toolroll 0.9.68 → 0.9.70

package/dist/serve.js

@@ -1,4 +1,6 @@
 import { taskMovedSince } from "./chat-ask.js";
+import { linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
+import { signInsUnavailableWords } from "./check-access.js";
 import { LIVE_VIEW_CONSENT, liveCommandsShown, liveViewConsentDigest } from "./live-detail.js";
 import { html, htmlString, jsonScript, textHtml } from "./html.js";
 import { browserAssetsAvailable, browserWorkspaceDocument } from './browser-shell.js';
@@ -14,6 +16,7 @@ import { boundProjectSummary, browserCrewFromIndex, browserCrewOf, browserNaviga
 import { sharedActionPayload } from './chat-actions.js';
 import { prepareCodingContext } from './coding-context.js';
 import { CodingWorkspace } from './coding-workspace.js';
+import { codingSessionPermissions } from './coding-provider.js';
 import { CONSOLE_FORMS, readForm } from "./contracts/console-api.js";
 import { createFlowRooms, flowFingerprint } from "./flow-live.js";
 import {} from "./google-mail.js";
@@ -193,7 +196,7 @@ export function createDecisionServer(options) {
         const database = store.handle.prepare('PRAGMA database_list').all().find(row => row['name'] === 'main')?.['file'];
         if (typeof database === 'string' && database !== '') {
             try {
-                coding = new CodingWorkspace({ database: `${database}.coding.sqlite`, worktreeRoot: join(dirname(database), 'coding-worktrees'), admissionPaused: () => updateAdmissionPaused(store.raw()), authorize: (actor, repo) => codingActorAllowed(actor) && codingProjectAllowed(repo), context: input => prepareCodingContext(store, { ...input, root: join(dirname(database), 'coding-context') }) });
+                coding = new CodingWorkspace({ database: `${database}.coding.sqlite`, worktreeRoot: join(dirname(database), 'coding-worktrees'), permissions: codingSessionPermissions(store, join(dirname(database), 'coding-worktrees')), admissionPaused: () => updateAdmissionPaused(store.raw()), authorize: (actor, repo) => codingActorAllowed(actor) && codingProjectAllowed(repo), context: input => prepareCodingContext(store, { ...input, root: join(dirname(database), 'coding-context') }) });
             }
             catch (error) {
                 codingProblem = error instanceof Error ? error.message : 'The coding workspace could not open.';
@@ -448,6 +451,14 @@ export function createDecisionServer(options) {
         access: projectAccessOf(repo),
         network: { setting: store.projectNetwork(repo), canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo) },
         writes: { setting: store.projectWrites(repo), canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo) },
+        sandbox: { setting: store.projectSandbox(repo), canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo) },
+        checkAccess: {
+            setting: store.projectCheckAccess(repo), changed: store.projectCheckAccessChange(repo),
+            canNarrow: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo),
+            canWiden: who.via === "cookie" && !store.isDemo() && store.isInstanceOperator(who.name),
+            unconfinedHere: !(options.fenceAvailable?.() ?? (macosFenceAvailable() || linuxFenceAvailable())) && store.unfencedAgentsAllowed(),
+            signInsUnavailable: signInsUnavailableWords(options.platform ?? process.platform),
+        },
         liveView: (() => {
             const commands = liveCommandsShown(store, repo);
             const canChange = who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo);

package/dist/server/http.d.ts

@@ -62,6 +62,8 @@ export type ServeOptions = {
     leadByDefault?: boolean;
     /** Test seam: the operating system the sign-in command is written for. */
     platform?: NodeJS.Platform;
+    /** Test seam: whether this machine has an OS fence (macOS sandbox or bubblewrap) for checks. */
+    fenceAvailable?: () => boolean;
     /** Extra Host values this server answers as (a Tailscale name, a LAN ip:port). */
     allowedHosts?: readonly string[];
     /**

package/dist/server/render-results.d.ts

@@ -1,4 +1,5 @@
 /** Results and runs: the review cockpit, evidence, receipts, diffs and the result panel. */
+import type { CheckAccess } from "../check-access.js";
 import type { RunNetworkRecord } from "../egress.js";
 import { type AssignmentSnapshot } from "../assignment.js";
 import { type BrowserCheckItem, type BrowserNeedAction, type BrowserResultPanel, type BrowserResultView } from "../browser-workspace.js";
@@ -184,6 +185,8 @@ export type ReviewCockpitView = {
     efficiency?: RunEfficiency | null;
     /** What the run's network was and what its proxy saw (egress.ts): display only. */
     network?: RunNetworkRecord | null;
+    /** How far its checks reached (check-access.ts): shown only when wider than sandboxed. */
+    checkAccess?: CheckAccess;
     taskId: string;
     title: string;
     repo: string | null;

package/dist/server/render-results.js

@@ -629,6 +629,7 @@ export function reviewCockpitDetailParts(view, csrf, noted, canRetryReview, tab,
         record: run === null ? null : { build: run.id, href: `/r/${run.id}?record=1`, facts: [
                 { label: "Agent", value: [run.provider, run.model].filter(Boolean).join(" · ") },
                 { label: "Worker", value: run.runner },
+                ...(view.checkAccess === undefined || view.checkAccess === "sandboxed" ? [] : [{ label: "Checks", value: view.checkAccess === "unsandboxed" ? "Checks ran without a sandbox" : "Checks ran with model and GitHub sign-ins" }]),
                 ...(run.branch === null ? [] : [{ label: "Branch", value: run.branch }]),
                 ...(run.finishedAt === null ? [] : [{ label: "Finished", value: when(run.finishedAt) }]),
                 ...(run.ranMinutes === null ? [] : [{ label: "Ran", value: `${run.ranMinutes} min` }]),

package/dist/server/render-tasks.js

@@ -1,6 +1,8 @@
 /** Task pages: approval, agents, plans, controls, decisions and the task body. */
 import { networkWords } from "../egress.js";
 import { writesWords } from "../writes-mode.js";
+import { checkAccessWords } from "../check-access.js";
+import { sandboxTermsWords } from "../project-sandbox.js";
 import { ACP_AGENTS, isAcpProfile } from "../acp-agents.js";
 import { html, htmlString, joinHtml, postForm, replaceMarkup, reauth } from "../html.js";
 import { closedQuestionReason, closedQuestionWords } from "../decision.js";
@@ -541,7 +543,9 @@ export function profileWords(scope) {
                 ? html `<p class="meta">Runs on <span class="mono">${ACP_AGENTS[profile.provider].name} (via ACP) · ${profile.model}</span> — full access inside the OS fence; the agent runs any tool it chooses and nothing asks. No turn limit: stops after ${Math.round(profile.timeoutSeconds / 60)} min, or ${Math.round(profile.idleTimeoutSeconds / 60)} min silent; repairs on ${repair}, ${Math.round(profile.repairTimeoutSeconds / 60)} min, or ${Math.round(profile.repairIdleTimeoutSeconds / 60)} min silent.</p>`
                 : html `<p class="meta">Runs on <span class="mono">${profile.provider} · ${profile.model}</span> — ${profile.sandboxMode === "danger-full-access" ? "FULL permissions via --dangerously-bypass-approvals-and-sandbox; nothing asks" : "workspace-write sandbox"}, no turn limit (${Math.round(profile.timeoutSeconds / 60)} min ${profile.timeoutKind === "idle" ? "without progress" : "per attempt"}); repairs on ${repair}, ${Math.round(profile.repairTimeoutSeconds / 60)} min</p>`;
     // What the build may reach is part of what is approved (egress.ts): said on every approval form.
-    return html `${base}<p class="meta" data-scope-network>${networkWords(profile.network ?? null)}</p><p class="meta" data-scope-writes>Writes: ${writesWords(profile.writes)}.</p>`;
+    // Its sandbox terms (project-sandbox.ts): what it reads always, and any widening, part of what the yes agrees to.
+    const terms = sandboxTermsWords(profile);
+    return html `${base}<p class="meta" data-scope-network>${networkWords(profile.network ?? null)}</p><p class="meta" data-scope-writes>Writes: ${writesWords(profile.writes)}.</p>${profile.checkAccess === undefined ? "" : html `<p class="meta" data-scope-checks>Checks: ${checkAccessWords(profile.checkAccess)}.</p>`}<p class="meta" data-scope-reads>Reads: ${terms.reads}.</p>${terms.mach === null ? "" : html `<p class="meta" data-scope-mach>${terms.mach.charAt(0).toUpperCase()}${terms.mach.slice(1)}.</p>`}`;
 }
 export const ROLE_NOUN = { plan: "Planner", build: "Builder", repair: "Repair", review: "Reviewer" };
 export function agentsStandingWords(view) {

package/dist/server/route-table.js

@@ -284,6 +284,8 @@ post("settings", "settings.project-concurrency", "/settings/project/concurrency"
 post("settings", "settings.project-live-view", "/settings/project/live-view", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-network", "/settings/project/network", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-writes", "/settings/project/writes", { scope: "step-up", callers: ["cookie"] });
+post("settings", "settings.project-check-access", "/settings/project/check-access", { scope: "step-up", callers: ["cookie"] });
+post("settings", "settings.project-sandbox", "/settings/project/sandbox", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-delete", "/settings/project/delete", { scope: "step-up", ...operator("An instance operator deletes projects.", "/settings/project") });
 // Lead sweeps (docs/plans/lead-fan-out.md): the table, and cancelling what isn't ready. The handler shows a sweep only in
 // a project the reader can see, and acts only for an approver.

package/dist/server/settings.js

@@ -81,6 +81,8 @@ import { checkPolicy, parseList, policyParts } from "../policy.js";
 import { parseProjectConcurrency, saveProjectConcurrency } from "../project-concurrency.js";
 import { MAX_NETWORK_HOSTS, normalizeHost } from "../egress.js";
 import { isWritesMode } from "../writes-mode.js";
+import { isCheckAccess, signInsUnavailableWords, widerThan } from "../check-access.js";
+import { parseMachLookup, parseReadDeny } from "../project-sandbox.js";
 import { projectDeleteConfirmHtml, projectSettingsHtml } from "../project-delete-ui.js";
 import { deleteProject, holdingsWords } from "../project-delete.js";
 import { applySavedKnowledge, changeKnowledge, knowledgeVersion, knowledgeView } from "../project-knowledge.js";
@@ -2485,6 +2487,8 @@ ${modeWords(terms)
         "settings.project-live-view": projectLiveView,
         "settings.project-network": projectNetwork,
         "settings.project-writes": projectWrites,
+        "settings.project-check-access": projectCheckAccess,
+        "settings.project-sandbox": projectSandbox,
         "settings.project-delete": projectDelete,
         "settings.policy-send": policySave,
         "settings.approval-send": approvalSave,
@@ -2587,5 +2591,65 @@ ${modeWords(terms)
         const changed = store.setProjectWrites(repo, wanted, who.name, now);
         return back("said", changed.before === changed.after ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
     }
+    // Settings → Project → Check access (check-access.ts). Widening is an instance operator's act with a password typed now
+    // (an identity-provider re-check doesn't count); any approver for the project narrows it. The level is compared again
+    // inside the write, so a change made meanwhile can't turn a narrowing into a widening. The ledger keeps before → after.
+    async function projectCheckAccess(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectCheckAccess);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes how far its checks reach.", "/settings/project");
+        const back = sayTo(response, `/settings/project?repo=${encodeURIComponent(repo)}`, "#check-access");
+        const wanted = body.get("level");
+        if (!isCheckAccess(wanted))
+            return back("problem", "Choose how far checks reach. Nothing changed.");
+        // Not available yet (check-access.ts signInsAvailable): refused before the password, whatever the form sent.
+        const unavailable = wanted === "sign-ins" ? signInsUnavailableWords(options.platform ?? process.platform) : null;
+        if (unavailable !== null)
+            return back("problem", `${unavailable} Nothing changed.`);
+        const widening = widerThan(wanted, store.projectCheckAccess(repo));
+        // Sign-ins with an open network: a second, explicit yes, said before the password.
+        if (wanted === "sign-ins" && widening && store.projectNetwork(repo).mode === "open" && body.get("confirm-open") !== "yes") {
+            return back("problem", "This project's network is open: confirm that its checks could send your sign-ins to any host. Nothing changed.");
+        }
+        const proved = authenticateCredential(who, body.get("password") ?? "");
+        if (!proved.ok)
+            return back("problem", "Enter your Toolroll password to change how far checks reach.");
+        if (widening && (proved.method !== "password-now" || !store.isInstanceOperator(who.name))) {
+            return back("problem", "Only an instance operator widens how far checks reach, with their password typed now. Nothing changed.");
+        }
+        const changed = store.setProjectCheckAccess(repo, wanted, who.name, now, { may: widening ? "widen" : "narrow" });
+        if (changed === null)
+            return back("problem", "Check access changed meanwhile, and this would now widen it. Nothing changed.");
+        return back("said", changed.before === changed.after ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
+    }
+    // Settings → Project → Home folder (project-sandbox.ts, sandbox parity C9): what the project's builds and checks may not
+    // read, and the macOS services they may also use. An approver for the project changes it with
+    // their password typed now; the ledger keeps before → after. New scopes seal it; approved ones keep theirs.
+    async function projectSandbox(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectSandbox);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes its sandbox.", "/settings/project");
+        const back = sayTo(response, `/settings/project?repo=${encodeURIComponent(repo)}`, "#sandbox");
+        const lines = (name) => (body.get(name) ?? "").split(/\r?\n/);
+        const parsed = { readDeny: parseReadDeny(lines("read-deny")), machLookup: parseMachLookup(lines("mach")) };
+        for (const one of Object.values(parsed))
+            if (!one.ok)
+                return back("problem", `${one.problem.charAt(0).toUpperCase()}${one.problem.slice(1)}. Nothing changed.`);
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
+            return back("problem", "Enter your Toolroll password to change the project's sandbox.");
+        const wanted = { readDeny: parsed.readDeny.ok ? parsed.readDeny.list : [], machLookup: parsed.machLookup.ok ? parsed.machLookup.list : [] };
+        const changed = store.setProjectSandbox(repo, wanted, who.name, now);
+        if (changed === null)
+            return back("problem", "An approver for this project changes its sandbox. Nothing changed.");
+        return back("said", JSON.stringify(changed.before) === JSON.stringify(changed.after) ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
+    }
     return { registrations, modelsView };
 }

package/dist/server/tasks.js

@@ -2846,6 +2846,8 @@ export function createTasksHandlers(runtime) {
             } })(),
             // What its network was and what its proxy saw (egress.ts), display only.
             network: store.runNetwork(run.id),
+            // How far its checks reached (check-access.ts), display only.
+            checkAccess: store.runCheckAccess(run.id),
             reviewRetry: store.reviewRetryStateOf(run.id),
             review: reviewFactsFor(run.id),
             notes: store.notesForRun(run.id),

package/dist/store.d.ts

@@ -1,5 +1,8 @@
 import { type WritesMode } from "./writes-mode.js";
-import { type ProjectNetwork, type RunNetworkRecord } from "./egress.js";
+import { type CheckAccess } from "./check-access.js";
+import { type ProjectSandbox } from "./project-sandbox.js";
+import type { FencePolicy } from "./agent-fence.js";
+import { type NetworkProfile, type ProjectNetwork, type RunNetworkRecord } from "./egress.js";
 import { type AcpLaunch } from "./acp-attest.js";
 import { type ChatBinding } from "./chat-core.js";
 import { ChatMessages, TELEGRAM_HOLD_REASONS, TELEGRAM_SKIPPED_ELSEWHERE, TELEGRAM_SKIPPED_OTHER_CHAT, TELEGRAM_SKIPPED_QUIET } from "./chat-messages.js";
@@ -179,7 +182,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 131;
+export declare const SCHEMA_VERSION = 133;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export declare const V118_MERGED_TABLES: Readonly<Record<string, CredentialKind>>;
 /**
@@ -318,6 +321,10 @@ export declare const V129_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record
 export declare const CONFINEMENT_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_network (\n  repo          TEXT PRIMARY KEY,\n  network_json  TEXT NOT NULL CHECK (length(network_json) <= 16384),\n  updated_at    TEXT NOT NULL,\n  updated_by    TEXT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS confinement_setting (\n  id               INTEGER PRIMARY KEY CHECK (id = 1),\n  unfenced_allowed INTEGER NOT NULL DEFAULT 0 CHECK (unfenced_allowed IN (0, 1)),\n  updated_at       TEXT,\n  updated_by       TEXT\n);\nINSERT OR IGNORE INTO confinement_setting (id, unfenced_allowed) VALUES (1, 0);\n";
 /** v131: where a project's builds may write (an approver's setting, agent-fence.ts WritesMode). */
 export declare const PROJECT_WRITES_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_writes (\n  repo        TEXT PRIMARY KEY,\n  mode        TEXT NOT NULL CHECK (mode IN ('workspace', 'anywhere')),\n  updated_at  TEXT NOT NULL,\n  updated_by  TEXT NOT NULL\n);\n";
+/** v132: how far a project's checks reach beyond the check fence (check-access.ts CheckAccess). */
+export declare const PROJECT_CHECK_ACCESS_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_check_access (\n  repo        TEXT PRIMARY KEY,\n  level       TEXT NOT NULL CHECK (level IN ('sandboxed', 'sign-ins', 'unsandboxed')),\n  updated_at  TEXT NOT NULL,\n  updated_by  TEXT NOT NULL\n);\n";
+/** v133: a project's sandbox settings (project-sandbox.ts): JSON lists, each sorted, distinct and valid. */
+export declare const PROJECT_SANDBOX_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_sandbox (\n  repo              TEXT PRIMARY KEY,\n  read_deny_json    TEXT NOT NULL DEFAULT '[]',\n  mach_lookup_json  TEXT NOT NULL DEFAULT '[]',\n  updated_at        TEXT NOT NULL,\n  updated_by        TEXT NOT NULL\n);\n";
 /** v129: a finished run's How it ran, derived from its own records on first view (display only: never a verdict). Its
  * parser version says when to derive again; `steps` says how complete the step detail was, and why not. */
 export declare const RUN_EFFICIENCY_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_efficiency (\n  run             INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  parser_version  INTEGER NOT NULL,\n  steps           TEXT NOT NULL CHECK (steps IN ('complete','truncated','expired','absent')),\n  steps_reason    TEXT,\n  payload_json    TEXT NOT NULL CHECK (length(payload_json) <= 16384),\n  derived_at      TEXT NOT NULL\n);\n";
@@ -6135,6 +6142,9 @@ export declare class Store {
     recordRunFence(run: number, fence: {
         method: string;
         paths: number;
+        policy?: 1 | 2;
+        digest?: string;
+        engine?: string;
     }, now: Date): void;
     /** What one attempt's network was and what its proxy saw (egress.ts), kept beside its fence. */
     recordRunNetwork(run: number, network: RunNetworkRecord, now: Date): void;
@@ -6142,6 +6152,9 @@ export declare class Store {
     runFence(run: number): {
         method: string;
         paths: number;
+        policy?: 1 | 2;
+        digest?: string;
+        engine?: string;
     } | null;
     runTools(run: number): {
         tools: {
@@ -7174,6 +7187,50 @@ export declare class Store {
      * removed or expired — any of those means the composer's draft was accepted and must not be sent again). */
     leadRequestReceived(session: number, request: string): boolean;
     forgetQueuedLeadMessage(message: number): void;
+    /** How far a project's checks reach beyond the check fence: its saved level, or sandboxed. */
+    projectCheckAccess(repo: string): CheckAccess;
+    /** Who last changed a project's check access, and when (null: never changed). */
+    projectCheckAccessChange(repo: string): {
+        by: string;
+        at: string;
+    } | null;
+    /** The level a run's setup and checks ran at (its sealed approval's, or unsandboxed where no OS fence exists). Its
+     * follow-up and batch checks never run wider than this. */
+    stampRunCheckAccess(runId: number, level: CheckAccess, network?: NetworkProfile | null): void;
+    /** The network a run's sign-ins checks ran under (null: none sealed; such a run's later checks run sandboxed). */
+    runCheckNetwork(runId: number): NetworkProfile | null;
+    /** The level a run's checks ran at: missing or unreadable reads as sandboxed. */
+    runCheckAccess(runId: number): CheckAccess;
+    /** A project's check access changed: saved, and in the ledger as before → after. `may` is what the caller proved:
+     * "widen" only after an instance operator's password typed now; anything else may only narrow. The level is read again
+     * and compared in the same transaction as the write, so a change made while the caller was proving itself can't turn
+     * a narrowing into a widening. Refused: null, nothing written. */
+    setProjectCheckAccess(repo: string, level: CheckAccess, by: string, now: Date, authority: {
+        may: "narrow" | "widen";
+    }): {
+        before: CheckAccess;
+        after: CheckAccess;
+    } | null;
+    /** The scout's browser ran outside Toolroll's fence under its launch contract (scout-browser.ts): which exception. */
+    recordRunBrowser(run: number, browser: {
+        containment: string;
+        tool: string;
+    }, now: Date): void;
+    runBrowser(run: number): {
+        containment: string;
+        tool: string;
+    } | null;
+    /** A project's sandbox settings (project-sandbox.ts): its saved lists, or none. A damaged row keeps what it can read
+     * of its read denies (never fewer) and grants nothing else. */
+    projectSandbox(repo: string): ProjectSandbox;
+    /** An approver changed a project's sandbox settings (their password was proved by the caller): saved whole, and in
+     * the ledger as before → after. The account is proved again inside the write. Refused: null, nothing written. */
+    setProjectSandbox(repo: string, wanted: ProjectSandbox, by: string, now: Date): {
+        before: ProjectSandbox;
+        after: ProjectSandbox;
+    } | null;
+    /** The fence policy a flow was made under (agent-fence.ts FencePolicy): v2 for one made from 0.9.70; v1 otherwise. */
+    flowFencePolicy(flow: number): FencePolicy;
 }
 /** The receipt a bot's first pairing writes over pre-pairing history: an
  * explicit skip, with no delivered timestamp and no attempt, so suppressed

package/dist/store.js

@@ -1,5 +1,7 @@
 import { WRITES_DEFAULT } from "./writes-mode.js";
-import { PROJECT_NETWORK_DEFAULT, projectNetworkFromValue, runNetworkFromValue } from "./egress.js";
+import { checkAccessOf, widerThan } from "./check-access.js";
+import { PROJECT_SANDBOX_DEFAULT, sandboxOf } from "./project-sandbox.js";
+import { networkFromValue, PROJECT_NETWORK_DEFAULT, projectNetworkFromValue, runNetworkFromValue } from "./egress.js";
 import { isAcpProfile, isAcpProvider } from "./acp-agents.js";
 import { ACP_CONFORMANCE_VERSION, launchFromJson } from "./acp-attest.js";
 import { reclaimDatabase } from "./database-reclaim.js";
@@ -718,7 +720,12 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // (confinement_setting, one row; off unless an instance operator turns it on).
 // v131 adds, and changes no saved row: where a project's builds may write (project_writes; agent-fence.ts, docs/plans/
 // agent-baseline-hardening.md arc 2) — only their workspace unless an approver chose anywhere.
-export const SCHEMA_VERSION = 131;
+// v132 adds, and changes no saved row: how far a project's checks reach beyond the check fence (project_check_access;
+// check-access.ts, docs/plans/check-access.md) — sandboxed unless an instance operator widened it.
+// v133 adds, and changes no saved row: a project's sandbox settings (project_sandbox; project-sandbox.ts,
+// docs/plans/sandbox-parity.md C9) — what its builds may not read, the macOS services and protected files they may — and
+// the fence policy a flow was made under (flow.fence_policy; saved flows read NULL: v1, the home configuration denied).
+export const SCHEMA_VERSION = 133;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -851,7 +858,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -988,6 +995,25 @@ CREATE TABLE IF NOT EXISTS project_writes (
   updated_by  TEXT NOT NULL
 );
 `;
+/** v132: how far a project's checks reach beyond the check fence (check-access.ts CheckAccess). */
+export const PROJECT_CHECK_ACCESS_SCHEMA = `
+CREATE TABLE IF NOT EXISTS project_check_access (
+  repo        TEXT PRIMARY KEY,
+  level       TEXT NOT NULL CHECK (level IN ('sandboxed', 'sign-ins', 'unsandboxed')),
+  updated_at  TEXT NOT NULL,
+  updated_by  TEXT NOT NULL
+);
+`;
+/** v133: a project's sandbox settings (project-sandbox.ts): JSON lists, each sorted, distinct and valid. */
+export const PROJECT_SANDBOX_SCHEMA = `
+CREATE TABLE IF NOT EXISTS project_sandbox (
+  repo              TEXT PRIMARY KEY,
+  read_deny_json    TEXT NOT NULL DEFAULT '[]',
+  mach_lookup_json  TEXT NOT NULL DEFAULT '[]',
+  updated_at        TEXT NOT NULL,
+  updated_by        TEXT NOT NULL
+);
+`;
 /** v129: a finished run's How it ran, derived from its own records on first view (display only: never a verdict). Its
  * parser version says when to derive again; `steps` says how complete the step detail was, and why not. */
 export const RUN_EFFICIENCY_SCHEMA = `
@@ -3923,6 +3949,15 @@ function initializeStore(db, file) {
     db.exec(CONFINEMENT_SCHEMA);
     // v131: where a project's builds may write (a new table only).
     db.exec(PROJECT_WRITES_SCHEMA);
+    // v132: how far a project's checks reach beyond the check fence (a new table), and the level each build's checks ran
+    // at (run.sandbox_access; saved rows read NULL: sandboxed).
+    db.exec(PROJECT_CHECK_ACCESS_SCHEMA);
+    addColumn(db, "run", "sandbox_access", "TEXT");
+    addColumn(db, "run", "sandbox_network", "TEXT");
+    // v133: a project's sandbox settings (a new table), and the fence policy each flow was made under (saved flows: NULL,
+    // read as v1).
+    db.exec(PROJECT_SANDBOX_SCHEMA);
+    addColumn(db, "flow", "fence_policy", "INTEGER");
     // v123: a flow that runs on its own (flow-unattended.ts): its grants and daily runs (new tables), and which authority
     // armed a plan's unchanged-plan approval (plan_authorization.basis, V123_ADDED_COLUMNS: saved rows read the mode).
     db.exec(FLOW_UNATTENDED_SCHEMA);
@@ -6729,6 +6764,23 @@ export class Store {
                     .get(taskId);
                 if (writtenByLead !== undefined)
                     return false;
+                // CHECK ACCESS (v132, check-access.ts): a scope whose checks reach beyond the fence (sign-ins, or no sandbox at
+                // all) seals only on a person's password ceremony — never a mode, a grant, a chat confirmation or a carry.
+                const profileText = this.db.prepare("SELECT profile_json FROM task_scope WHERE task_id = ?").get(taskId)?.["profile_json"];
+                let sealedAccess;
+                // SANDBOX WIDENINGS (v133, project-sandbox.ts): extra macOS services seal, likewise,
+                // only on a person's own password yes to exactly them.
+                let sandboxWidened = false;
+                try {
+                    const stored = typeof profileText === "string" ? JSON.parse(profileText) : null;
+                    sealedAccess = stored?.profile?.["checkAccess"];
+                    sandboxWidened = stored?.profile?.["machLookup"] !== undefined;
+                }
+                catch {
+                    sealedAccess = "unreadable";
+                }
+                if (sealedAccess !== undefined || sandboxWidened)
+                    return false;
             }
             // SEPARATION OF DUTIES (v102), enforced in the primitive so no road
             // around it exists: a project's rules can refuse the requester, and
@@ -15223,7 +15275,8 @@ export class Store {
     // ---- flows (v81) -------------------------------------------------------------
     createFlow(flow, now) {
         const stamp = now.toISOString();
-        return Number(this.db.prepare("INSERT INTO flow (repo, name, definition_json, revision, state, created_by, created_at, updated_by, updated_at) VALUES (?, ?, ?, 1, 'active', ?, ?, ?, ?)")
+        // A flow made from 0.9.70 on runs under fence policy v2 (agent-fence.ts FencePolicy); one made before stays v1.
+        return Number(this.db.prepare("INSERT INTO flow (repo, name, definition_json, revision, state, created_by, created_at, updated_by, updated_at, fence_policy) VALUES (?, ?, ?, 1, 'active', ?, ?, ?, ?, 2)")
             .run(flow.repo, flow.name, flowDefinitionForStore(flow.definitionJson), flow.by, stamp, flow.by, stamp).lastInsertRowid);
     }
     /** Hand a flow to another person: its "the owner decides" zones ask them from now on. */
@@ -18987,6 +19040,115 @@ export class Store {
         this.db.prepare("UPDATE lead_queue SET context_json = NULL WHERE message = ?").run(message);
         this.db.prepare("DELETE FROM memory_search WHERE kind = 'conversation' AND ref = ?").run(`message:${message}`);
     }
+    // ---- check access (v132, check-access.ts). Kept last in the class: the freshness tripwire pins method positions.
+    /** How far a project's checks reach beyond the check fence: its saved level, or sandboxed. */
+    projectCheckAccess(repo) {
+        // A damaged row reads as the narrowest level, never a wider one.
+        return checkAccessOf(this.db.prepare("SELECT level FROM project_check_access WHERE repo = ?").get(repo)?.["level"]);
+    }
+    /** Who last changed a project's check access, and when (null: never changed). */
+    projectCheckAccessChange(repo) {
+        const row = this.db.prepare("SELECT updated_by, updated_at FROM project_check_access WHERE repo = ?").get(repo);
+        return row === undefined ? null : { by: String(row["updated_by"]), at: String(row["updated_at"]) };
+    }
+    /** The level a run's setup and checks ran at (its sealed approval's, or unsandboxed where no OS fence exists). Its
+     * follow-up and batch checks never run wider than this. */
+    stampRunCheckAccess(runId, level, network = null) {
+        this.db.prepare("UPDATE run SET sandbox_access = ?, sandbox_network = ? WHERE id = ?").run(level, network === null ? null : JSON.stringify(network), runId);
+    }
+    /** The network a run's sign-ins checks ran under (null: none sealed; such a run's later checks run sandboxed). */
+    runCheckNetwork(runId) {
+        const text = this.db.prepare("SELECT sandbox_network FROM run WHERE id = ?").get(runId)?.["sandbox_network"];
+        if (typeof text !== "string")
+            return null;
+        try {
+            return networkFromValue(JSON.parse(text));
+        }
+        catch {
+            return null;
+        }
+    }
+    /** The level a run's checks ran at: missing or unreadable reads as sandboxed. */
+    runCheckAccess(runId) {
+        return checkAccessOf(this.db.prepare("SELECT sandbox_access FROM run WHERE id = ?").get(runId)?.["sandbox_access"]);
+    }
+    /** A project's check access changed: saved, and in the ledger as before → after. `may` is what the caller proved:
+     * "widen" only after an instance operator's password typed now; anything else may only narrow. The level is read again
+     * and compared in the same transaction as the write, so a change made while the caller was proving itself can't turn
+     * a narrowing into a widening. Refused: null, nothing written. */
+    setProjectCheckAccess(repo, level, by, now, authority) {
+        return this.transact(() => {
+            const before = this.projectCheckAccess(repo);
+            // Who is acting is proved again here too: an account revoked, demoted or moved off the project while its password
+            // was being checked changes nothing.
+            const account = this.accountOf(by);
+            if (account === null || account.revokedAt !== null || account.role !== "approver" || !this.accountCanAccess(by, repo))
+                return null;
+            if (widerThan(level, before) && (authority.may !== "widen" || !this.isInstanceOperator(by)))
+                return null;
+            this.db.prepare(`INSERT INTO project_check_access (repo, level, updated_at, updated_by) VALUES (?, ?, ?, ?)
+        ON CONFLICT (repo) DO UPDATE SET level = excluded.level, updated_at = excluded.updated_at, updated_by = excluded.updated_by`).run(repo, level, now.toISOString(), by);
+            const after = this.projectCheckAccess(repo);
+            this.recordPolicy(by, repo, "check access", before, after, now);
+            return { before, after };
+        });
+    }
+    // ---- sandbox parity (docs/plans/sandbox-parity.md). Kept last in the class: the freshness tripwire pins positions.
+    /** The scout's browser ran outside Toolroll's fence under its launch contract (scout-browser.ts): which exception. */
+    recordRunBrowser(run, browser, now) {
+        const json = JSON.stringify(browser);
+        this.db.prepare(`INSERT INTO run_tool (run, tools_json, created_at) VALUES (?, json_object('browser', json(?)), ?)
+      ON CONFLICT (run) DO UPDATE SET tools_json = json_set(tools_json, '$.browser', json(?))`).run(run, json, now.toISOString(), json);
+    }
+    runBrowser(run) {
+        const row = this.db.prepare("SELECT json_extract(tools_json, '$.browser') AS browser FROM run_tool WHERE run = ?").get(run);
+        if (row === undefined || row["browser"] === null)
+            return null;
+        try {
+            const parsed = JSON.parse(String(row["browser"]));
+            return typeof parsed.containment === "string" && typeof parsed.tool === "string" ? { containment: parsed.containment, tool: parsed.tool } : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** A project's sandbox settings (project-sandbox.ts): its saved lists, or none. A damaged row keeps what it can read
+     * of its read denies (never fewer) and grants nothing else. */
+    projectSandbox(repo) {
+        const row = this.db.prepare("SELECT read_deny_json, mach_lookup_json FROM project_sandbox WHERE repo = ?").get(repo);
+        if (row === undefined)
+            return { ...PROJECT_SANDBOX_DEFAULT };
+        const read = (text) => { try {
+            return typeof text === "string" ? JSON.parse(text) : null;
+        }
+        catch {
+            return null;
+        } };
+        return sandboxOf({ readDeny: read(row["read_deny_json"]), machLookup: read(row["mach_lookup_json"]) });
+    }
+    /** An approver changed a project's sandbox settings (their password was proved by the caller): saved whole, and in
+     * the ledger as before → after. The account is proved again inside the write. Refused: null, nothing written. */
+    setProjectSandbox(repo, wanted, by, now) {
+        return this.transact(() => {
+            const account = this.accountOf(by);
+            if (account === null || account.revokedAt !== null || account.role !== "approver" || !this.accountCanAccess(by, repo))
+                return null;
+            const before = this.projectSandbox(repo);
+            const clean = sandboxOf(wanted);
+            this.db.prepare(`INSERT INTO project_sandbox (repo, read_deny_json, mach_lookup_json, updated_at, updated_by) VALUES (?, ?, ?, ?, ?)
+        ON CONFLICT (repo) DO UPDATE SET read_deny_json = excluded.read_deny_json, mach_lookup_json = excluded.mach_lookup_json,
+        updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
+                .run(repo, JSON.stringify(clean.readDeny), JSON.stringify(clean.machLookup), now.toISOString(), by);
+            const after = this.projectSandbox(repo);
+            const words = (one) => `read-deny ${one.readDeny.length === 0 ? "none" : one.readDeny.join(",")}; mach ${one.machLookup.length === 0 ? "none" : one.machLookup.join(",")}`;
+            this.recordPolicy(by, repo, "sandbox", words(before), words(after), now);
+            return { before, after };
+        });
+    }
+    /** The fence policy a flow was made under (agent-fence.ts FencePolicy): v2 for one made from 0.9.70; v1 otherwise. */
+    flowFencePolicy(flow) {
+        return this.db.prepare("SELECT fence_policy FROM flow WHERE id = ?").get(flow)?.["fence_policy"] === 2 ? 2 : 1;
+    }
 }
 /** A stored count or id that must be a whole, non-negative number — a
  * NULL, an empty string, a fraction, or text reads as null (v48 authority repair). */

package/dist/subagent-tools.d.ts

@@ -13,6 +13,7 @@ export type ToolIo = {
     callTool?: ToolCaller;
     listTools?: ToolLister;
     toolHome?: string | undefined;
+    fenceAvailable?: () => boolean;
 };
 /** Actions whose names say they only read start as "do it"; everything else asks first until its manager says otherwise. */
 export declare const READ_VERB: RegExp;

package/dist/subagent-tools.js

@@ -19,7 +19,7 @@
 import { redactSecretLines, scanForSecrets } from "./evidence.js";
 import { scrubSecrets } from "./flow-secrets.js";
 import { toolRefusal } from "./policy.js";
-import { callProjectTool, listProjectToolActions, projectToolsOf, readToolSecrets } from "./project-tools.js";
+import { callProjectTool, listProjectToolActions, projectToolsOf, readToolSecrets, toolServerFor } from "./project-tools.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
 /** Actions whose names say they only read start as "do it"; everything else asks first until its manager says otherwise. */
 export const READ_VERB = /^(get|list|search|find|read|fetch|lookup|look_up|query|show|describe|count|check|view|retrieve)([_.-]|$)/i;
@@ -113,13 +113,15 @@ export async function refreshGrants(store, mate, now, io) {
         const tool = tools.find(one => one.name === grant.tool);
         if (tool === undefined)
             continue;
-        const listed = await listed_(tool, mate.repo, io);
+        const listed = await listed_(store, tool, mate.repo, io);
         if (!listed.ok)
             continue;
         store.saveSubagentGrant({ subagent: mate.id, tool: grant.tool, ...withActions(grant.rules, listed.actions), listedAt: now.toISOString() }, grant.updatedBy, now);
     }
 }
-const listed_ = (tool, repo, io) => (io.listTools ?? ((spec, values) => listProjectToolActions(spec, values, { timeoutMs: 60_000, omitEnv: ALL_CREDENTIAL_ENV })))(tool.spec, readToolSecrets(repo, tool.name, io.toolHome));
+const listed_ = (store, tool, repo, io) => (io.listTools ?? ((spec, values) => listProjectToolActions(spec, values, { timeoutMs: 60_000, omitEnv: ALL_CREDENTIAL_ENV, server: serverOf(store, repo, io) })))(tool.spec, readToolSecrets(repo, tool.name, io.toolHome));
+/** Where a subagent's tool server starts: in the server fence (project-tools.ts toolServerFor), never bare. */
+const serverOf = (store, repo, io) => toolServerFor(store, repo, { ...(io.toolHome === undefined ? {} : { home: io.toolHome }), ...(io.fenceAvailable === undefined ? {} : { available: io.fenceAvailable }) });
 /** Names only, from the tool's last test: what a grant starts with when it can't be listed right now. */
 const namesOnly = (tool) => (tool.lastTest?.tools ?? []).map(name => ({ name, about: "", input: null, readOnly: false }));
 /** Let a subagent use one of the project's tools. Its actions start at their defaults: reading is free, everything else asks first. */
@@ -129,7 +131,7 @@ export async function grantTool(store, mate, tool, by, now, io = {}) {
         return { ok: false, said: `This project has no tool called ${tool}. Add it on the Tools page first.` };
     if (store.subagentGrant(mate.id, tool) !== null)
         return { ok: true, said: `It can already use ${tool}.` };
-    const listed = await listed_(found, mate.repo, io);
+    const listed = await listed_(store, found, mate.repo, io);
     return grantListed(store, mate, found, listed.ok ? listed.actions : null, by, now);
 }
 /** A grant from what the tool offers (or, not reachable now, the names its last test found). */
@@ -219,7 +221,7 @@ export async function makeCall(store, call, repo, io, now, options = {}) {
     const values = readToolSecrets(repo, tool.name, io.toolHome);
     let answer;
     try {
-        answer = await (io.callTool ?? ((spec, secrets, name, given) => callProjectTool(spec, secrets, name, given, { timeoutMs: 120_000, omitEnv: ALL_CREDENTIAL_ENV })))(tool.spec, values, call.action, call.input);
+        answer = await (io.callTool ?? ((spec, secrets, name, given) => callProjectTool(spec, secrets, name, given, { timeoutMs: 120_000, omitEnv: ALL_CREDENTIAL_ENV, server: serverOf(store, repo, io) })))(tool.spec, values, call.action, call.input);
     }
     catch (error) {
         answer = { ok: false, problem: error instanceof Error ? error.message : "It couldn't be reached." };

package/dist/surface.js

@@ -353,6 +353,7 @@ const GUIDE_ROWS = [
     operator("runner bind", "replace which repositories a worker may build in"),
     operator("runner capacity", "set how many tasks a worker runs at once; running work carries on, the new number applies at the next claim"),
     operator("project checks", "show or set a project's batch checks (--batch on|off, off by default): results that finish within 10 minutes share one full check on a temporary batch commit; nothing is merged into a real branch"),
+    operator("project check-access", "show or set how far a project's checks reach: sandboxed (the default), with model and GitHub sign-ins, or not sandboxed; an instance operator widens it with a password typed now"),
     operator("project concurrency", "set how many of a project's tasks build at once (default 2, never past the worker's capacity); running work carries on"),
     operator("coordinator mint", "mint the MCP filing credential — repo-bound, rate-limited, token shown once"),
     operator("coordinator revoke", "revoke an MCP filing credential"),
@@ -450,7 +451,7 @@ const REMOTE_STEP_UP = [
     // A person's own API tokens: a password step-up on the server's machine, or the console. Never with a token.
     "tokens create", "tokens list", "tokens revoke", "tokens rotate",
     "mode show", "mode set", "mode revoke", "chat-approval on", "review on", "review off", "config set", "config clear",
-    "verify set", "verify clear", "verify level", "project checks", "project concurrency", "intake grant", "intake clear", "webhook primary",
+    "verify set", "verify clear", "verify level", "project checks", "project check-access", "project concurrency", "intake grant", "intake clear", "webhook primary",
 ];
 const REMOTE_YES = [
     "status", "integrations", "ready", "gaps", "grants", "sync", "audit",

package/dist/tool-broker.d.ts

@@ -19,9 +19,10 @@ export type BrokerOptions = {
     /** Why a local server may not start unwrapped (no fence for it here), read when it would; null when it may. */
     unwrapped?: () => string | null;
     /** How a local server is started inside its run's fence, read when it starts (the fence is fixed after the tools). */
-    wrap?: () => ((file: string, args: readonly string[]) => {
+    wrap?: () => ((file: string, args: readonly string[], cwd?: string) => {
         file: string;
         args: string[];
+        env?: Record<string, string>;
     }) | null;
 };
 export type ToolBroker = {