toolroll 0.9.69 → 0.9.71

package/dist/store.d.ts

@@ -1,5 +1,7 @@
 import { type WritesMode } from "./writes-mode.js";
 import { type CheckAccess } from "./check-access.js";
+import { type ProjectSandbox } from "./project-sandbox.js";
+import type { FencePolicy } from "./agent-fence.js";
 import { type NetworkProfile, type ProjectNetwork, type RunNetworkRecord } from "./egress.js";
 import { type AcpLaunch } from "./acp-attest.js";
 import { type ChatBinding } from "./chat-core.js";
@@ -180,7 +182,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 132;
+export declare const SCHEMA_VERSION = 133;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export declare const V118_MERGED_TABLES: Readonly<Record<string, CredentialKind>>;
 /**
@@ -321,6 +323,8 @@ export declare const CONFINEMENT_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_
 export declare const PROJECT_WRITES_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_writes (\n  repo        TEXT PRIMARY KEY,\n  mode        TEXT NOT NULL CHECK (mode IN ('workspace', 'anywhere')),\n  updated_at  TEXT NOT NULL,\n  updated_by  TEXT NOT NULL\n);\n";
 /** v132: how far a project's checks reach beyond the check fence (check-access.ts CheckAccess). */
 export declare const PROJECT_CHECK_ACCESS_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_check_access (\n  repo        TEXT PRIMARY KEY,\n  level       TEXT NOT NULL CHECK (level IN ('sandboxed', 'sign-ins', 'unsandboxed')),\n  updated_at  TEXT NOT NULL,\n  updated_by  TEXT NOT NULL\n);\n";
+/** v133: a project's sandbox settings (project-sandbox.ts): JSON lists, each sorted, distinct and valid. */
+export declare const PROJECT_SANDBOX_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_sandbox (\n  repo              TEXT PRIMARY KEY,\n  read_deny_json    TEXT NOT NULL DEFAULT '[]',\n  mach_lookup_json  TEXT NOT NULL DEFAULT '[]',\n  updated_at        TEXT NOT NULL,\n  updated_by        TEXT NOT NULL\n);\n";
 /** v129: a finished run's How it ran, derived from its own records on first view (display only: never a verdict). Its
  * parser version says when to derive again; `steps` says how complete the step detail was, and why not. */
 export declare const RUN_EFFICIENCY_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_efficiency (\n  run             INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  parser_version  INTEGER NOT NULL,\n  steps           TEXT NOT NULL CHECK (steps IN ('complete','truncated','expired','absent')),\n  steps_reason    TEXT,\n  payload_json    TEXT NOT NULL CHECK (length(payload_json) <= 16384),\n  derived_at      TEXT NOT NULL\n);\n";
@@ -6138,6 +6142,9 @@ export declare class Store {
     recordRunFence(run: number, fence: {
         method: string;
         paths: number;
+        policy?: 1 | 2;
+        digest?: string;
+        engine?: string;
     }, now: Date): void;
     /** What one attempt's network was and what its proxy saw (egress.ts), kept beside its fence. */
     recordRunNetwork(run: number, network: RunNetworkRecord, now: Date): void;
@@ -6145,6 +6152,9 @@ export declare class Store {
     runFence(run: number): {
         method: string;
         paths: number;
+        policy?: 1 | 2;
+        digest?: string;
+        engine?: string;
     } | null;
     runTools(run: number): {
         tools: {
@@ -7201,6 +7211,26 @@ export declare class Store {
         before: CheckAccess;
         after: CheckAccess;
     } | null;
+    /** The scout's browser ran outside Toolroll's fence under its launch contract (scout-browser.ts): which exception. */
+    recordRunBrowser(run: number, browser: {
+        containment: string;
+        tool: string;
+    }, now: Date): void;
+    runBrowser(run: number): {
+        containment: string;
+        tool: string;
+    } | null;
+    /** A project's sandbox settings (project-sandbox.ts): its saved lists, or none. A damaged row keeps what it can read
+     * of its read denies (never fewer) and grants nothing else. */
+    projectSandbox(repo: string): ProjectSandbox;
+    /** An approver changed a project's sandbox settings (their password was proved by the caller): saved whole, and in
+     * the ledger as before → after. The account is proved again inside the write. Refused: null, nothing written. */
+    setProjectSandbox(repo: string, wanted: ProjectSandbox, by: string, now: Date): {
+        before: ProjectSandbox;
+        after: ProjectSandbox;
+    } | null;
+    /** The fence policy a flow was made under (agent-fence.ts FencePolicy): v2 for one made from 0.9.70; v1 otherwise. */
+    flowFencePolicy(flow: number): FencePolicy;
 }
 /** The receipt a bot's first pairing writes over pre-pairing history: an
  * explicit skip, with no delivered timestamp and no attempt, so suppressed

package/dist/store.js

@@ -1,5 +1,6 @@
 import { WRITES_DEFAULT } from "./writes-mode.js";
 import { checkAccessOf, widerThan } from "./check-access.js";
+import { PROJECT_SANDBOX_DEFAULT, sandboxOf } from "./project-sandbox.js";
 import { networkFromValue, PROJECT_NETWORK_DEFAULT, projectNetworkFromValue, runNetworkFromValue } from "./egress.js";
 import { isAcpProfile, isAcpProvider } from "./acp-agents.js";
 import { ACP_CONFORMANCE_VERSION, launchFromJson } from "./acp-attest.js";
@@ -721,7 +722,10 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // agent-baseline-hardening.md arc 2) — only their workspace unless an approver chose anywhere.
 // v132 adds, and changes no saved row: how far a project's checks reach beyond the check fence (project_check_access;
 // check-access.ts, docs/plans/check-access.md) — sandboxed unless an instance operator widened it.
-export const SCHEMA_VERSION = 132;
+// v133 adds, and changes no saved row: a project's sandbox settings (project_sandbox; project-sandbox.ts,
+// docs/plans/sandbox-parity.md C9) — what its builds may not read, the macOS services and protected files they may — and
+// the fence policy a flow was made under (flow.fence_policy; saved flows read NULL: v1, the home configuration denied).
+export const SCHEMA_VERSION = 133;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -854,7 +858,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1000,6 +1004,16 @@ CREATE TABLE IF NOT EXISTS project_check_access (
   updated_by  TEXT NOT NULL
 );
 `;
+/** v133: a project's sandbox settings (project-sandbox.ts): JSON lists, each sorted, distinct and valid. */
+export const PROJECT_SANDBOX_SCHEMA = `
+CREATE TABLE IF NOT EXISTS project_sandbox (
+  repo              TEXT PRIMARY KEY,
+  read_deny_json    TEXT NOT NULL DEFAULT '[]',
+  mach_lookup_json  TEXT NOT NULL DEFAULT '[]',
+  updated_at        TEXT NOT NULL,
+  updated_by        TEXT NOT NULL
+);
+`;
 /** v129: a finished run's How it ran, derived from its own records on first view (display only: never a verdict). Its
  * parser version says when to derive again; `steps` says how complete the step detail was, and why not. */
 export const RUN_EFFICIENCY_SCHEMA = `
@@ -3940,6 +3954,10 @@ function initializeStore(db, file) {
     db.exec(PROJECT_CHECK_ACCESS_SCHEMA);
     addColumn(db, "run", "sandbox_access", "TEXT");
     addColumn(db, "run", "sandbox_network", "TEXT");
+    // v133: a project's sandbox settings (a new table), and the fence policy each flow was made under (saved flows: NULL,
+    // read as v1).
+    db.exec(PROJECT_SANDBOX_SCHEMA);
+    addColumn(db, "flow", "fence_policy", "INTEGER");
     // v123: a flow that runs on its own (flow-unattended.ts): its grants and daily runs (new tables), and which authority
     // armed a plan's unchanged-plan approval (plan_authorization.basis, V123_ADDED_COLUMNS: saved rows read the mode).
     db.exec(FLOW_UNATTENDED_SCHEMA);
@@ -6750,14 +6768,18 @@ export class Store {
                 // all) seals only on a person's password ceremony — never a mode, a grant, a chat confirmation or a carry.
                 const profileText = this.db.prepare("SELECT profile_json FROM task_scope WHERE task_id = ?").get(taskId)?.["profile_json"];
                 let sealedAccess;
+                // SANDBOX WIDENINGS (v133, project-sandbox.ts): extra macOS services seal, likewise,
+                // only on a person's own password yes to exactly them.
+                let sandboxWidened = false;
                 try {
                     const stored = typeof profileText === "string" ? JSON.parse(profileText) : null;
                     sealedAccess = stored?.profile?.["checkAccess"];
+                    sandboxWidened = stored?.profile?.["machLookup"] !== undefined;
                 }
                 catch {
                     sealedAccess = "unreadable";
                 }
-                if (sealedAccess !== undefined)
+                if (sealedAccess !== undefined || sandboxWidened)
                     return false;
             }
             // SEPARATION OF DUTIES (v102), enforced in the primitive so no road
@@ -15253,7 +15275,8 @@ export class Store {
     // ---- flows (v81) -------------------------------------------------------------
     createFlow(flow, now) {
         const stamp = now.toISOString();
-        return Number(this.db.prepare("INSERT INTO flow (repo, name, definition_json, revision, state, created_by, created_at, updated_by, updated_at) VALUES (?, ?, ?, 1, 'active', ?, ?, ?, ?)")
+        // A flow made from 0.9.70 on runs under fence policy v2 (agent-fence.ts FencePolicy); one made before stays v1.
+        return Number(this.db.prepare("INSERT INTO flow (repo, name, definition_json, revision, state, created_by, created_at, updated_by, updated_at, fence_policy) VALUES (?, ?, ?, 1, 'active', ?, ?, ?, ?, 2)")
             .run(flow.repo, flow.name, flowDefinitionForStore(flow.definitionJson), flow.by, stamp, flow.by, stamp).lastInsertRowid);
     }
     /** Hand a flow to another person: its "the owner decides" zones ask them from now on. */
@@ -19070,6 +19093,62 @@ export class Store {
             return { before, after };
         });
     }
+    // ---- sandbox parity (docs/plans/sandbox-parity.md). Kept last in the class: the freshness tripwire pins positions.
+    /** The scout's browser ran outside Toolroll's fence under its launch contract (scout-browser.ts): which exception. */
+    recordRunBrowser(run, browser, now) {
+        const json = JSON.stringify(browser);
+        this.db.prepare(`INSERT INTO run_tool (run, tools_json, created_at) VALUES (?, json_object('browser', json(?)), ?)
+      ON CONFLICT (run) DO UPDATE SET tools_json = json_set(tools_json, '$.browser', json(?))`).run(run, json, now.toISOString(), json);
+    }
+    runBrowser(run) {
+        const row = this.db.prepare("SELECT json_extract(tools_json, '$.browser') AS browser FROM run_tool WHERE run = ?").get(run);
+        if (row === undefined || row["browser"] === null)
+            return null;
+        try {
+            const parsed = JSON.parse(String(row["browser"]));
+            return typeof parsed.containment === "string" && typeof parsed.tool === "string" ? { containment: parsed.containment, tool: parsed.tool } : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** A project's sandbox settings (project-sandbox.ts): its saved lists, or none. A damaged row keeps what it can read
+     * of its read denies (never fewer) and grants nothing else. */
+    projectSandbox(repo) {
+        const row = this.db.prepare("SELECT read_deny_json, mach_lookup_json FROM project_sandbox WHERE repo = ?").get(repo);
+        if (row === undefined)
+            return { ...PROJECT_SANDBOX_DEFAULT };
+        const read = (text) => { try {
+            return typeof text === "string" ? JSON.parse(text) : null;
+        }
+        catch {
+            return null;
+        } };
+        return sandboxOf({ readDeny: read(row["read_deny_json"]), machLookup: read(row["mach_lookup_json"]) });
+    }
+    /** An approver changed a project's sandbox settings (their password was proved by the caller): saved whole, and in
+     * the ledger as before → after. The account is proved again inside the write. Refused: null, nothing written. */
+    setProjectSandbox(repo, wanted, by, now) {
+        return this.transact(() => {
+            const account = this.accountOf(by);
+            if (account === null || account.revokedAt !== null || account.role !== "approver" || !this.accountCanAccess(by, repo))
+                return null;
+            const before = this.projectSandbox(repo);
+            const clean = sandboxOf(wanted);
+            this.db.prepare(`INSERT INTO project_sandbox (repo, read_deny_json, mach_lookup_json, updated_at, updated_by) VALUES (?, ?, ?, ?, ?)
+        ON CONFLICT (repo) DO UPDATE SET read_deny_json = excluded.read_deny_json, mach_lookup_json = excluded.mach_lookup_json,
+        updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
+                .run(repo, JSON.stringify(clean.readDeny), JSON.stringify(clean.machLookup), now.toISOString(), by);
+            const after = this.projectSandbox(repo);
+            const words = (one) => `read-deny ${one.readDeny.length === 0 ? "none" : one.readDeny.join(",")}; mach ${one.machLookup.length === 0 ? "none" : one.machLookup.join(",")}`;
+            this.recordPolicy(by, repo, "sandbox", words(before), words(after), now);
+            return { before, after };
+        });
+    }
+    /** The fence policy a flow was made under (agent-fence.ts FencePolicy): v2 for one made from 0.9.70; v1 otherwise. */
+    flowFencePolicy(flow) {
+        return this.db.prepare("SELECT fence_policy FROM flow WHERE id = ?").get(flow)?.["fence_policy"] === 2 ? 2 : 1;
+    }
 }
 /** A stored count or id that must be a whole, non-negative number — a
  * NULL, an empty string, a fraction, or text reads as null (v48 authority repair). */

package/dist/subagent-tools.d.ts

@@ -13,6 +13,7 @@ export type ToolIo = {
     callTool?: ToolCaller;
     listTools?: ToolLister;
     toolHome?: string | undefined;
+    fenceAvailable?: () => boolean;
 };
 /** Actions whose names say they only read start as "do it"; everything else asks first until its manager says otherwise. */
 export declare const READ_VERB: RegExp;

package/dist/subagent-tools.js

@@ -19,7 +19,7 @@
 import { redactSecretLines, scanForSecrets } from "./evidence.js";
 import { scrubSecrets } from "./flow-secrets.js";
 import { toolRefusal } from "./policy.js";
-import { callProjectTool, listProjectToolActions, projectToolsOf, readToolSecrets } from "./project-tools.js";
+import { callProjectTool, listProjectToolActions, projectToolsOf, readToolSecrets, toolServerFor } from "./project-tools.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
 /** Actions whose names say they only read start as "do it"; everything else asks first until its manager says otherwise. */
 export const READ_VERB = /^(get|list|search|find|read|fetch|lookup|look_up|query|show|describe|count|check|view|retrieve)([_.-]|$)/i;
@@ -113,13 +113,15 @@ export async function refreshGrants(store, mate, now, io) {
         const tool = tools.find(one => one.name === grant.tool);
         if (tool === undefined)
             continue;
-        const listed = await listed_(tool, mate.repo, io);
+        const listed = await listed_(store, tool, mate.repo, io);
         if (!listed.ok)
             continue;
         store.saveSubagentGrant({ subagent: mate.id, tool: grant.tool, ...withActions(grant.rules, listed.actions), listedAt: now.toISOString() }, grant.updatedBy, now);
     }
 }
-const listed_ = (tool, repo, io) => (io.listTools ?? ((spec, values) => listProjectToolActions(spec, values, { timeoutMs: 60_000, omitEnv: ALL_CREDENTIAL_ENV })))(tool.spec, readToolSecrets(repo, tool.name, io.toolHome));
+const listed_ = (store, tool, repo, io) => (io.listTools ?? ((spec, values) => listProjectToolActions(spec, values, { timeoutMs: 60_000, omitEnv: ALL_CREDENTIAL_ENV, server: serverOf(store, repo, io) })))(tool.spec, readToolSecrets(repo, tool.name, io.toolHome));
+/** Where a subagent's tool server starts: in the server fence (project-tools.ts toolServerFor), never bare. */
+const serverOf = (store, repo, io) => toolServerFor(store, repo, { ...(io.toolHome === undefined ? {} : { home: io.toolHome }), ...(io.fenceAvailable === undefined ? {} : { available: io.fenceAvailable }) });
 /** Names only, from the tool's last test: what a grant starts with when it can't be listed right now. */
 const namesOnly = (tool) => (tool.lastTest?.tools ?? []).map(name => ({ name, about: "", input: null, readOnly: false }));
 /** Let a subagent use one of the project's tools. Its actions start at their defaults: reading is free, everything else asks first. */
@@ -129,7 +131,7 @@ export async function grantTool(store, mate, tool, by, now, io = {}) {
         return { ok: false, said: `This project has no tool called ${tool}. Add it on the Tools page first.` };
     if (store.subagentGrant(mate.id, tool) !== null)
         return { ok: true, said: `It can already use ${tool}.` };
-    const listed = await listed_(found, mate.repo, io);
+    const listed = await listed_(store, found, mate.repo, io);
     return grantListed(store, mate, found, listed.ok ? listed.actions : null, by, now);
 }
 /** A grant from what the tool offers (or, not reachable now, the names its last test found). */
@@ -219,7 +221,7 @@ export async function makeCall(store, call, repo, io, now, options = {}) {
     const values = readToolSecrets(repo, tool.name, io.toolHome);
     let answer;
     try {
-        answer = await (io.callTool ?? ((spec, secrets, name, given) => callProjectTool(spec, secrets, name, given, { timeoutMs: 120_000, omitEnv: ALL_CREDENTIAL_ENV })))(tool.spec, values, call.action, call.input);
+        answer = await (io.callTool ?? ((spec, secrets, name, given) => callProjectTool(spec, secrets, name, given, { timeoutMs: 120_000, omitEnv: ALL_CREDENTIAL_ENV, server: serverOf(store, repo, io) })))(tool.spec, values, call.action, call.input);
     }
     catch (error) {
         answer = { ok: false, problem: error instanceof Error ? error.message : "It couldn't be reached." };

package/dist/tool-broker.d.ts

@@ -19,9 +19,10 @@ export type BrokerOptions = {
     /** Why a local server may not start unwrapped (no fence for it here), read when it would; null when it may. */
     unwrapped?: () => string | null;
     /** How a local server is started inside its run's fence, read when it starts (the fence is fixed after the tools). */
-    wrap?: () => ((file: string, args: readonly string[]) => {
+    wrap?: () => ((file: string, args: readonly string[], cwd?: string) => {
         file: string;
         args: string[];
+        env?: Record<string, string>;
     }) | null;
 };
 export type ToolBroker = {

package/dist/tool-broker.js

@@ -139,8 +139,8 @@ class LocalServer {
                 return null;
             }
         }
-        const { file, args } = wrap === null ? { file: this.tool.spec.command, args: [...this.tool.spec.args] } : wrap(this.tool.spec.command, this.tool.spec.args);
-        const child = spawn(file, args, { env, ...(this.options.cwd === undefined ? {} : { cwd: this.options.cwd }), stdio: ["pipe", "pipe", "ignore"], detached: process.platform !== "win32" });
+        const { file, args, env: sandboxEnv } = wrap === null ? { file: this.tool.spec.command, args: [...this.tool.spec.args], env: undefined } : wrap(this.tool.spec.command, this.tool.spec.args, this.options.cwd);
+        const child = spawn(file, args, { env: { ...env, ...(sandboxEnv ?? {}) }, ...(this.options.cwd === undefined ? {} : { cwd: this.options.cwd }), stdio: ["pipe", "pipe", "ignore"], detached: process.platform !== "win32" });
         this.child = child;
         this.initialized = false;
         child.stdout?.setEncoding("utf8");

package/dist/tool-launcher.js

@@ -5,23 +5,15 @@
  * against codex-cli 0.156), so nothing rides Codex's environment. A build's
  * launch file names its run's tool broker (tool-broker.ts) and that launch's
  * token, and this process relays stdio to it over HTTP; the tool's own
- * secrets stay in the broker. A launch file naming a local program or a web
- * server with its values is still run as before.
+ * secrets stay in the broker. A launch file naming a local program is refused
+ * (docs/plans/sandbox-parity.md C2): Codex starts this launcher outside its
+ * command sandbox, so a program started here would run unfenced; every local
+ * server runs in the broker, inside the server fence.
  */
-import { spawn } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { createInterface } from "node:readline";
-function runLocal(spec, values) {
-    const child = spawn(spec.command, spec.args, { env: { ...process.env, ...values }, stdio: "inherit" });
-    const forward = (signal) => { try {
-        child.kill(signal);
-    }
-    catch { /* gone */ } };
-    for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"])
-        process.on(signal, () => forward(signal));
-    child.on("error", error => { process.stderr.write(`the tool could not start: ${error.message}\n`); process.exit(127); });
-    child.on("exit", (code, signal) => process.exit(code ?? (signal === null ? 1 : 128)));
-}
+/** The refusal for a launch file naming a local program: nothing is started (126, "could not be executed"). */
+const LOCAL_LAUNCH_REFUSED = "This tool's launch names a local program, which only Toolroll's tool broker may start (inside its fence); nothing was started.";
 /** stdio ↔ streamable HTTP: each line from Codex is POSTed; JSON or event-stream answers go back as lines. */
 function relayWeb(spec, values) {
     const headers = { "content-type": "application/json", accept: "application/json, text/event-stream" };
@@ -98,5 +90,7 @@ catch {
 }
 if (launch.spec.transport === "http")
     relayWeb(launch.spec, launch.values);
-else
-    runLocal(launch.spec, launch.values);
+else {
+    process.stderr.write(`${LOCAL_LAUNCH_REFUSED}\n`);
+    process.exit(126);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.69",
+  "version": "0.9.71",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"
@@ -125,6 +125,7 @@
     }
   },
   "dependencies": {
+    "@anthropic-ai/sandbox-runtime": "0.0.79",
     "@slack/socket-mode": "3.1.0",
     "@xterm/addon-serialize": "0.14.0",
     "@xterm/headless": "6.0.0",

package/scripts/provider-canary.mjs

@@ -313,7 +313,7 @@ async function runtimeIdentity() {
 export async function checkCheckoutGit({ provider, worktree, databaseFile, repository, home = homedir() }, execute = run) {
   if (!["claude", "codex", "gemini"].includes(provider)) return null;
   if (typeof worktree !== "string" || worktree === "") throw new Error("the builder did not retain its worktree for the Git fence check");
-  const { agentFence, taskBoundary, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, fenceGrants, codexFenceArgv, macosFenceAvailable, macosFenced, linuxFenceAvailable, linuxFenced } = await import(join(root, "dist", "agent-fence.js"));
+  const { agentFence, taskBoundary, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, fenceGrants, codexFenceArgv, macosFenceAvailable, linuxFenceAvailable, sandboxedSpawn } = await import(join(root, "dist", "agent-fence.js"));
   const binding = trustedWorktreeBinding(repository, worktree);
   const boundary = taskBoundary({ worktree, provider, home, binding });
   const fence = agentFence({ databaseFile, worktree, home, boundary, binding });
@@ -329,16 +329,15 @@ export async function checkCheckoutGit({ provider, worktree, databaseFile, repos
       if (control.code !== 0) throw new Error(`unfenced git ${args.join(" ")} failed: ${control.stderr}`);
       const wrapped = provider === "codex"
         ? { file: "codex", args: ["sandbox", ...codexFenceArgv(fence, false, grants), "-P", "standing-orders", "--", "git", ...gitArgs] }
-        : macosFenceAvailable() ? macosFenced("git", gitArgs, fence, grants)
-        : linuxFenceAvailable() ? linuxFenced("git", gitArgs, fence, grants) : null;
+        : macosFenceAvailable() || linuxFenceAvailable() ? sandboxedSpawn("git", gitArgs, fence, grants, worktree) : null;
       if (wrapped === null || fence.length === 0) { skipped = true; if (args[0] === "rev-parse") head = control.stdout.trim(); continue; }
       const checked = await execute(wrapped.file, wrapped.args, { cwd: worktree,
-        env });
+        env: { ...env, ...(wrapped.env ?? {}) } });
       if (checked.code !== 0) {
         const trivial = provider === "codex"
           ? { file: "codex", args: ["sandbox", ...codexFenceArgv(fence, false, grants), "-P", "standing-orders", "--", "true"] }
-          : macosFenceAvailable() ? macosFenced("true", [], fence, grants) : linuxFenced("true", [], fence, grants);
-        const sandbox = await execute(trivial.file, trivial.args, { cwd: worktree, env });
+          : sandboxedSpawn("true", [], fence, grants, worktree);
+        const sandbox = await execute(trivial.file, trivial.args, { cwd: worktree, env: { ...env, ...(trivial.env ?? {}) } });
         throw new Error(sandbox.code === 0 ? `The build fence blocks this checkout's own Git data. git ${args.join(" ")}: ${checked.stderr}` : `The provider sandbox could not run its control: ${sandbox.stderr}`);
       }
       if (checked.stdout !== control.stdout) throw new Error(`fenced git ${args.join(" ")} disagrees with its control`);

package/dist/egress-bridge.d.ts

@@ -1,17 +0,0 @@
-/** The prefix of a bridge folder in the temp folder (agent-fence.ts RUN_FOLDER_PREFIXES denies every other run's). */
-export declare const BRIDGE_PREFIX = "so-net-";
-/** The forwarder, run inside the namespace as `node forward.mjs <folder> <port>... -- <command>`. Zero dependencies. */
-export declare const FORWARDER_SOURCE: string;
-/** Whether a bridge made under `root` keeps every socket path within the limit (its folder and `<port>.sock`). */
-export declare function bridgeFits(root: string): boolean;
-export type EgressBridge = {
-    folder: string;
-    forwarder: string;
-    close: () => Promise<void>;
-};
-/**
- * Serve one socket per port (each relayed to that port on the host's loopback) in a fresh owner-only folder under
- * `root`: the plane's own bridge folder beside the database (agent-fence.ts BRIDGE_DIR), which every build's fence
- * hides from launch, so no other build can change the forwarder or reach the sockets.
- */
-export declare function startEgressBridge(ports: readonly number[], root?: string): Promise<EgressBridge>;

package/dist/egress-bridge.js

@@ -1,111 +0,0 @@
-/**
- * How a Linux build with a network of its own reaches its proxy and tool broker (agent-fence.ts linuxFenced). The
- * plane serves one unix socket per port in a folder of its own (`<folder>/<port>.sock`, each relayed to that port on
- * the host's loopback); bubblewrap binds the folder read-only into the build's namespace, where the forwarder below
- * listens on the namespace's own 127.0.0.1 at the same ports and relays each connection to its socket. Only those
- * ports cross: nothing else of the host's network is reachable, and the relay never opens a connection of its own.
- *
- * The forwarder is written into the folder at launch (the plane's own file, read-only to the build), so it never runs
- * from an installation path a fence might hide or a build could change.
- */
-import { chmodSync, lstatSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { connect, createServer } from "node:net";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-/** The prefix of a bridge folder in the temp folder (agent-fence.ts RUN_FOLDER_PREFIXES denies every other run's). */
-export const BRIDGE_PREFIX = "so-net-";
-/** The forwarder, run inside the namespace as `node forward.mjs <folder> <port>... -- <command>`. Zero dependencies. */
-export const FORWARDER_SOURCE = String.raw `import { connect, createServer } from "node:net";
-import { spawn } from "node:child_process";
-const argv = process.argv.slice(2);
-const split = argv.indexOf("--");
-if (split < 1 || split === argv.length - 1) { process.stderr.write("toolroll forwarder: usage <folder> <port>... -- <command>\n"); process.exit(2); }
-const folder = argv[0];
-const ports = argv.slice(1, split).map(Number);
-const command = argv.slice(split + 1);
-let ready = 0;
-for (const port of ports) {
-  const server = createServer(client => {
-    const upstream = connect(folder + "/" + port + ".sock");
-    client.on("error", () => upstream.destroy());
-    upstream.on("error", () => client.destroy());
-    client.pipe(upstream);
-    upstream.pipe(client);
-  });
-  server.on("error", error => { process.stderr.write("toolroll forwarder: " + error.message + "\n"); process.exit(70); });
-  server.listen(port, "127.0.0.1", () => { if (++ready === ports.length) start(); });
-}
-if (ports.length === 0) start();
-function start() {
-  const child = spawn(command[0], command.slice(1), { stdio: "inherit" });
-  for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(signal, () => child.kill(signal));
-  child.on("error", error => { process.stderr.write("toolroll forwarder: " + error.message + "\n"); process.exit(127); });
-  child.on("exit", (code, signal) => {
-    if (signal === null) process.exit(code ?? 1);
-    // Die the way the agent died: this process's own handlers (which only pass a signal on) step aside first.
-    process.removeAllListeners(signal);
-    process.kill(process.pid, signal);
-    setTimeout(() => process.exit(128), 1000).unref();
-  });
-}
-`;
-/** The longest a unix socket's path may be here (macOS 104 bytes, Linux 108, with room to spare). */
-const SOCKET_PATH_MAX = 100;
-/** Whether a bridge made under `root` keeps every socket path within the limit (its folder and `<port>.sock`). */
-export function bridgeFits(root) {
-    return join(root, `${BRIDGE_PREFIX}XXXXXX`, "65535.sock").length <= SOCKET_PATH_MAX;
-}
-/**
- * Serve one socket per port (each relayed to that port on the host's loopback) in a fresh owner-only folder under
- * `root`: the plane's own bridge folder beside the database (agent-fence.ts BRIDGE_DIR), which every build's fence
- * hides from launch, so no other build can change the forwarder or reach the sockets.
- */
-export async function startEgressBridge(ports, root = tmpdir()) {
-    // The root must be a real folder of this user's alone, never a link a build could have planted before it existed.
-    const held = lstatSync(root);
-    if (held.isSymbolicLink() || !held.isDirectory() || (process.getuid !== undefined && held.uid !== process.getuid()) || (root !== tmpdir() && (held.mode & 0o077) !== 0)) {
-        throw new Error(`the bridge folder ${root} isn't a private folder of this user's`);
-    }
-    if (!bridgeFits(root))
-        throw new Error(`the bridge folder ${root} is too deep for a socket path`);
-    const folder = mkdtempSync(join(root, BRIDGE_PREFIX));
-    chmodSync(folder, 0o700);
-    const forwarder = join(folder, "forward.mjs");
-    writeFileSync(forwarder, FORWARDER_SOURCE, { mode: 0o500, flag: "wx" });
-    const servers = [];
-    const sockets = new Set();
-    try {
-        for (const port of ports) {
-            const server = createServer(client => {
-                sockets.add(client);
-                const upstream = connect(port, "127.0.0.1");
-                sockets.add(upstream);
-                const drop = () => { client.destroy(); upstream.destroy(); };
-                client.on("error", drop);
-                upstream.on("error", drop);
-                client.on("close", () => { sockets.delete(client); upstream.destroy(); });
-                upstream.on("close", () => { sockets.delete(upstream); client.destroy(); });
-                client.pipe(upstream);
-                upstream.pipe(client);
-            });
-            await new Promise((done, fail) => { server.once("error", fail); server.listen(join(folder, `${port}.sock`), () => { server.off("error", fail); done(); }); });
-            servers.push(server);
-        }
-    }
-    catch (error) {
-        for (const server of servers)
-            server.close();
-        rmSync(folder, { recursive: true, force: true });
-        throw error;
-    }
-    return {
-        folder,
-        forwarder,
-        close: async () => {
-            for (const socket of sockets)
-                socket.destroy();
-            await Promise.all(servers.map(server => new Promise(done => server.close(() => done()))));
-            rmSync(folder, { recursive: true, force: true });
-        },
-    };
-}