toolroll 0.9.69 → 0.9.71

package/dist/invoke.js

@@ -29,15 +29,18 @@ import { witnessedRunner } from "./process-custody.js";
 import { underStopWatch } from "./task-control.js";
 import { childDatabaseEnv, isolatedChildDatabase, removeChildDatabase as removeAgentDatabase } from "./child-database.js";
 import { RunSignInError, noToolsArgs, prepareRunTools } from "./project-tools.js";
+import { createHash } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { poolRootOf } from "./worktree.js";
-import { BRIDGE_DIR, checkLaunchRoot, readGrantedFile, SIGN_IN_COPIES_DIR, signInCopiesRoot, signInGrants } from "./agent-fence.js";
+import { checkLaunchRoot, signInGrants, signInIsItself } from "./agent-fence.js";
 import { CHECK_ACCESS_DEFAULT, checkAccessHere, narrowestAccess, narrowestNetwork, signInsAvailable } from "./check-access.js";
-import { agentFence, buildCacheEnv, buildCacheFolder, grantFolder, writeAllowlist, WRITES_DEFAULT, CheckoutBindingError, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, codexFenceArgv, fenceGrants, fencedGitEnv, linuxFenceAvailable, linuxFenced, macosFenceAvailable, macosFenced, NO_GRANTS, runFolders, taskBoundary } from "./agent-fence.js";
+import { readDenyPath } from "./project-sandbox.js";
+import { sandboxRuntimeWords } from "./sandbox-runtime.js";
+import { canonicalJson } from "./canonical-json.js";
+import { buildCacheEnv, buildCacheFolder, grantFolder, writeAllowlist, WRITES_DEFAULT, CheckoutBindingError, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, codexFenceArgv, fenceFor, fencedGitEnv, LEGACY_SANDBOX, launchSandboxOf, linuxFenceAvailable, macosFenceAvailable, NO_GRANTS, sandboxedSpawn, serverGrantsOf, runFolders, taskBoundary } from "./agent-fence.js";
 import { proxyEnv, providerOnlyNetwork, repositoryEcosystems, resolveNetwork, startEgressProxy } from "./egress.js";
-import { bridgeFits, startEgressBridge } from "./egress-bridge.js";
 import { claudeConfigDir, claudeDefaults, codexDefaults, codexHomeDir, isolatedCodexHome } from "./provider-home.js";
 import { billingOf, claudeBillingFrom, seenBilling } from "./spend.js";
 /** "Within seconds": how soon a silent failed run must end for its stderr to
@@ -242,7 +245,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // re-supply survives resolveChildEnv's chat-key strip); in
     // "subscription" mode the key is STRIPPED from the child so the CLI's
     // own login is used — its key is retained, just not handed over.
-    const { runner, clock: _clock, versionProbe: _probe, keyHome, timeoutMs: _hardTimeout, idleTimeoutMs: _idleTimeout, stdin: _callerStdin, accumulateUsage: _accumulateUsage, liveInput: _liveInput, acpCheck: _acpCheck, network: launchNetwork, writes: launchWrites, ...runOptions } = options;
+    const { runner, clock: _clock, versionProbe: _probe, keyHome, timeoutMs: _hardTimeout, idleTimeoutMs: _idleTimeout, stdin: _callerStdin, accumulateUsage: _accumulateUsage, liveInput: _liveInput, acpCheck: _acpCheck, network: launchNetwork, writes: launchWrites, sandbox: launchSandbox, ...runOptions } = options;
     // The live setting is read STRICTLY (atomic authority closure): a
     // present mode file that says neither word is a value-shaped refusal
     // before any stamp or process — never the subscription default a
@@ -305,6 +308,9 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // (tool-broker.ts), which alone holds their secrets. A review keeps its isolation.
     // Set once the fence is known: a fenced build's servers never start outside a fence.
     let serverMustBeFenced = false;
+    // Pinned for the attempt (sandbox parity C11): whether an instance operator allowed unconfined agents, read once now.
+    // A tool server the agent starts late gets the decision this attempt launched with, never one changed meanwhile.
+    const unconfinedAtLaunch = store.unfencedAgentsAllowed();
     // What the build writes (its checkout, its project's caches): a tool server never runs from there, nor reads it at all.
     const serverUntrusted = workspace === null ? [] : toolUntrusted(store, workspace, keyHome);
     const launchTools = invocation.phase === "review" ? null : await runTools(store, runId, spec, options.keyHome, clock, invocation.readOnlyTools, invocation.researchWithheld, containment, {
@@ -316,7 +322,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         untrusted: serverUntrusted,
         wrap: () => serverFence,
         // A fenced build's tool servers start only in a fence too, unless an instance operator allowed unconfined agents.
-        unwrapped: () => serverMustBeFenced && !store.unfencedAgentsAllowed()
+        unwrapped: () => serverMustBeFenced && !unconfinedAtLaunch
             ? "This machine can't confine the tool's server (no macOS sandbox, no working bubblewrap), so it was not started." : null,
     });
     if (launchTools !== null && "refused" in launchTools) {
@@ -345,7 +351,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // tool servers outside its command sandbox, so its own launch folder is
     // fenced too; Claude reads its config from there, inside the sandbox.
     const ownTools = tools?.privateDir === undefined ? null : realpathSync(tools.privateDir);
-    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [], grants: NO_GRANTS, gitPaths: [], cache: undefined, problem: undefined } : runFence(store, runId, spec.provider, options.keyHome, codexHarness ? null : ownTools, launchWrites ?? WRITES_DEFAULT);
+    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [], grants: NO_GRANTS, gitPaths: [], cache: undefined, problem: undefined } : runFence(store, runId, spec.provider, options.keyHome, codexHarness ? null : ownTools, launchWrites ?? WRITES_DEFAULT, launchSandbox ?? LEGACY_SANDBOX);
     if (fenceOf.problem !== undefined) {
         tools?.cleanup();
         codexHome?.cleanup();
@@ -386,13 +392,13 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     if (fence.length > 0) {
         // A tool server keeps its own reach (it holds its tool's secrets, not the agent's code): never the agent's network,
         // nor its write allowlist (a server keeps its own state where it always has).
-        const serverGrants = () => { const { network: _agentOnly, writes: _agentWrites, ...rest } = grants; return rest; };
+        const serverGrants = () => serverGrantsOf(grants);
         // Nor read what the build wrote: however its arguments are spelled, no byte of the checkout or caches can load.
         const serverDenies = [...fence, ...serverUntrusted.filter(path => existsSync(path)).map(path => realpathSync(path))];
-        if (macosFenceAvailable())
-            serverFence = (file, args) => macosFenced(file, args, serverDenies, serverGrants());
-        else if (linuxFenceAvailable())
-            serverFence = (file, args) => linuxFenced(file, args, serverDenies, serverGrants());
+        // Pinned: the server fence this attempt launched with, a copy, whatever changes later (C11).
+        const pinned = structuredClone(serverGrants());
+        if (macosFenceAvailable() || linuxFenceAvailable())
+            serverFence = (file, args, cwd) => sandboxedSpawn(file, args, serverDenies, pinned, cwd);
         serverMustBeFenced = true;
     }
     // No silent fallback (arc 1): a build this machine can't confine at the OS — Claude reduced to its own file-tool
@@ -404,10 +410,9 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         codexHome?.cleanup();
         removeAgentDatabase(isolatedDb.dir);
         return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null,
-            diagnostic: "This machine can't confine an agent (no macOS sandbox, no working bubblewrap), so nothing was started. Install bubblewrap, or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`." };
+            diagnostic: "This machine can't confine an agent (no macOS sandbox, no working bubblewrap), so nothing was started. Install bubblewrap, socat and ripgrep (Linux), or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`." };
     }
     let egress = null;
-    let bridge = null;
     let runTemp = null;
     const confinedOs = fenced.method === "macos-sandbox" || fenced.method === "linux-bubblewrap";
     if (fence.length > 0 && !codexHarness && confinedOs) {
@@ -429,22 +434,19 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             }
             else {
                 egress = await startEgressProxy({ hosts: network.policy.hosts });
-                grants.network = { mode: "allowlist", proxyPort: egress.port, brokerPorts, loopback: network.policy.loopback, socketRoots };
+                grants.network = { mode: "allowlist", proxyPort: egress.port, brokerPorts, loopback: network.policy.loopback, socketRoots, token: egress.secret };
             }
-            if (fenced.method === "linux-bubblewrap" && grants.network.mode === "allowlist") {
-                const database = store.databaseFile();
-                // The plane's own fenced folder, unless a socket there would be too long a path (a unix socket's path is capped
-                // near 100 bytes): then the system temp folder, which a confined Linux build doesn't see (its /tmp is its own).
-                const fenced = database === null || database === "" || database === ":memory:" ? undefined : join(dirname(realpathSync(database)), BRIDGE_DIR);
-                bridge = await startEgressBridge([grants.network.proxyPort, ...grants.network.brokerPorts], fenced !== undefined && bridgeFits(fenced) ? fenced : undefined);
-                grants.network.bridge = { folder: realpathSync(bridge.folder), forwarder: realpathSync(bridge.forwarder), node: process.execPath };
-                // Its private /tmp gives back only its own folders: its checkout and its launch folder (its temp is inside).
-                grants.network.keep = [...(workspace === null ? [] : [realpathSync(workspace)]), ...(ownTools === null ? [] : [ownTools]), ...(fenceOf.gitPaths ?? [])];
+            // On Linux the build has a network of its own, and the sandbox runtime relays only two ports into it: the
+            // proxy's (3128) and a second (1080), which carries this run's tool broker. Claude's tool list names it there.
+            // (An injected runner, in tests, runs outside every sandbox and keeps the broker's own address.)
+            if (fenced.method === "linux-bubblewrap" && grants.network.mode === "allowlist" && runner === undefined && tools?.brokerPort !== undefined && tools.privateDir !== undefined) {
+                const list = join(tools.privateDir, "mcp.json");
+                if (existsSync(list))
+                    writeFileSync(list, readFileSync(list, "utf8").replaceAll(`http://127.0.0.1:${tools.brokerPort}/`, "http://127.0.0.1:1080/"), { mode: 0o600 });
             }
         }
         catch (error) {
             await egress?.close();
-            await bridge?.close();
             tools?.cleanup();
             codexHome?.cleanup();
             removeAgentDatabase(isolatedDb.dir);
@@ -452,8 +454,11 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
                 diagnostic: `The build's network could not be set up, so nothing was started: ${error instanceof Error ? error.message : String(error)}` };
         }
     }
+    // The attempt's pinned fence, stamped on the run (C11): its method, policy version, the digest of exactly what it was
+    // given, and the sandbox engine and version it runs in.
     if (invocation.phase !== "review")
-        store.recordRunFence(runId, { method: fenced.method, paths: fence.length }, clock());
+        store.recordRunFence(runId, { method: fenced.method, paths: fence.length, policy: (launchSandbox ?? LEGACY_SANDBOX).policy,
+            digest: fenceDigest(fence, grants), engine: sandboxRuntimeWords() }, clock());
     const billingSeen = { keySource: null, model: null, planWindows: false, answered: false };
     // v105: a Codex run on its sign-in bills as Codex says it's signed in (a ChatGPT plan, or a saved key, or Bedrock),
     // read right before it runs. Never with an injected runner: tests don't start a real Codex.
@@ -496,7 +501,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             : ownKeyEnv.filter(name => name !== keyEnvName)),
     ];
     const launchOptions = {
-        ...(fenced.wrap.length === 0 ? {} : { fence: fenced.wrap, fenceGrants: grants }),
+        ...(fenced.wrap.length === 0 ? {} : { fence: fenced.wrap, fenceGrants: grants, confinement: "required" }),
         ...runOptions,
         ...(workspace === null ? {} : { cwd: workspace }),
         // v105: how the CLI really billed this turn (its key source, its plan's windows), read off its own stream.
@@ -566,7 +571,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
                 const insideFence = (file, args) => codexHarness
                     ? runCommand(executable, ["sandbox", ...codexFenceArgv(fence, invocation.skipPermissions, grants),
                         "-P", "standing-orders", "--", file, ...args], probeOptions)
-                    : runCommand(file, args, { ...probeOptions, fence: launchOptions.fence,
+                    : runCommand(file, args, { ...probeOptions, fence: launchOptions.fence, confinement: "required",
                         ...(launchOptions.fenceGrants === undefined ? {} : { fenceGrants: launchOptions.fenceGrants }) });
                 const check = await insideFence("git", gitArgs);
                 if (check.code !== 0) {
@@ -582,7 +587,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         // key in the launching environment must be absent. No agent takes part, so no agent can fake it.
         if (acpCheckAsk?.isolation !== undefined && launchOptions.fence !== undefined && workspace !== null) {
             // processGroup: run() applies the fence only on the process-group road (a plain execFile carries none).
-            const probe = { cwd: workspace, env: childEnv, omitEnv: childOmitEnv, fence: launchOptions.fence, ...(launchOptions.fenceGrants === undefined ? {} : { fenceGrants: launchOptions.fenceGrants }), timeoutMs: 15_000, processGroup: true };
+            const probe = { cwd: workspace, env: childEnv, omitEnv: childOmitEnv, fence: launchOptions.fence, confinement: "required", ...(launchOptions.fenceGrants === undefined ? {} : { fenceGrants: launchOptions.fenceGrants }), timeoutMs: 15_000, processGroup: true };
             const read = await runCommand("/bin/cat", [acpCheckAsk.isolation.file], probe);
             const env = await runCommand("/usr/bin/env", [], probe);
             acpIsolation = {
@@ -705,7 +710,6 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             }, clock());
         }
         await egress?.close();
-        await bridge?.close();
     }
     // v105: the run's billing, fixed from evidence before its usage is priced: a key it was given is a key; otherwise
     // what the CLI said (Claude's stream) or was last seen doing (Codex's account), and the setting only when neither.
@@ -926,7 +930,7 @@ function linkedFor(store, worktree) {
 /** The paths this run's agent may not reach: the state folder around the live database (but not its own worktree),
  * ~/.toolroll (or its older name), its task boundary and other launches' private folders; what the fence gives back
  * (FenceGrants); and what only Claude's file tools refuse. */
-function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEFAULT) {
+function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEFAULT, sandbox = LEGACY_SANDBOX) {
     try {
         // A plane always has a database file; an in-memory store (a test) has nothing to fence.
         const databaseFile = store.databaseFile();
@@ -939,22 +943,24 @@ function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEF
             throw new CheckoutBindingError("The checkout's Git pointer was changed or its trusted binding could not be verified.");
         const poolRoots = [join(dirname(databaseFile), "worktrees"), ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
         const binding = worktree === null || row === null ? null : trustedWorktreeBinding(row.repo, worktree, poolRoots);
-        const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home, binding });
+        const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home, binding, policy: sandbox.policy });
         const folders = runFolders(ownTools);
         // A build with a checkout writes only its workspace unless its approval said anywhere (arc 2): its checkout and
         // Git data, its launch folder, its project's caches and the provider state its CLI must write.
         const allowed = worktree === null || row === null || writes !== "workspace" ? null
             : writeAllowlist({ provider, home: keyHome ?? homedir(), worktree, binding, launchFolder: ownTools, cache: buildCacheFolder(row.repo, keyHome ?? homedir()) });
-        const fence = agentFence({ databaseFile, worktree, ...home, boundary, binding, runFolders: folders, extra: allowed?.deny ?? [] });
-        const grants = fenceGrants({ databaseFile, worktree, boundary, runFolders: folders, linked: linkedFor(store, worktree), binding, ...home, poolRoots });
+        // The shared install is granted only as the plane linked it: this checkout's project and stamped setup.
+        // Every plane checkout pool is denied around this one: the plane's own beside the database, and the one this
+        // checkout was recorded in (a --pool elsewhere), so another project's worktree, present at launch, is out of reach. Native wrappers also cover later creations.
+        const launch = fenceFor(provider === "command" ? "command" : "build", { databaseFile, worktree, ...home, boundary, binding, runFolders: folders, poolRoots,
+            extra: allowed?.deny ?? [], linked: linkedFor(store, worktree), writes: allowed === null ? null : { writes: allowed.writes, readOnly: allowed.readOnly }, policy: sandbox.policy, provider,
+            // The sealed read denies, and whatever the project lists now too (adding a deny only narrows).
+            readDeny: [...new Set([...sandbox.readDeny, ...(row === null ? [] : store.projectSandbox(row.repo).readDeny)])].map(one => readDenyPath(one, keyHome ?? homedir())), machLookup: sandbox.machLookup });
         return {
-            fence,
+            fence: launch.fence,
             fileTools: boundary?.fileTools ?? [],
-            // The shared install is granted only as the plane linked it: this checkout's project and stamped setup.
-            // Every plane checkout pool is denied around this one: the plane's own beside the database, and the one this
-            // checkout was recorded in (a --pool elsewhere), so another project's worktree, present at launch, is out of reach. Native wrappers also cover later creations.
-            grants: allowed === null ? grants : { ...grants, writes: allowed.writes, readOnly: [...new Set([...grants.readOnly, ...allowed.readOnly])].sort() },
-            // The checkout's own Git data, which a private /tmp gives back beside the checkout (agent-fence.ts linuxFenced).
+            grants: launch.fenceGrants,
+            // The checkout's own Git data (a sign-ins check's network keeps it reachable).
             gitPaths: binding === null ? [] : [binding.gitdir, join(binding.main, ".git")],
             ...(allowed === null || row === null ? {} : { cache: buildCacheFolder(row.repo, keyHome ?? homedir()) }),
         };
@@ -970,7 +976,7 @@ function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEF
  * Their network stays as it was. A machine without an OS fence runs them as before; a fence that can't be prepared
  * (a checkout whose binding no longer proves) runs nothing.
  */
-export function fencedCommands(store, runId, writes, inner, available = () => macosFenceAvailable() || linuxFenceAvailable(), access = CHECK_ACCESS_DEFAULT, network) {
+export function fencedCommands(store, runId, writes, inner, available = () => macosFenceAvailable() || linuxFenceAvailable(), access = CHECK_ACCESS_DEFAULT, network, sandbox = LEGACY_SANDBOX) {
     // An injected runner (tests) starts no real command, as an injected agent starts no real agent (invokeAgent).
     if (inner !== runCommand)
         return inner;
@@ -982,7 +988,7 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
                 store.stampRunCheckAccess(runId, "unsandboxed");
                 return inner(file, args, options);
             }
-            return { code: 1, stdout: "", stderr: "This machine can't confine the build's commands (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
+            return { code: 1, stdout: "", stderr: "This machine can't confine the build's commands (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, socat and ripgrep (Linux), or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
         }
         const own = realpathSync(mkdtempSync(join(checkLaunchRoot(), "so-cmd-")));
         try {
@@ -991,7 +997,7 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
             // Not sandboxed (check-access.ts): the project's checks are trusted by the whole instance, as before 0.9.66.
             if (access === "unsandboxed")
                 return await inner(file, args, { ...options, env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp } });
-            const fenced = runFence(store, runId, "command", undefined, own, writes);
+            const fenced = runFence(store, runId, "command", undefined, own, writes, sandbox);
             if (fenced.problem !== undefined)
                 return { code: 1, stdout: "", stderr: `${fenced.problem}\n`, timedOut: false, notFound: false };
             if (fenced.fence.length === 0)
@@ -1010,7 +1016,11 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
                 return await inner(file, args, {
                     ...options,
                     fence: fenced.fence,
-                    fenceGrants: signIns === null ? grants : { ...grants, signIns: signIns.grants, network: signIns.network },
+                    // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
+                    // With sign-ins, the keychain too (Claude Code keeps its macOS sign-in there), only while a person still set it.
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network,
+                        ...(signInsKeychain(store, checkout === null ? null : store.getWorktree(checkout)?.repo ?? null) ? { keychain: true } : {}) },
+                    confinement: "required",
                     env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(fenced.cache === undefined || fenced.grants.writes === undefined ? {} : buildCacheEnv(fenced.cache)), ...(signIns?.env ?? {}) },
                     ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
                 });
@@ -1030,14 +1040,14 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
  * project's writes setting, only that checkout, its Git data, its own temp folder, the project's caches and its check
  * database writable. Where nothing can confine them, they run only when an instance operator allowed unconfined agents.
  */
-export function fencedCheckoutCommands(store, repo, checkout, inner, available = () => macosFenceAvailable() || linuxFenceAvailable(), access = CHECK_ACCESS_DEFAULT, network) {
+export function fencedCheckoutCommands(store, repo, checkout, inner, available = () => macosFenceAvailable() || linuxFenceAvailable(), access = CHECK_ACCESS_DEFAULT, network, sandbox = LEGACY_SANDBOX) {
     if (inner !== runCommand)
         return inner;
     return async (file, args, options) => {
         if (!available()) {
             if (store.unfencedAgentsAllowed())
                 return inner(file, args, options);
-            return { code: 1, stdout: "", stderr: "This machine can't confine the project's checks (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
+            return { code: 1, stdout: "", stderr: "This machine can't confine the project's checks (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, socat and ripgrep (Linux), or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
         }
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
@@ -1057,15 +1067,16 @@ export function fencedCheckoutCommands(store, repo, checkout, inner, available =
                 return { code: 1, stdout: "", stderr: "The check's checkout couldn't be bound to its project, so nothing ran.\n", timedOut: false, notFound: false };
             }
             const poolRoots = [join(dirname(databaseFile), "worktrees"), ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
-            const boundary = taskBoundary({ worktree: checkout, provider: "command", binding });
+            const boundary = taskBoundary({ worktree: checkout, provider: "command", binding, policy: sandbox.policy });
             const folders = runFolders(own);
             const cache = buildCacheFolder(repo);
             const allowed = store.projectWrites(repo) !== "workspace" ? null : writeAllowlist({ provider: "command", home: homedir(), worktree: checkout, binding, launchFolder: own, cache });
             const database = options?.env?.["TOOLROLL_DB"];
             const checkData = allowed === null || database === undefined ? null : grantFolder(dirname(database), false);
-            const base = fenceGrants({ databaseFile, worktree: checkout, boundary, runFolders: folders, linked: linkedFor(store, checkout), binding, poolRoots });
-            const grants = allowed === null ? base
-                : { ...base, readOnly: [...new Set([...base.readOnly, ...allowed.readOnly])].sort(), writes: { ...allowed.writes, subpaths: [...allowed.writes.subpaths, ...(checkData === null ? [] : [checkData])] } };
+            const launch = fenceFor("check", { databaseFile, worktree: checkout, boundary, binding, runFolders: folders, poolRoots, extra: allowed?.deny ?? [], linked: linkedFor(store, checkout),
+                readDeny: sandbox.readDeny.map(one => readDenyPath(one, homedir())), machLookup: sandbox.machLookup, policy: sandbox.policy,
+                writes: allowed === null ? null : { writes: { ...allowed.writes, subpaths: [...allowed.writes.subpaths, ...(checkData === null ? [] : [checkData])] }, readOnly: allowed.readOnly } });
+            const grants = launch.fenceGrants;
             // With sign-ins, under the network its caller proved for it (the narrowest of its results' sealed check networks and
             // the project's current one): none given, nothing runs.
             const signIns = access !== "sign-ins" ? null : network === undefined ? { problem: "A check with sign-ins has no network sealed for it, so nothing ran." }
@@ -1075,8 +1086,12 @@ export function fencedCheckoutCommands(store, repo, checkout, inner, available =
             try {
                 return await inner(file, args, {
                     ...options,
-                    fence: agentFence({ databaseFile, worktree: checkout, boundary, binding, runFolders: folders, extra: allowed?.deny ?? [] }),
-                    fenceGrants: signIns === null ? grants : { ...grants, signIns: signIns.grants, network: signIns.network },
+                    fence: launch.fence,
+                    // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
+                    // With sign-ins, the keychain too (Claude Code keeps its macOS sign-in there), only while a person still set it.
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network,
+                        ...(signInsKeychain(store, repo) ? { keychain: true } : {}) },
+                    confinement: launch.confinement,
                     env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(allowed === null ? {} : buildCacheEnv(cache)), ...(signIns?.env ?? {}) },
                     ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
                 });
@@ -1156,80 +1171,40 @@ function plainLines(stdout) {
  * keyed to its default one; check-access.ts). gh's and Codex's are set to the granted ones instead. */
 const SIGN_INS_OMITTED_ENV = ["CLAUDE_CONFIG_DIR"];
 /**
- * A `sign-ins` check's launch (check-access.ts): its exact sign-in files and its own transcript folder
- * (agent-fence.ts signInGrants), Codex's config and sign-in copied into a home of the launch's own (private, gone with
- * the launch; ~/.codex itself stays fenced), gh pointed at its own folder, and the network the check runs under:
- * open, or its allowlist through a proxy of its own (on Linux, carried in by a bridge). Nothing about it is started
- * unless all of it is.
+ * A `sign-ins` check's launch (check-access.ts, sandbox parity C10): its exact sign-in files, read by the check itself
+ * through its sandbox (agent-fence.ts signInGrants: nothing privileged reads or copies one), its own transcript folder
+ * and Codex's session and log folders; Codex, gh and XDG pointed at the real folders; and the network the check runs
+ * under: open, or its allowlist through a proxy of its own (on Linux, relayed in by the sandbox runtime). Nothing about it is
+ * started unless all of it is.
  */
+/**
+ * Whether a check with sign-ins also reaches the keychain (macOS securityd: any item every program may read, not only
+ * the sign-ins). Only while the project's sign-ins level stands as a person set it: widening to sign-ins takes an
+ * instance operator's password typed now (operate.ts project check-access, Settings → Project → Check access), and the
+ * one who set it must still be an approver for the project and an instance operator now. Anything else: no keychain.
+ */
+export function signInsKeychain(store, repo) {
+    if (repo === null || store.projectCheckAccess(repo) !== "sign-ins")
+        return false;
+    const change = store.projectCheckAccessChange(repo);
+    const account = change === null ? null : store.accountOf(change.by);
+    return account !== null && account.revokedAt === null && account.role === "approver" && store.accountCanAccess(change.by, repo) && store.isInstanceOperator(change.by);
+}
 export async function signInsLaunch(store, own, temp, checkout, policy, gitPaths, platform = process.platform) {
-    // The belt (check-access.ts signInsAvailable, off for now): no sign-in file is read, copied or granted, whatever level
-    // reached this far. Its callers already run such a check sandboxed; anything else that asks runs nothing.
     if (!signInsAvailable(platform))
-        return { problem: "Sign-ins can't be shared with checks yet, so nothing ran." };
+        return { problem: "Sign-ins can't be shared with checks here, so nothing ran." };
     const home = homedir();
-    const grants = signInGrants(home, checkout);
-    const cleanup = [];
-    // Codex's files are copied, each read only as the real file it is (readGrantedFile: no link, here or above it).
-    const codex = join(own, "codex");
-    mkdirSync(codex, { mode: 0o700 });
-    for (const name of ["config.toml", "auth.json"]) {
-        const bytes = readGrantedFile(join(realpathSync(home), ".codex", name));
-        if (bytes !== null)
-            writeFileSync(join(codex, name), bytes, { mode: 0o600 });
-    }
-    // On Linux every granted file is bound from a copy of its own, made the same way (bubblewrap binds a source path, and
-    // a link swapped in after validation must never be what it binds). A Mac's sandbox checks the real path itself.
-    // Not reached for now: the belt above refuses until reading these files is race-free.
-    if (process.platform === "linux") {
-        const copies = {};
-        // Under Toolroll's own state folder, which every fence denies whole (a launch's folder in a shared /tmp isn't masked
-        // from a launch already running): bubblewrap binds from the original root, so only this check sees them.
-        const database = store.databaseFile();
-        if (database === null || database === "" || database === ":memory:")
-            return { problem: "A check with sign-ins needs Toolroll's state folder, so nothing ran." };
-        const state = dirname(realpathSync(database));
-        try {
-            mkdirSync(join(state, SIGN_IN_COPIES_DIR), { mode: 0o700 });
-        }
-        catch { /* there already: checked next */ }
-        // Only the real, private folder Toolroll made (this user's, 0700, no link): never a link planted where it should be.
-        const parent = signInCopiesRoot(state);
-        if (parent === null)
-            return { problem: "The sign-in copies folder isn't a private folder of Toolroll's, so nothing ran." };
-        const folder = mkdtempSync(join(parent, `c-${process.pid}-`));
-        cleanup.push(folder);
-        grants.read.forEach((path, index) => {
-            const bytes = readGrantedFile(path);
-            if (bytes === null)
-                return;
-            const copy = join(folder, String(index));
-            writeFileSync(copy, bytes, { mode: 0o600 });
-            copies[path] = copy;
-        });
-        grants.read = grants.read.filter(path => copies[path] !== undefined);
-        grants.copies = copies;
-    }
+    const grants = signInGrants(home, checkout, platform);
     let egress = null;
-    let bridge = null;
-    const close = async () => { await egress?.close(); await bridge?.close(); for (const one of cleanup)
-        rmSync(one, { recursive: true, force: true }); };
+    const close = async () => { await egress?.close(); };
     try {
-        const env = { CODEX_HOME: codex, GH_CONFIG_DIR: join(home, ".config", "gh"), XDG_CONFIG_HOME: join(home, ".config") };
+        const env = { CODEX_HOME: join(home, ".codex"), GH_CONFIG_DIR: join(home, ".config", "gh"), XDG_CONFIG_HOME: join(home, ".config") };
         if (policy.mode === "open")
             return { grants, network: { mode: "open" }, env, close };
         // Exactly the project's network: the services the sign-ins are for are reached only if the operator allowed their
         // hosts (check-access.ts signInHostsMissing says which are missing; never added here).
         egress = await startEgressProxy({ hosts: policy.hosts });
-        const network = { mode: "allowlist", proxyPort: egress.port, brokerPorts: [], loopback: policy.loopback, socketRoots: [temp, realpathSync(checkout)] };
-        if (linuxFenceAvailable()) {
-            const database = store.databaseFile();
-            const fenced = database === null || database === "" || database === ":memory:" ? undefined : join(dirname(realpathSync(database)), BRIDGE_DIR);
-            bridge = await startEgressBridge([egress.port], fenced !== undefined && bridgeFits(fenced) ? fenced : undefined);
-            network.bridge = { folder: realpathSync(bridge.folder), forwarder: realpathSync(bridge.forwarder), node: process.execPath };
-            // Its private /tmp gives back its checkout, its launch folder and its checkout's own Git data (as a build's does).
-            network.keep = [realpathSync(checkout), own, ...gitPaths.filter(path => existsSync(path))];
-        }
+        const network = { mode: "allowlist", proxyPort: egress.port, brokerPorts: [], loopback: policy.loopback, socketRoots: [temp, realpathSync(checkout)], token: egress.secret };
         return { grants, network, env: { ...env, ...proxyEnv(egress, policy.loopback) }, close };
     }
     catch (error) {
@@ -1270,6 +1245,31 @@ export function checkoutRunner(store, repo, checkout, inner, runIds, ran, platfo
     return (file, args, options) => {
         const launch = checkoutLaunchOf(store, repo, runIds, platform);
         ran(actualCheckAccess(store, launch.access));
-        return fencedCheckoutCommands(store, repo, checkout, inner, undefined, launch.access, launch.network)(file, args, options);
+        return fencedCheckoutCommands(store, repo, checkout, inner, undefined, launch.access, launch.network, checkoutSandboxOf(store, repo, runIds))(file, args, options);
+    };
+}
+/**
+ * A saved result's checks' sandbox terms (sandbox parity C9), never wider than any of those results' own approvals nor
+ * the project now: v2 only when every result's approval sealed v2; every read deny any of them sealed or the project
+ * lists now; mach services only those all of them sealed and the project still lists. A result with
+ * no readable approval counts as v1 with nothing listed.
+ */
+export function checkoutSandboxOf(store, repo, runIds) {
+    const sealed = runIds.map(id => {
+        const taskRef = store.getRun(id)?.taskRef;
+        const ref = taskRef === undefined ? null : store.refForId(taskRef);
+        const profile = ref === null ? null : store.getScope(ref.externalId)?.approvedProfile ?? null;
+        return profile === null ? LEGACY_SANDBOX : launchSandboxOf(profile);
+    });
+    const live = store.projectSandbox(repo);
+    const common = (pick, now) => now.filter(one => sealed.length > 0 && sealed.every(terms => pick(terms).includes(one)));
+    return {
+        policy: sealed.length > 0 && sealed.every(one => one.policy === 2) ? 2 : 1,
+        readDeny: [...new Set([...live.readDeny, ...sealed.flatMap(one => one.readDeny)])].sort(),
+        machLookup: common(one => one.machLookup, live.machLookup),
     };
 }
+/** The digest of a launch's whole fence (its denied paths and grants, canonical), as stamped on its run (C11). */
+export function fenceDigest(fence, grants) {
+    return createHash("sha256").update(`toolroll:fence:${canonicalJson({ fence: [...fence], grants: grants })}`).digest("hex").slice(0, 32);
+}

package/dist/operate.js

@@ -113,6 +113,7 @@ import { parseLeadToken } from "./api-tokens.js";
 import { MAX_NETWORK_HOSTS, normalizeHost } from "./egress.js";
 import { isWritesMode, writesWords } from "./writes-mode.js";
 import { linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
+import { parseMachLookup, parseReadDeny, readDenyWords } from "./project-sandbox.js";
 import { CHECK_ACCESS_WARNINGS, checkAccessRunsAs, checkAccessWords, isCheckAccess, signInHostsMissing, signInsUnavailableWords, widerThan } from "./check-access.js";
 import { CLI_PASSWORD_SOURCE, withPasswordSource } from "./sign-in-guard.js";
 import { admissionRecorded, admitProject, commandLineActor } from "./project-admission.js";
@@ -691,6 +692,8 @@ export const OPERATE_VALUE_FLAGS = new Set([
     "token-name",
     // task pause / task steer --now: the asker's own request id, so a repeat is the same request.
     "request",
+    // project sandbox (sandbox parity C9): read denies and macOS services.
+    "read-deny", "mach",
 ]);
 export const OPERATE_BOOLEAN_FLAGS = new Set([
     "json", "yes", "all", "brief", "local", "history", "latest-watch", "dry-run", "file",
@@ -1180,6 +1183,8 @@ async function dispatch(command, positional, flags, context) {
                 return projectWritesCommand(positional, flags, context);
             if (positional[0] === "check-access")
                 return projectCheckAccessCommand(positional, flags, context);
+            if (positional[0] === "sandbox")
+                return projectSandboxCommand(positional, flags, context);
             if (positional[0] === "checks")
                 return projectChecksCommand(positional, flags, context);
             if (positional[0] === "demo")
@@ -11640,3 +11645,44 @@ async function projectCheckAccessCommand(positional, flags, context) {
         "Scopes written from now on use this; scopes already approved keep what they were approved with.",
     ]);
 }
+/**
+ * `project sandbox --repo <p> [--read-deny <a,b>] [--mach <a,b>]` (project-sandbox.ts, sandbox parity C9): what the
+ * project's builds and checks may not read (paths, `~/…` or absolute) and the macOS services they may also use. Each list is replaced whole by its flag (an empty value clears it). New scopes seal it;
+ * approved ones keep theirs. Changing it is an approver's act with a password, kept in the ledger as before → after.
+ */
+async function projectSandboxCommand(positional, flags, context) {
+    const command = "project sandbox";
+    const allowed = new Set(["repo", "read-deny", "mach", "as", "token", "token-file", "token-env", "db", "json"]);
+    for (const name of flags.keys())
+        if (!allowed.has(name))
+            return fail(context.write, context.json, command, "usage", `--${name} is not a project sandbox option.`, EXIT.usage);
+    const repoFlag = text(flags, "repo");
+    if (positional.length > 1 || repoFlag === undefined)
+        return fail(context.write, context.json, command, "usage", "Use project sandbox --repo <project path> [--read-deny <paths>] [--mach <services>] (comma-separated; empty clears).", EXIT.usage);
+    const repo = await knownProject(context, repoFlag, { listed: true, canonical: true });
+    if (repo === undefined)
+        return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
+    const words = (one) => [`${repo}: ${readDenyWords(one.readDeny)}`,
+        ...(one.machLookup.length === 0 ? [] : [`macOS services also allowed: ${one.machLookup.join(", ")}`])];
+    const current = context.store.projectSandbox(repo);
+    const asked = (name) => { const value = flags.get(name); return value === undefined ? undefined : value === true ? [] : value.split(","); };
+    const changes = { readDeny: asked("read-deny"), machLookup: asked("mach") };
+    if (changes.readDeny === undefined && changes.machLookup === undefined)
+        return succeed(context.write, context.json, command, { repo, sandbox: current }, () => words(current));
+    const parsed = { readDeny: parseReadDeny(changes.readDeny ?? current.readDeny), machLookup: parseMachLookup(changes.machLookup ?? current.machLookup) };
+    for (const [name, one] of Object.entries(parsed))
+        if (!one.ok)
+            return fail(context.write, context.json, command, "usage", `${name}: ${one.problem}. Nothing changed.`, EXIT.usage);
+    const wanted = { readDeny: parsed.readDeny.ok ? parsed.readDeny.list : [], machLookup: parsed.machLookup.ok ? parsed.machLookup.list : [] };
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : credentialApprover(context.store, acting.name, acting.token, repo);
+    if (acting === null || !verified?.ok || !context.store.accountCanAccess(acting.name, repo))
+        return fail(context.write, context.json, command, "refused", "An approver for this project changes its sandbox, with their password: pass --as and --token.", EXIT.refused);
+    const changed = context.store.setProjectSandbox(repo, wanted, acting.name, context.clock());
+    if (changed === null)
+        return fail(context.write, context.json, command, "refused", "An approver for this project changes its sandbox. Nothing changed.", EXIT.refused);
+    return succeed(context.write, context.json, command, { repo, before: changed.before, sandbox: changed.after }, () => [
+        ...words(changed.after),
+        "Scopes written from now on use this; scopes already approved keep what they were approved with.",
+    ]);
+}

package/dist/project-delete-ui.d.ts

@@ -1,9 +1,4 @@
-/**
- * Settings → Project: what Toolroll holds for a project, and deleting
- * it. An instance operator deletes in two steps: type the project's name,
- * then read exactly what goes and confirm with their password (or a fresh
- * sign-in with the identity provider). The repository itself stays.
- */
+import type { ProjectSandbox } from "./project-sandbox.js";
 import type { ProjectNetwork } from "./egress.js";
 import type { WritesMode } from "./writes-mode.js";
 import { type CheckAccess } from "./check-access.js";
@@ -51,6 +46,12 @@ export type ProjectSettingsView = {
         setting: WritesMode;
         canChange: boolean;
     };
+    /** What its builds and checks may not read, and the macOS services and protected files they may still use
+     * (project-sandbox.ts), and whether this person may change it. */
+    sandbox?: {
+        setting: ProjectSandbox;
+        canChange: boolean;
+    };
     /** How far its checks reach (check-access.ts): the level, who changed it last, and whether this person may narrow it
      * (an approver for the project) or also widen it (an instance operator). */
     checkAccess?: {