toolroll 0.9.68 → 0.9.70

package/dist/operate.js

@@ -112,6 +112,9 @@ import { claimActor, currentActor, withActor } from "./actor.js";
 import { parseLeadToken } from "./api-tokens.js";
 import { MAX_NETWORK_HOSTS, normalizeHost } from "./egress.js";
 import { isWritesMode, writesWords } from "./writes-mode.js";
+import { linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
+import { parseMachLookup, parseReadDeny, readDenyWords } from "./project-sandbox.js";
+import { CHECK_ACCESS_WARNINGS, checkAccessRunsAs, checkAccessWords, isCheckAccess, signInHostsMissing, signInsUnavailableWords, widerThan } from "./check-access.js";
 import { CLI_PASSWORD_SOURCE, withPasswordSource } from "./sign-in-guard.js";
 import { admissionRecorded, admitProject, commandLineActor } from "./project-admission.js";
 import { leadClaim, leadSay, noteLeadWork } from "./lead-voice.js";
@@ -265,6 +268,9 @@ export const OPERATE_HELP = `toolroll — operating the queue
                                         where the project's builds may write: only their checkout, caches and temp
                                         (workspace, the default), or anywhere outside Toolroll's fenced folders;
                                         an approver changes it (new scopes seal it; approved ones keep theirs)
+  toolroll project check-access --repo <p> [sandboxed|sign-ins|unsandboxed]
+                                        how far the project's checks reach: sandboxed (the default), with model
+                                        and GitHub sign-ins, or not sandboxed; an instance operator widens it
   toolroll config unconfined-agents [allow|refuse]
                                         whether builds run where this machine can't confine them (instance operator)
   toolroll project concurrency [<n>] --repo <p>
@@ -686,6 +692,8 @@ export const OPERATE_VALUE_FLAGS = new Set([
     "token-name",
     // task pause / task steer --now: the asker's own request id, so a repeat is the same request.
     "request",
+    // project sandbox (sandbox parity C9): read denies and macOS services.
+    "read-deny", "mach",
 ]);
 export const OPERATE_BOOLEAN_FLAGS = new Set([
     "json", "yes", "all", "brief", "local", "history", "latest-watch", "dry-run", "file",
@@ -916,6 +924,8 @@ async function dispatchOn(command, positional, flags, repoList, base, options, e
             ...(options.flowTriggerIo === undefined ? {} : { flowTriggerIo: options.flowTriggerIo }),
             ...(options.flowStepIo === undefined ? {} : { flowStepIo: options.flowStepIo }),
             ...(options.flowEveryMs === undefined ? {} : { flowEveryMs: options.flowEveryMs }),
+            ...(options.platform === undefined ? {} : { platform: options.platform }),
+            ...(options.fenceAvailable === undefined ? {} : { fenceAvailable: options.fenceAvailable }),
             ...(options.flowFetch === undefined ? {} : { flowFetch: options.flowFetch }),
             ...(options.integrationIo === undefined ? {} : { integrationIo: options.integrationIo }),
             ...(options.shouldStop === undefined ? {} : { shouldStop: options.shouldStop }),
@@ -1171,6 +1181,10 @@ async function dispatch(command, positional, flags, context) {
                 return projectNetworkCommand(positional, flags, context);
             if (positional[0] === "writes")
                 return projectWritesCommand(positional, flags, context);
+            if (positional[0] === "check-access")
+                return projectCheckAccessCommand(positional, flags, context);
+            if (positional[0] === "sandbox")
+                return projectSandboxCommand(positional, flags, context);
             if (positional[0] === "checks")
                 return projectChecksCommand(positional, flags, context);
             if (positional[0] === "demo")
@@ -11567,3 +11581,108 @@ export function ownValueFlags(command, argv) {
         return PROJECT_NETWORK_VALUE_FLAGS;
     return undefined;
 }
+// Last in the file, so the password tripwire's function positions (password-freshness.test.ts) stay as reviewed.
+/**
+ * `project check-access --repo <p> [sandboxed|sign-ins|unsandboxed]` (check-access.ts): how far the project's setup
+ * and check commands reach beyond the check fence. Widening is an instance operator's act with a password typed now
+ * (never a remembered sign-in or a single sign-on recheck); any approver for the project may narrow it back to
+ * sandboxed. New scopes seal it; approved ones keep theirs. The ledger keeps before → after.
+ */
+async function projectCheckAccessCommand(positional, flags, context) {
+    const command = "project check-access";
+    const allowed = new Set(["repo", "as", "token", "token-file", "token-env", "db", "json"]);
+    for (const name of flags.keys())
+        if (!allowed.has(name))
+            return fail(context.write, context.json, command, "usage", `--${name} is not a project check-access option.`, EXIT.usage);
+    const repoFlag = text(flags, "repo");
+    const wanted = positional[1];
+    if (positional.length > 2 || repoFlag === undefined || (wanted !== undefined && !isCheckAccess(wanted)))
+        return fail(context.write, context.json, command, "usage", "Use project check-access --repo <project path> [sandboxed | sign-ins | unsandboxed].", EXIT.usage);
+    const repo = await knownProject(context, repoFlag, { listed: true, canonical: true });
+    if (repo === undefined)
+        return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
+    const current = context.store.projectCheckAccess(repo);
+    const platform = context.platform ?? process.platform;
+    // How it actually runs here: with no OS fence and unconfined running allowed, without a sandbox whatever is saved; on
+    // a saved sign-ins level (off for now) runs sandboxed. Said, never hidden.
+    const fenced = context.fenceAvailable?.() ?? (macosFenceAvailable() || linuxFenceAvailable());
+    const runsAs = (one) => checkAccessRunsAs(one, { platform, fenced, unconfinedAllowed: context.store.unfencedAgentsAllowed() });
+    const here = runsAs(current);
+    const words = (one) => {
+        if (runsAs(one) === "unsandboxed" && one !== "unsandboxed")
+            return [`${repo}: saved as ${checkAccessWords(one)}, but this machine can't sandbox checks, so they run without a sandbox.`];
+        if (runsAs(one) !== one)
+            return [`${repo}: saved with model and GitHub sign-ins, but its checks run sandboxed: sign-ins can't be shared with checks safely yet.`];
+        const missing = one === "sign-ins" ? signInHostsMissing(context.store.projectNetwork(repo)) : [];
+        return [`${repo}: checks run ${checkAccessWords(one)}.`, ...(one === "sandboxed" ? [] : [CHECK_ACCESS_WARNINGS[one]]),
+            // Never added for it: the operator widens the network separately, with their own password.
+            ...(missing.length === 0 ? [] : [`Model sign-ins need these hosts in this project's network allowlist: ${missing.join(", ")}. Add them with: toolroll project network --repo ${repo} --allow ${missing.join(",")}`])];
+    };
+    if (wanted === undefined)
+        return succeed(context.write, context.json, command, { repo, checkAccess: current, ...(here === current ? {} : { runsAs: here }), ...(here === "sign-ins" ? { missingHosts: signInHostsMissing(context.store.projectNetwork(repo)) } : {}) }, () => words(current));
+    // Not available yet (check-access.ts signInsAvailable): refused before any password is asked for, nothing written.
+    const unavailable = wanted === "sign-ins" ? signInsUnavailableWords(platform) : null;
+    if (unavailable !== null)
+        return fail(context.write, context.json, command, "refused", unavailable, EXIT.refused);
+    const widening = widerThan(wanted, current);
+    const acting = await askCredentials(flags, context);
+    const proved = acting === null ? null : authenticateApprover(context.store, acting.name, acting.token, repo);
+    if (widening) {
+        // Wider reach exposes the operator's own sign-ins or machine: an instance operator, with a password typed for this.
+        if (acting === null || proved === null || !proved.ok || proved.method !== "password-now" || !context.store.isInstanceOperator(acting.name)) {
+            return fail(context.write, context.json, command, "refused", "An instance operator widens what a project's checks reach, with their password typed now: pass --as and --token.", EXIT.refused);
+        }
+    }
+    else if (acting === null || proved === null || !proved.ok || !credentialProof(proved.method) || !context.store.accountCanAccess(acting.name, repo)) {
+        return fail(context.write, context.json, command, "refused", "An approver for this project narrows what its checks reach, with their password: pass --as and --token.", EXIT.refused);
+    }
+    // The level is compared again inside the write: a change made while the password was asked for can't widen it here.
+    const changed = context.store.setProjectCheckAccess(repo, wanted, acting.name, context.clock(), { may: widening ? "widen" : "narrow" });
+    if (changed === null)
+        return fail(context.write, context.json, command, "refused", "The project's check access changed meanwhile, and this would now widen it: an instance operator widens it, with their password typed now.", EXIT.refused);
+    return succeed(context.write, context.json, command, { repo, before: changed.before, checkAccess: changed.after }, () => [
+        ...words(changed.after),
+        "Scopes written from now on use this; scopes already approved keep what they were approved with.",
+    ]);
+}
+/**
+ * `project sandbox --repo <p> [--read-deny <a,b>] [--mach <a,b>]` (project-sandbox.ts, sandbox parity C9): what the
+ * project's builds and checks may not read (paths, `~/…` or absolute) and the macOS services they may also use. Each list is replaced whole by its flag (an empty value clears it). New scopes seal it;
+ * approved ones keep theirs. Changing it is an approver's act with a password, kept in the ledger as before → after.
+ */
+async function projectSandboxCommand(positional, flags, context) {
+    const command = "project sandbox";
+    const allowed = new Set(["repo", "read-deny", "mach", "as", "token", "token-file", "token-env", "db", "json"]);
+    for (const name of flags.keys())
+        if (!allowed.has(name))
+            return fail(context.write, context.json, command, "usage", `--${name} is not a project sandbox option.`, EXIT.usage);
+    const repoFlag = text(flags, "repo");
+    if (positional.length > 1 || repoFlag === undefined)
+        return fail(context.write, context.json, command, "usage", "Use project sandbox --repo <project path> [--read-deny <paths>] [--mach <services>] (comma-separated; empty clears).", EXIT.usage);
+    const repo = await knownProject(context, repoFlag, { listed: true, canonical: true });
+    if (repo === undefined)
+        return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
+    const words = (one) => [`${repo}: ${readDenyWords(one.readDeny)}`,
+        ...(one.machLookup.length === 0 ? [] : [`macOS services also allowed: ${one.machLookup.join(", ")}`])];
+    const current = context.store.projectSandbox(repo);
+    const asked = (name) => { const value = flags.get(name); return value === undefined ? undefined : value === true ? [] : value.split(","); };
+    const changes = { readDeny: asked("read-deny"), machLookup: asked("mach") };
+    if (changes.readDeny === undefined && changes.machLookup === undefined)
+        return succeed(context.write, context.json, command, { repo, sandbox: current }, () => words(current));
+    const parsed = { readDeny: parseReadDeny(changes.readDeny ?? current.readDeny), machLookup: parseMachLookup(changes.machLookup ?? current.machLookup) };
+    for (const [name, one] of Object.entries(parsed))
+        if (!one.ok)
+            return fail(context.write, context.json, command, "usage", `${name}: ${one.problem}. Nothing changed.`, EXIT.usage);
+    const wanted = { readDeny: parsed.readDeny.ok ? parsed.readDeny.list : [], machLookup: parsed.machLookup.ok ? parsed.machLookup.list : [] };
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : credentialApprover(context.store, acting.name, acting.token, repo);
+    if (acting === null || !verified?.ok || !context.store.accountCanAccess(acting.name, repo))
+        return fail(context.write, context.json, command, "refused", "An approver for this project changes its sandbox, with their password: pass --as and --token.", EXIT.refused);
+    const changed = context.store.setProjectSandbox(repo, wanted, acting.name, context.clock());
+    if (changed === null)
+        return fail(context.write, context.json, command, "refused", "An approver for this project changes its sandbox. Nothing changed.", EXIT.refused);
+    return succeed(context.write, context.json, command, { repo, before: changed.before, sandbox: changed.after }, () => [
+        ...words(changed.after),
+        "Scopes written from now on use this; scopes already approved keep what they were approved with.",
+    ]);
+}

package/dist/project-delete-ui.d.ts

@@ -1,11 +1,7 @@
-/**
- * Settings → Project: what Toolroll holds for a project, and deleting
- * it. An instance operator deletes in two steps: type the project's name,
- * then read exactly what goes and confirm with their password (or a fresh
- * sign-in with the identity provider). The repository itself stays.
- */
+import type { ProjectSandbox } from "./project-sandbox.js";
 import type { ProjectNetwork } from "./egress.js";
 import type { WritesMode } from "./writes-mode.js";
+import { type CheckAccess } from "./check-access.js";
 import { type Html } from "./html.js";
 import { type ProjectHoldings } from "./project-delete.js";
 export declare const PROJECT_DELETE_CSS: string;
@@ -50,6 +46,27 @@ export type ProjectSettingsView = {
         setting: WritesMode;
         canChange: boolean;
     };
+    /** What its builds and checks may not read, and the macOS services and protected files they may still use
+     * (project-sandbox.ts), and whether this person may change it. */
+    sandbox?: {
+        setting: ProjectSandbox;
+        canChange: boolean;
+    };
+    /** How far its checks reach (check-access.ts): the level, who changed it last, and whether this person may narrow it
+     * (an approver for the project) or also widen it (an instance operator). */
+    checkAccess?: {
+        setting: CheckAccess;
+        changed: {
+            by: string;
+            at: string;
+        } | null;
+        canNarrow: boolean;
+        canWiden: boolean;
+        /** This machine can't sandbox checks at all, and an operator allowed them to run anyway: every level runs unsandboxed. */
+        unconfinedHere?: boolean;
+        /** Why sign-ins can't be chosen (off for now), or null: they can. */
+        signInsUnavailable?: string | null;
+    };
 };
 /** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
 export declare function projectSettingsHtml(view: ProjectSettingsView, notice: {

package/dist/project-delete-ui.js

@@ -1,3 +1,11 @@
+/**
+ * Settings → Project: what Toolroll holds for a project, and deleting
+ * it. An instance operator deletes in two steps: type the project's name,
+ * then read exactly what goes and confirm with their password (or a fresh
+ * sign-in with the identity provider). The repository itself stays.
+ */
+import { sandboxRuntimeWords } from "./sandbox-runtime.js";
+import { CHECK_ACCESS_WARNINGS, signInHostsMissing } from "./check-access.js";
 import { html, postForm, reauth } from "./html.js";
 import { holdingsWords } from "./project-delete.js";
 export const PROJECT_DELETE_CSS = `.project-settings,.project-delete{max-width:720px;min-width:0}.project-settings .path,.project-delete .path{font-family:var(--font-mono);font-size:.8125rem;overflow-wrap:anywhere;word-break:break-all}` +
@@ -13,6 +21,21 @@ export const PROJECT_DELETE_CSS = `.project-settings,.project-delete{max-width:7
     `.project-settings .build-access .tool-name{font:var(--so-typography-mono)}.project-settings .build-access details{margin:4px 0 0}.project-settings .build-access summary{min-height:44px;display:inline-flex;align-items:center;cursor:pointer;color:var(--so-muted);font:var(--so-typography-label)}` +
     `.project-settings .build-access ul{margin:0 0 4px;padding-left:20px;font:var(--so-typography-body);color:var(--so-ink)}.project-settings .build-access li{margin:2px 0}.project-settings .build-access li .meta{color:var(--so-muted)}` +
     `.project-settings .build-access a.manage-tools{display:inline-flex;align-items:center;justify-content:center;min-height:44px;margin-top:4px;padding:0 14px;white-space:nowrap;background:var(--so-paper);color:var(--so-ink);border:1px solid var(--so-input-line);border-radius:var(--so-radius-md);font:var(--so-typography-label);text-decoration:none}` +
+    // A radio or checkbox choice sits beside its words, at its natural size, not as a full-width grid row.
+    `.project-settings .build-access label.check{display:flex;align-items:center;gap:8px;min-height:44px;font:var(--so-typography-body);font-weight:500}` +
+    `.project-settings .build-access label.check input{width:auto;min-height:0;margin:0;flex:none}.project-settings .build-access form .meta{margin:-8px 0 0 26px}` +
+    // Check access: a warning shows only under the option chosen; the folds draw the console's own chevron (as a diff's).
+    `.project-settings .check-access-setting .option .warning{display:none;color:var(--so-ink)}.project-settings .check-access-setting .option:has(input:checked) .warning{display:block}` +
+    `.project-settings .check-access-setting form{margin-top:0;gap:10px}.project-settings .check-access-setting .option{display:grid;gap:2px}` +
+    `.project-settings .check-access-setting .option .meta{margin:0 0 0 26px}.project-settings .check-access-setting label.check{min-height:36px}` +
+    `.project-settings .check-access-setting details > summary{list-style:none;display:flex;align-items:center;gap:10px;min-height:40px;padding:0}` +
+    `.project-settings .check-access-setting details > summary::-webkit-details-marker{display:none}.project-settings .check-access-setting details > summary::marker{content:""}` +
+    `.project-settings .check-access-setting details > summary::before{content:"";flex:none;width:.35rem;height:.35rem;border-right:1.5px solid var(--so-muted);border-bottom:1.5px solid var(--so-muted);transform:rotate(-45deg);transition:transform .15s ease}` +
+    `.project-settings .check-access-setting details[open] > summary::before{transform:rotate(45deg) translateY(-.1rem)}` +
+    // Show hosts: a quiet fold in the line, not a card.
+    `.project-settings .check-access-setting details.hosts{border:0;background:none;padding:0;margin:0}.project-settings .check-access-setting details.hosts > summary{min-height:32px;font-size:.8125rem}` +
+    `.project-settings .check-access-setting details.hosts .tool-name{margin:0 0 4px;font-size:.75rem}` +
+    `.project-settings .check-access-setting button.primary{background:var(--so-signal);color:var(--so-on-signal);border-color:var(--so-signal)}` +
     `.project-settings .build-access a.manage-tools:hover{background:var(--so-raised)}.project-settings .build-access a.manage-tools:focus-visible,.project-settings .build-access summary:focus-visible{outline:2px solid var(--so-ink);outline-offset:2px}`;
 /** Where builds may write, said plainly; an approver changes it with their password. */
 function writesHtml(view) {
@@ -33,6 +56,76 @@ function writesHtml(view) {
     <button type="submit">Save</button>`, { hidden: { repo: view.repo } });
     return html `<section class="build-access writes-setting" id="writes" aria-labelledby="writes-title"><h2 id="writes-title">Where builds write</h2>${said}<details><summary>Change</summary>${form}</details></section>`;
 }
+/** Home folder (project-sandbox.ts): what builds and checks can read there, said once; the paths they can't, and the
+ * advanced list (macOS services), changed under Change with the approver's password. */
+function sandboxHtml(view) {
+    const sandbox = view.sandbox;
+    if (sandbox === undefined)
+        return "";
+    const { readDeny, machLookup } = sandbox.setting;
+    const said = readDeny.length === 0
+        ? html `<p>Builds and checks can read your home folder, as in Anthropic's sandbox runtime. Toolroll's own folders stay out of reach; other tasks' work is read, never written.</p>`
+        : html `<p>Builds and checks can read your home folder except <strong>${readDeny.length === 1 ? readDeny[0] : `${readDeny.length} paths`}</strong>.</p>`;
+    const extra = machLookup.length === 0 ? "" : html `<p class="meta">${machLookup.length} macOS ${machLookup.length === 1 ? "service" : "services"} allowed</p>`;
+    // The engine, named where the sandbox is set (sandbox-runtime.ts).
+    const engine = html `<p class="meta" data-sandbox-engine>Builds, checks and flows run in ${sandboxRuntimeWords()}.</p>`;
+    const head = html `<h2 id="sandbox-title">Home folder</h2>${said}${extra}${engine}`;
+    if (!sandbox.canChange)
+        return html `<section class="build-access sandbox-setting" id="sandbox" aria-labelledby="sandbox-title">${head}<p class="meta">An approver for this project can change this.</p></section>`;
+    const form = postForm("/settings/project/sandbox", html `
+    <label>Paths builds can't read<textarea name="read-deny" rows="4" placeholder="~/.ssh&#10;~/.aws">${readDeny.join("\n")}</textarea></label>
+    <p class="meta">One per line: <code>~/…</code> or a full path.</p>
+    <details><summary>Advanced</summary>
+      <label>macOS services builds may also use<textarea name="mach" rows="2">${machLookup.join("\n")}</textarea></label>
+    </details>
+    <p class="meta">Tasks scoped from now on use this; tasks already approved keep what they were approved with.</p>
+    ${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}
+    <button type="submit">Save</button>`, { hidden: { repo: view.repo } });
+    return html `<section class="build-access sandbox-setting" id="sandbox" aria-labelledby="sandbox-title">${head}<details><summary>Change</summary>${form}</details></section>`;
+}
+/** Check access (check-access.ts): how far the project's checks reach, said once. Collapsed: the level, what it means
+ * when it isn't the default, and who changed it. Inside Change: a line per level, and each wider level's warning under it
+ * only while it is chosen. An instance operator widens it with a password typed now; an approver narrows it. */
+function checkAccessHtml(view) {
+    const access = view.checkAccess;
+    if (access === undefined)
+        return "";
+    const saved = access.setting;
+    // Sign-ins aren't available (off for now): a saved sign-ins level runs sandboxed, and the page says so.
+    const unavailable = access.signInsUnavailable ?? null;
+    const setting = unavailable !== null && saved === "sign-ins" ? "sandboxed" : saved;
+    const network = view.network?.setting ?? null;
+    const names = { sandboxed: "Sandboxed", "sign-ins": "Sandboxed, with model and GitHub sign-ins", unsandboxed: "Not sandboxed" };
+    const meaning = { sandboxed: null, "sign-ins": "Checks can read your Claude, Codex and GitHub sign-ins.", unsandboxed: "Checks run with your full access to this machine and to Toolroll." };
+    // The sign-ins never widen the network: how many hosts they'd still need, and where to add them (a change of its own).
+    const missing = setting === "sign-ins" && network !== null ? signInHostsMissing(network) : [];
+    const hosts = missing.length === 0 ? "" : html `<p class="meta" data-sign-in-hosts>${missing.length} sign-in ${missing.length === 1 ? "host isn't" : "hosts aren't"} allowed yet · <a href="#network">Add them</a></p><details class="hosts"><summary>Show hosts</summary><p class="tool-name">${missing.join(", ")}</p></details>`;
+    const changed = access.changed === null ? "" : html `<p class="meta">Changed by ${access.changed.by}, ${new Date(access.changed.at).toLocaleDateString("en-GB", { day: "numeric", month: "short", timeZone: "UTC" })}</p>`;
+    // Said before anything else: on a machine with no OS sandbox, every level runs without one.
+    const unconfined = access.unconfinedHere === true ? html `<p class="meta warning-line" data-unconfined-here>This machine can't sandbox checks, so they run without a sandbox whatever is chosen here.</p>` : "";
+    const runsSandboxed = setting !== saved && access.unconfinedHere !== true ? html `<p class="meta warning-line" data-sign-ins-unavailable>Saved with model and GitHub sign-ins, but checks run sandboxed: sign-ins can't be shared with checks safely yet.</p>` : "";
+    // No OS sandbox here, and unconfined running allowed: checks run without a sandbox whatever is saved, and that is
+    // what the page says first (never "sandboxed"); the saved level is named under it.
+    const head = access.unconfinedHere === true
+        ? html `<h2 id="check-access-title">Check access</h2><p><strong>${names.unsandboxed}</strong></p>${saved === "unsandboxed" ? "" : html `<p class="meta" data-saved-level>Saved as ${names[saved]}.</p>`}${unconfined}${changed}`
+        : html `<h2 id="check-access-title">Check access</h2><p><strong>${names[setting]}</strong></p>${meaning[setting] === null ? "" : html `<p class="meta">${meaning[setting]}</p>`}${runsSandboxed}${hosts}${changed}`;
+    if (!access.canNarrow && !access.canWiden)
+        return html `<section class="build-access check-access-setting" id="check-access" aria-labelledby="check-access-title">${head}</section>`;
+    const option = (value, detail, warning) => {
+        const allowed = (value === setting || access.canWiden || value === "sandboxed") && !(value === "sign-ins" && unavailable !== null);
+        return html `<div class="option"><label class="check"><input type="radio" name="level" value="${value}"${setting === value ? html ` checked` : ""}${allowed ? "" : html ` disabled`}> ${names[value]}</label><p class="meta">${detail}</p>${warning === null ? "" : html `<p class="meta warning" data-check-access-warning="${value}">${warning}</p>`}</div>`;
+    };
+    const open = network?.mode === "open";
+    const form = postForm("/settings/project/check-access", html `
+    ${option("sandboxed", "Reads your home folder, as in Anthropic's sandbox runtime, except the folders this project hides (Home folder, above). Never Toolroll's folders or other tasks' work.", null)}
+    ${unavailable !== null ? option("sign-ins", unavailable, null) : option("sign-ins", `Also reads the files your Claude, Codex and GitHub sign-ins are kept in, on this project's network (${open ? "any host" : network === null || network.hosts.length === 0 ? "registries only" : `registries and ${network.hosts.length} ${network.hosts.length === 1 ? "host" : "hosts"}`}).`, CHECK_ACCESS_WARNINGS["sign-ins"])}
+    ${option("unsandboxed", "For projects whose checks create sandboxes themselves, such as Toolroll's own.", CHECK_ACCESS_WARNINGS.unsandboxed)}
+    ${open && unavailable === null ? html `<label class="check"><input type="checkbox" name="confirm-open" value="yes"> The network is open: with sign-ins, checks could send them to any host</label>` : ""}
+    ${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}
+    <button type="submit" class="primary">Save</button>
+    <p class="meta">${access.canWiden ? "" : "Only an instance operator can widen this. "}Flow script steps always run sandboxed. Tasks already approved keep their level.</p>`, { hidden: { repo: view.repo } });
+    return html `<section class="build-access check-access-setting" id="check-access" aria-labelledby="check-access-title">${head}<details class="change"><summary>Change</summary>${form}</details></section>`;
+}
 /** Network: what the project's builds may reach, said plainly; an approver changes it with their password. */
 function networkHtml(view) {
     const network = view.network;
@@ -111,7 +204,7 @@ export function projectSettingsHtml(view, notice) {
     const remote = html `<section class="build-access recorded-remote" aria-labelledby="recorded-remote-title"><h2 id="recorded-remote-title">Recorded remote</h2>${view.remoteUrl
         ? html `<p class="path">${view.remoteUrl}</p>`
         : html `<p>No remote recorded. Landed work waits for your review.</p>`}<details><summary>Change remote</summary><p>An owner or instance operator can run:</p><p class="path">toolroll repos add &lt;project&gt; --remote &lt;url&gt;</p></details></section>`;
-    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${remote}${buildsHtml(view)}${accessHtml(view)}${networkHtml(view)}${writesHtml(view)}${liveViewHtml(view)}`;
+    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${remote}${buildsHtml(view)}${accessHtml(view)}${networkHtml(view)}${writesHtml(view)}${sandboxHtml(view)}${checkAccessHtml(view)}${liveViewHtml(view)}`;
     if (!view.canDelete)
         return html `<section class="project-settings">${head}<p class="meta">An instance operator can delete a project.</p></section>`;
     const body = view.running.length > 0

package/dist/project-sandbox.d.ts

@@ -0,0 +1,59 @@
+export type ProjectSandbox = {
+    readDeny: string[];
+    machLookup: string[];
+};
+export declare const PROJECT_SANDBOX_DEFAULT: ProjectSandbox;
+export declare const MAX_READ_DENY = 100;
+export declare const MAX_MACH_LOOKUP = 30;
+/** A read-deny entry: `~/…` (the home folder of whoever runs the build) or an absolute path; normalized, no `..`, no
+ * pattern; `~` or `/` alone never (that would deny everything a build needs). */
+export declare function validReadDeny(one: string): boolean;
+/** Services no project can add, whatever it asks: the keychain and security services, the pasteboard, Launch Services
+ * and Apple Events (what a build would open or script another application with), the privacy database, the window
+ * server. Each name or prefix here matches the service and everything beneath it. */
+export declare const MACH_NEVER: readonly string[];
+/** A mach service a project may add: an exact reverse-DNS name, or a prefix ending `.*` after at least three labels
+ * (`com.example.tool.*`); never one of MACH_NEVER, nor a prefix that would reach one. */
+export declare function validMachLookup(one: string): boolean;
+/** Entries as a setting keeps them: trimmed, distinct, sorted; refused whole when any is invalid or there are too many. */
+export declare function parseSandboxList(lines: readonly string[], valid: (one: string) => boolean, max: number): {
+    ok: true;
+    list: string[];
+} | {
+    ok: false;
+    problem: string;
+};
+export declare const parseReadDeny: (lines: readonly string[]) => {
+    ok: true;
+    list: string[];
+} | {
+    ok: false;
+    problem: string;
+};
+export declare const parseMachLookup: (lines: readonly string[]) => {
+    ok: true;
+    list: string[];
+} | {
+    ok: false;
+    problem: string;
+};
+/** A stored or sealed setting, read strictly: anything unreadable reads as the narrowest (no extra services) but keeps
+ * whatever read-denies are valid (never fewer than were asked for). */
+export declare function sandboxOf(raw: {
+    readDeny?: unknown;
+    machLookup?: unknown;
+}): ProjectSandbox;
+/** A read-deny entry as the path it names for a launch whose home folder is `home`. */
+export declare const readDenyPath: (one: string, home: string) => string;
+/** What an approval's sandbox terms say, one line each, for every surface that asks for a yes (scope.ts describeScope,
+ * the console's scope view): the fence policy and its read denies always, the macOS services when there are any. */
+export declare function sandboxTermsWords(profile: {
+    fencePolicy?: 2;
+    readDeny?: readonly string[];
+    machLookup?: readonly string[];
+}): {
+    reads: string;
+    mach: string | null;
+};
+/** The setting in a sentence, for the CLI and the settings page. */
+export declare function readDenyWords(list: readonly string[]): string;

package/dist/project-sandbox.js

@@ -0,0 +1,83 @@
+/**
+ * A project's sandbox settings (docs/plans/sandbox-parity.md C9), an approver's, each sealed into new scopes:
+ *
+ * - `readDeny`: what its builds and checks may not read (Anthropic's sandbox runtime `denyRead`). Under fence policy v2
+ *   the home folder is readable as in the sandbox runtime; this is how a project hides `~/.ssh` and the like again.
+ *   Narrowing only: it applies to running launches' next start too (flows, coding sessions read it live).
+ * - `machLookup`: macOS services its builds may also reach (the sandbox runtime `allowMachLookup`), for toolchains the
+ *   deny-default baseline breaks (Go's TLS, Playwright). Widening: sealed, and only a person's password yes seals it.
+ */
+import { isAbsolute, normalize } from "node:path";
+export const PROJECT_SANDBOX_DEFAULT = { readDeny: [], machLookup: [] };
+export const MAX_READ_DENY = 100;
+export const MAX_MACH_LOOKUP = 30;
+/** A read-deny entry: `~/…` (the home folder of whoever runs the build) or an absolute path; normalized, no `..`, no
+ * pattern; `~` or `/` alone never (that would deny everything a build needs). */
+export function validReadDeny(one) {
+    if (one.length === 0 || one.length > 400 || one.includes("\0") || /[*?[\]{}]/.test(one))
+        return false;
+    const path = one.startsWith("~/") ? one.slice(2) : isAbsolute(one) ? one.slice(1) : null;
+    if (path === null || path === "" || path.endsWith("/"))
+        return false;
+    return path.split("/").every(part => part !== "" && part !== "." && part !== "..") && normalize(`/${path}`) === `/${path}`;
+}
+/** Services no project can add, whatever it asks: the keychain and security services, the pasteboard, Launch Services
+ * and Apple Events (what a build would open or script another application with), the privacy database, the window
+ * server. Each name or prefix here matches the service and everything beneath it. */
+export const MACH_NEVER = ["com.apple.security", "com.apple.SecurityServer", "com.apple.securityd", "com.apple.pasteboard",
+    "com.apple.coreservices.launchservicesd", "com.apple.lsd", "com.apple.coreservices.appleevents", "com.apple.tccd", "com.apple.windowserver",
+    "com.apple.CoreServices.coreservicesd"];
+/** A mach service a project may add: an exact reverse-DNS name, or a prefix ending `.*` after at least three labels
+ * (`com.example.tool.*`); never one of MACH_NEVER, nor a prefix that would reach one. */
+export function validMachLookup(one) {
+    if (one.length > 200)
+        return false;
+    const prefix = one.endsWith(".*");
+    const name = prefix ? one.slice(0, -2) : one;
+    const labels = name.split(".");
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]*(\.[A-Za-z0-9_@-]+)+$/.test(name) || labels.length < (prefix ? 3 : 2))
+        return false;
+    const lower = name.toLowerCase();
+    return !MACH_NEVER.some(never => { const blocked = never.toLowerCase(); return lower === blocked || lower.startsWith(blocked) || (prefix && blocked.startsWith(`${lower}.`)); });
+}
+/** Entries as a setting keeps them: trimmed, distinct, sorted; refused whole when any is invalid or there are too many. */
+export function parseSandboxList(lines, valid, max) {
+    const list = [...new Set(lines.map(one => one.trim()).filter(one => one !== ""))].sort();
+    const bad = list.find(one => !valid(one));
+    if (bad !== undefined)
+        return { ok: false, problem: `“${bad.slice(0, 80)}” isn't a valid entry` };
+    if (list.length > max)
+        return { ok: false, problem: `at most ${max} entries` };
+    return { ok: true, list };
+}
+export const parseReadDeny = (lines) => parseSandboxList(lines, validReadDeny, MAX_READ_DENY);
+export const parseMachLookup = (lines) => parseSandboxList(lines, validMachLookup, MAX_MACH_LOOKUP);
+/** A stored or sealed setting, read strictly: anything unreadable reads as the narrowest (no extra services) but keeps
+ * whatever read-denies are valid (never fewer than were asked for). */
+export function sandboxOf(raw) {
+    const strings = (value) => Array.isArray(value) ? value.filter((one) => typeof one === "string") : [];
+    const readDeny = parseReadDeny(strings(raw.readDeny));
+    const mach = parseMachLookup(strings(raw.machLookup));
+    return {
+        readDeny: readDeny.ok ? readDeny.list : strings(raw.readDeny).filter(validReadDeny),
+        machLookup: mach.ok ? mach.list : [],
+    };
+}
+/** A read-deny entry as the path it names for a launch whose home folder is `home`. */
+export const readDenyPath = (one, home) => one.startsWith("~/") ? `${home}/${one.slice(2)}` : one;
+/** What an approval's sandbox terms say, one line each, for every surface that asks for a yes (scope.ts describeScope,
+ * the console's scope view): the fence policy and its read denies always, the macOS services when there are any. */
+export function sandboxTermsWords(profile) {
+    const reads = profile.fencePolicy === 2
+        ? `your home folder, as in Anthropic's sandbox runtime${(profile.readDeny ?? []).length === 0 ? "" : `, except ${(profile.readDeny ?? []).join(", ")}`}; never Toolroll's own folders; other tasks' work read, never written`
+        : "not your home folder's credentials and agent settings (approved before home reads opened)";
+    return {
+        reads,
+        mach: (profile.machLookup ?? []).length === 0 ? null : `also reaches these macOS services: ${(profile.machLookup ?? []).join(", ")}`,
+    };
+}
+/** The setting in a sentence, for the CLI and the settings page. */
+export function readDenyWords(list) {
+    return list.length === 0 ? "Builds and checks can read your home folder, as in Anthropic's sandbox runtime; Toolroll's own folders stay out of reach, and other tasks' work is read, never written."
+        : `Builds and checks can read your home folder except ${list.length === 1 ? list[0] : `${list.length} paths (${list.slice(0, 3).join(", ")}${list.length > 3 ? ", …" : ""})`}.`;
+}

package/dist/project-tools.d.ts

@@ -1,6 +1,6 @@
 import type { Store, ToolActionInfo } from "./store.js";
 import { type BrokerOptions } from "./tool-broker.js";
-import type { FenceMethod } from "./agent-fence.js";
+import { type FenceMethod, type LaunchFence } from "./agent-fence.js";
 import type { ProviderId } from "./contracts/provider.js";
 import { type SecretStoreKind } from "./tool-secret-store.js";
 import { type ToolSecret, type ToolSpec } from "./contracts/integration-metadata.js";
@@ -105,10 +105,11 @@ export type FoundTool = {
  */
 export declare function discoverTools(repo: string, codexServers: unknown[] | null, home?: string, environment?: NodeJS.ProcessEnv): FoundTool[];
 /** Start the server once, ask for its tools, and stop it: the proof a build can use it. */
-export declare function testTool(spec: ToolSpec, values: Record<string, string>, options?: {
+export declare function testTool(spec: ToolSpec, values: Record<string, string>, options: {
     timeoutMs?: number;
     env?: NodeJS.ProcessEnv;
     omitEnv?: readonly string[];
+    server: ToolServer;
 }): Promise<{
     ok: true;
     tools: string[];
@@ -121,10 +122,11 @@ export declare function testTool(spec: ToolSpec, values: Record<string, string>,
  * its description, what input it takes, and whether it says it only reads.
  * A subagent is offered these, each under its own rule.
  */
-export declare function listProjectToolActions(spec: ToolSpec, values: Record<string, string>, options?: {
+export declare function listProjectToolActions(spec: ToolSpec, values: Record<string, string>, options: {
     timeoutMs?: number;
     env?: NodeJS.ProcessEnv;
     omitEnv?: readonly string[];
+    server: ToolServer;
 }): Promise<{
     ok: true;
     actions: ToolActionInfo[];
@@ -146,10 +148,11 @@ export type ToolCall = {
  * "Use a tool" step. The answer's text parts are kept; a tool that says it
  * failed (isError) is an answer, not trouble reaching it.
  */
-export declare function callProjectTool(spec: ToolSpec, values: Record<string, string>, name: string, args: Record<string, unknown>, options?: {
+export declare function callProjectTool(spec: ToolSpec, values: Record<string, string>, name: string, args: Record<string, unknown>, options: {
     timeoutMs?: number;
     env?: NodeJS.ProcessEnv;
     omitEnv?: readonly string[];
+    server: ToolServer;
 }): Promise<ToolCall>;
 /** The exact servers one launch gets, and those left out with why (`repo`: the project, from the run's record). */
 export type ToolLaunch = {
@@ -259,10 +262,11 @@ export declare function addToolTo(store: ToolWrites, repo: string, input: ToolSp
 /** Take one tool away from every build now, with its stored secrets. */
 export declare function removeToolFrom(store: ToolWrites, repo: string, name: string, by: string, now: Date, home?: string): boolean;
 /** Test one tool of a project and keep the answer on it. */
-export declare function testToolOf(store: ToolWrites, repo: string, name: string, now: Date, options?: {
+export declare function testToolOf(store: ToolWrites & ToolServerStore, repo: string, name: string, now: Date, options?: {
     home?: string | undefined;
     timeoutMs?: number;
     omitEnv?: readonly string[];
+    available?: () => boolean;
 }): Promise<ToolTest | null>;
 /** Where a tool stands, in a few words: what a person reads first. */
 export declare function toolStanding(tool: ProjectTool, secretsSet: readonly string[]): {
@@ -289,3 +293,23 @@ export declare function toolSecretStorage(): {
 };
 /** A command line split into program and arguments, honouring "double" and 'single' quotes. */
 export declare function splitCommandLine(line: string): string[];
+/** What a tool server started outside a build needs of the store: the plane's own records of its state and pools. */
+export type ToolServerStore = Pick<Store, "databaseFile" | "listWorktrees" | "unfencedAgentsAllowed">;
+/** How a tool server started outside a build runs (toolServerFor): inside `fence`, or with none where there is nothing to
+ * fence (a store with no database file) or an instance operator allowed unconfined agents; or not at all. */
+export type ToolServer = {
+    fence: LaunchFence | null;
+} | {
+    problem: string;
+};
+/**
+ * The server fence for a project tool started outside a build (docs/plans/sandbox-parity.md C2): discovery, its Test
+ * button, a flow's "Use a tool" step, a subagent's call. As the broker's servers are fenced: Toolroll's state, every
+ * other launch's folder and the checkout pools denied, and nothing a build writes (its project's caches) read, so no
+ * byte a build wrote can load into a process that holds the tool's secrets. Required: where this machine can't confine
+ * it, it doesn't start unless an instance operator allowed unconfined agents.
+ */
+export declare function toolServerFor(store: ToolServerStore, repo: string, options?: {
+    home?: string;
+    available?: () => boolean;
+}): ToolServer;