toolroll 0.9.72 → 0.9.73

package/CHANGELOG.md

@@ -1,5 +1,81 @@
 # Changelog
 
+## 0.9.73 — 2026-10-25
+
+- **Carry release approvals when checks aren't sandboxed.** A project whose
+  checks run outside the sandbox (like Toolroll's own release project) can
+  let later test-only commits carry a release approval:
+  `toolroll release unsandboxed-carry on --repo <path> --as <you> --token
+  <password>`. It is off by default; only a person turns it on, and it counts
+  only for releases approved while it is on. The approval sheet says plainly
+  that those later commits will run outside the sandbox without being shown
+  to you first. Every other carry rule stays: tests and docs only, the
+  400-line, 20-file and 800-line-churn limits, an identical production build,
+  and main's open nightly failures. Turning it off, or checks that reach
+  further than at the approval, stops carrying.
+- **`toolroll release` stops at the gate when the pull request's checks
+  fail.** Before it files the release task or asks for your approval, it
+  reads the required checks on the exact commit. One that failed or was
+  cancelled stops the release with the failing job names, so you aren't
+  asked to approve a commit that can't merge. Checks not started or still
+  running are named and waited for; if they don't finish within the gate's
+  limit (60 minutes, `--limit gate=<min>`), it stops there too. The ci step
+  still checks every one again before merging.
+- **Chat apps, browsers and password managers are off limits to every
+  launch.** Builds, checks, flows, tool servers and coding sessions can't
+  read or write where Slack, Telegram, Discord, Teams, WhatsApp, 1Password,
+  Bitwarden, or the Chrome, Chromium, Brave, Edge, Arc, Firefox, Zen,
+  Vivaldi, Opera, Orion and Safari profiles keep their data, on macOS and
+  Linux, under both sandbox versions and in Codex's sandbox. This covers the
+  folders by name and by real path, links inside them, and a moved profile
+  or config folder named in the environment. No project setting reopens
+  them, and those apps' variables (SLACK_, TELEGRAM_, DISCORD_, TEAMS_, OP_,
+  BW_, BITWARDENCLI_) are removed from every launch; a tool server keeps the
+  secrets it names.
+- **`toolroll release` runs Git safely on the release checkout.** The release
+  used to run plain Git there, so a setting planted in the checkout's Git
+  config (an include, a hook folder, an ssh command, a proxy, a URL rewrite
+  and the like) could run a command or send the gh token elsewhere. Now it
+  uses the repository and GitHub URL from Toolroll's own records, runs Git,
+  gh and ssh by absolute path with a fixed environment, pins HTTPS settings
+  on the command line, and allows only the plain settings Git writes itself.
+  Any other setting stops the release and names it. The checkout must be a
+  project Toolroll records, with a recorded remote.
+- **Widening actions take your password.** Setting the permission default to
+  Full access, giving a subagent a tool, loosening a tool rule, accepting a
+  subagent's suggested looser rule, and adding a trigger that brings in work
+  from anyone (GitHub from anyone, mail from any sender, from the Triggers
+  panel, a gallery template or a starter kit) now ask for your password (a
+  signed-in session does under Passwordless). Narrowing needs none. A chat
+  card, import or template can no longer do any of these; it points to the
+  page that can.
+- **Approving a release from chat shows the whole release first.** A tap
+  approves a deploy only through the release card: every signed term and
+  release term, one line each (it says so when later test-only commits
+  will run outside the sandbox), and the commits since the last release
+  Toolroll recorded as merged. Continue sends the terms (as a file where the
+  chat app allows), and Approve is bound to exactly what was shown;
+  anything changed in between refuses with the new card. It works only in
+  your own private chat (Telegram or a Slack direct message); a group,
+  someone else's chat, Discord and Teams are refused. Each such approval is
+  announced to you, naming the chat app.
+- **Network, writes, check access and sandbox settings stay on the typed
+  password under Passwordless,** and a test now fails if one moves to the
+  ordinary signed-in step-up.
+- **Launches don't wait on macOS's "access data from other apps" prompt.**
+  Toolroll looks inside other apps' containers only after a 3-second look in
+  a separate process shows macOS lets it, so a service run by launchd no
+  longer hangs every fenced launch. While macOS is still asking, the
+  containers stay denied by name and real path, and the links found by the
+  last full look stay denied; a look that fails for any other reason refuses
+  the launch.
+- **The release check ends itself before its time limit,** stopping the
+  parts still running and keeping every log and its report, and a failed
+  part's log reaches the run's output as soon as it fails.
+- **`toolroll release` rides out short GitHub network timeouts** while a
+  step waits, asking again until that step's own limit.
+- No database change: the schema stays at v135.
+
 ## 0.9.72 — 2026-10-25
 
 - **One approval per release.** A person approves a release once. Later

package/dist/agent-fence.d.ts

@@ -29,6 +29,8 @@ export declare function agentFence(options: {
     boundary?: TaskBoundary | null;
     binding?: WorktreeBinding | null;
     runFolders?: RunFolders;
+    /** Protected storage as this launch resolved it (protected-storage.ts); resolved here when not given. */
+    protectedStorage?: readonly string[];
 }): string[];
 /** The task's boundary: `shell` joins the OS fence; `fileTools` only Claude's file-tool deny rules; `readOnly` and
  * `lookup` are other tasks' git metadata and checkout roots (see FenceGrants). */
@@ -103,6 +105,9 @@ export type FenceGrants = {
     signIns?: SignInGrants;
     /** Never written, wherever the launch writes (homeWriteDenies): what runs for the operator next or signs them in. */
     writeDenies?: string[];
+    /** Protected storage (protected-storage.ts): denied to read and write by every backend, and no grant equal to or
+     * inside one survives (a sandbox that lets the more specific path win can't reopen it). */
+    protectedStorage?: string[];
 };
 export { isWritesMode, WRITES_DEFAULT, type WritesMode } from "./writes-mode.js";
 /**

package/dist/agent-fence.js

@@ -34,6 +34,7 @@ import { readMonitoring } from "./monitoring-settings.js";
 import { existingFolders } from "./names.js";
 import { DEPS_FOLDER, linkedKey, readyCopy, sharedCopies } from "./shared-deps.js";
 import { SEATBELT_PROBE, sandboxRuntimeProblem, srtSpawn } from "./sandbox-runtime.js";
+import { protectedStorageDenies, protectedStorageNames } from "./protected-storage.js";
 import { getDefaultWritePaths } from "@anthropic-ai/sandbox-runtime";
 /** Names that are secrets wherever the database lives (used when its folder is shared with other things). */
 const SENSITIVE_NAME = /(^up-login\.txt$|token|secret|login|password|credential|vapid|keys?\b|\.pem$|\.key$|^backups$|^evidence$|^remote$|^sign-in\.json$|^monitoring\.json$)/i;
@@ -188,11 +189,18 @@ export function agentFence(options) {
     for (const path of options.boundary?.protectedShell ?? [])
         fence.add(real(path));
     const protectedPaths = new Set([...fence].flatMap(path => path === runFolder ? [path, real(path)] : [real(path)]));
+    // Protected storage (chat apps, browser profiles, password managers): every launch, every policy, never exemptible,
+    // kept by the name it was resolved under as well as where it leads.
+    const storage = options.protectedStorage ?? protectedStorageDenies(home);
+    for (const path of storage) {
+        protectedPaths.add(path);
+        protectedPaths.add(real(path));
+    }
     for (const path of options.boundary?.shell ?? [])
         fence.add(path);
     const binding = options.binding;
     const needed = binding === undefined || binding === null ? [] : [binding.gitdir, real(join(binding.main, ".git"))];
-    return [...new Set([...fence].flatMap(path => path === runFolder ? [path, real(path)] : [real(path)]))].filter(path => {
+    return [...new Set([...[...fence].flatMap(path => path === runFolder ? [path, real(path)] : [real(path)]), ...storage.flatMap(path => [path, real(path)])])].filter(path => {
         if (protectedPaths.has(path) || !needed.some(target => target === path || inside(target, path)))
             return true;
         console.warn(`Dropped build fence entry covering this checkout's own Git data: ${path}`);
@@ -237,10 +245,12 @@ export function taskBoundary(options) {
     const present = (names) => names.map(name => join(home, name)).filter(path => existsSync(path)).map(real);
     // Policy v2 (docs/plans/sandbox-parity.md §1.2): the home folder, the repositories beside this one and the project's
     // primary checkout are read as Anthropic's sandbox runtime reads them; only writes to the primary checkout stay denied.
+    // Protected storage by name, under both policies (protected-storage.ts): never part of the v1-only home configuration.
+    const storage = protectedStorageNames(home);
     if ((options.policy ?? 1) === 2)
-        return v2Boundary(worktree, main, gitdir);
+        return v2Boundary(worktree, main, gitdir, storage);
     const shell = new Set(present(HOME_CONFIGURATION.filter(name => !own.has(name))));
-    const protectedShell = [...shell];
+    const protectedShell = [...shell, ...storage];
     const repository = (path) => existsSync(join(path, ".git"));
     for (const parent of new Set([dirname(worktree), ...(main === null ? [] : [dirname(main)])])) {
         // Home contains toolchain clones such as .nvm and .oh-my-zsh. The
@@ -290,7 +300,7 @@ export function taskBoundary(options) {
 /** A v2 boundary: nothing of the home folder, the repositories beside this one or the primary checkout is denied to
  * read; the primary checkout (all but its `.git`, which this worktree's Git needs) is never written; other tasks' Git
  * metadata is read, never written, as under v1. */
-function v2Boundary(worktree, main, gitdir) {
+function v2Boundary(worktree, main, gitdir, storage) {
     const noWrite = new Set();
     if (main !== null && main !== worktree) {
         let entries = [];
@@ -309,7 +319,7 @@ function v2Boundary(worktree, main, gitdir) {
     const { readOnly, lookup } = siblingGitData(main, gitdir);
     for (const path of noWrite)
         readOnly.add(path);
-    return { protectedShell: [], shell: [], fileTools: [], readOnly: [...readOnly].sort(), lookup: [...lookup].sort(), homeNames: [] };
+    return { protectedShell: [...storage], shell: [], fileTools: [], readOnly: [...readOnly].sort(), lookup: [...lookup].sort(), homeNames: [] };
 }
 /**
  * Git needs this worktree's metadata and the shared objects/refs, but must not prune or rewrite the metadata of another
@@ -765,6 +775,18 @@ function codexFilesystem(fence, fullAccess, grants) {
         if (basename(path) === INSTANCE_DIR)
             access.set(path, "deny");
     }
+    // Protected storage: denied by name and real path, and nothing granted inside it (Codex lets the more specific path
+    // win, so a grant there would reopen it).
+    const storage = grants.protectedStorage ?? [];
+    if (storage.length > 0) {
+        for (const [path, mode] of [...access])
+            if (mode !== "deny" && storage.some(one => path === one || inside(path, one)))
+                access.delete(path);
+        for (const path of storage) {
+            access.set(path, "deny");
+            access.set(real(path), "deny");
+        }
+    }
     return access;
 }
 /**
@@ -971,6 +993,16 @@ export function srtTermsOf(fence, grants = NO_GRANTS) {
                 denyWrite.add(sealed);
         }
     }
+    // Protected storage last: denied to read and write by name and real path, and no read grant inside it survives.
+    const storage = grants.protectedStorage ?? [];
+    const isProtected = (path) => storage.some(one => path === one || inside(path, one) || real(path) === one || inside(real(path), one));
+    for (const path of storage) {
+        denyRead.add(path);
+        denyWrite.add(path);
+    }
+    for (const path of [...allowRead])
+        if (isProtected(path))
+            allowRead.delete(path);
     const readConfig = { denyOnly: [...denyRead].sort(), allowWithinDeny: [...allowRead].sort() };
     const writes = grants.writes;
     // A sign-ins check also writes Codex's session and log folders and its own Claude transcripts (never inside a
@@ -983,7 +1015,7 @@ export function srtTermsOf(fence, grants = NO_GRANTS) {
     const network = grants.network;
     return {
         readConfig,
-        writeConfig: { allowOnly: [...new Set(allowOnly)].sort(), denyWithinAllow: [...denyWrite].sort() },
+        writeConfig: { allowOnly: [...new Set(allowOnly)].filter(path => path === "/" || !isProtected(path.replace(/\*$/, ""))).sort(), denyWithinAllow: [...denyWrite].sort() },
         allowMachLookup: [...grants.machLookup ?? [], ...grants.signIns?.mach ?? []],
         ...(grants.browser === true ? { browser: true } : {}),
         ...(grants.keychain === true ? { keychain: true } : {}),
@@ -1078,7 +1110,9 @@ export function launchSandboxOf(profile) {
 export function fenceFor(kind, ctx) {
     const home = ctx.home === undefined ? {} : { home: ctx.home };
     // The project's read denies join the fence by name, there or not (the runtime denies a path that isn't there yet).
-    const fence = agentFence({ databaseFile: ctx.databaseFile, worktree: ctx.worktree, ...home, boundary: ctx.boundary, binding: ctx.binding, runFolders: ctx.runFolders, extra: [...ctx.extra ?? [], ...ctx.readDeny ?? []] });
+    // Protected storage, resolved once for this launch, from the plane's own environment (protected-storage.ts).
+    const storage = protectedStorageDenies(ctx.home ?? homedir());
+    const fence = agentFence({ databaseFile: ctx.databaseFile, worktree: ctx.worktree, ...home, boundary: ctx.boundary, binding: ctx.binding, runFolders: ctx.runFolders, extra: [...ctx.extra ?? [], ...ctx.readDeny ?? []], protectedStorage: storage });
     const found = fenceGrants({ databaseFile: ctx.databaseFile, worktree: ctx.worktree, boundary: ctx.boundary, runFolders: ctx.runFolders, linked: ctx.linked ?? null, binding: ctx.binding, ...home, poolRoots: ctx.poolRoots });
     // Toolroll's own install, the sandbox runtime's package and the Node running them, never written by anything it
     // launches: rewriting the code that fences a build would switch the fence off.
@@ -1095,6 +1129,7 @@ export function fenceFor(kind, ctx) {
         ...(kind === "build" ? { keychain: true } : {}),
         // Under a write allowlist these are out of reach already; where the launch writes anywhere, they are denied by name.
         writeDenies: homeWriteDenies(ctx.home ?? homedir(), ctx.binding, ctx.provider ?? null),
+        protectedStorage: storage,
         ...(made.pool === undefined ? {} : { pool: { ...made.pool, ...(ctx.policy === 2 ? { readable: true } : {}),
                 // Flows' scratch folders in the pool (and any the caller names) stay denied whole, at every policy version.
                 sealed: sealedScratch(ctx.poolRoots, ctx.scratchRoots ?? []) } }),