toolroll 0.9.72 → 0.9.73

package/dist/contracts/release-terms.d.ts

@@ -13,6 +13,7 @@ export declare const releasePolicySchema: z.ZodObject<{
         files: z.ZodInt;
         churn: z.ZodInt;
     }, z.core.$strict>;
+    unsandboxedCarry: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 export type ReleasePolicy = z.infer<typeof releasePolicySchema>;
 export declare const releaseTermsSchema: z.ZodObject<{
@@ -35,12 +36,17 @@ export declare const releaseTermsSchema: z.ZodObject<{
             files: z.ZodInt;
             churn: z.ZodInt;
         }, z.core.$strict>;
+        unsandboxedCarry: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>;
     grant: z.ZodObject<{
         id: z.ZodInt;
         digest: z.ZodString;
     }, z.core.$strict>;
-    access: z.ZodLiteral<"sandboxed">;
+    access: z.ZodEnum<{
+        sandboxed: "sandboxed";
+        "sign-ins": "sign-ins";
+        unsandboxed: "unsandboxed";
+    }>;
     expiresAt: z.ZodISODateTime;
 }, z.core.$strict>;
 export type ReleaseTerms = z.infer<typeof releaseTermsSchema>;

package/dist/contracts/release-terms.js

@@ -17,6 +17,9 @@ export const releasePolicySchema = versioned(1, {
     protectProject: z.boolean(),
     protectedPaths: z.array(z.string().min(1).max(400)).max(200),
     limits: z.strictObject({ lines: z.int().min(0).max(1_000_000), files: z.int().min(0).max(100_000), churn: z.int().min(0).max(1_000_000) }),
+    /** "Carry release approvals when checks aren't sandboxed" (a person's project setting, off by default). Absent (a
+     * policy sealed before it existed): off. */
+    unsandboxedCarry: z.boolean().optional(),
 });
 const sha = z.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/);
 export const releaseTermsSchema = versioned(1, {
@@ -29,8 +32,9 @@ export const releaseTermsSchema = versioned(1, {
     approvedTree: sha,
     policy: releasePolicySchema,
     grant: z.strictObject({ id: z.int(), digest: z.string().min(1).max(128) }),
-    /** The check access the release check runs with: only the fence ever carries. */
-    access: z.literal("sandboxed"),
+    /** The check access the release check runs with at approval: the fence, or (only with unsandboxedCarry sealed in the
+     * policy) a wider one. Never wider later: a check that reaches further than this stops the release. */
+    access: z.enum(["sandboxed", "sign-ins", "unsandboxed"]),
     expiresAt: z.iso.datetime(),
 });
 export function readReleaseTerms(input) {

package/dist/exec.d.ts

@@ -200,7 +200,7 @@ export declare function confined(file: string, args: readonly string[], bag: {
     env: Record<string, string>;
 };
 /** A spawn's environment with what its sandbox needs added (nothing added: the caller's, as it was). */
-export declare function withSandboxEnv<T extends Record<string, string | undefined>>(env: T | undefined, added: Record<string, string>): T | Record<string, string | undefined> | undefined;
+export declare function withSandboxEnv<T extends Record<string, string | undefined>>(env: T | undefined, added: Record<string, string>, fenced?: boolean): T | Record<string, string | undefined> | undefined;
 /** Run IDs are local to a database. Connections to the same file share
  * custody; separate files and separate in-memory databases never do. */
 export declare function runOwnerTag(store: Store, runId: number): string;

package/dist/exec.js

@@ -8,6 +8,7 @@
  */
 import { ACP_LINE_CAP, createAcpConversation } from "./acp-client.js";
 import { linuxFenceAvailable, macosFenceAvailable, sandboxedSpawn } from "./agent-fence.js";
+import { withoutProtectedEnv } from "./protected-storage.js";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { readlinkSync, realpathSync } from "node:fs";
 import { observeProcessTree, stopProcessTree } from "./process-tree.js";
@@ -75,7 +76,10 @@ export function confined(file, args, bag) {
     return { file, args: [...args], env: {} };
 }
 /** A spawn's environment with what its sandbox needs added (nothing added: the caller's, as it was). */
-export function withSandboxEnv(env, added) {
+export function withSandboxEnv(env, added, fenced = false) {
+    // A fenced launch never gets a chat or vault variable (protected-storage.ts), whoever made its environment.
+    if (fenced)
+        return withoutProtectedEnv({ ...(env ?? process.env), ...added });
     return Object.keys(added).length === 0 ? env : { ...(env ?? process.env), ...added };
 }
 /** A spawn callback refused custody AFTER the child existed: the caller
@@ -107,7 +111,7 @@ function spawnContained(file, args, spawnOptions, label, bag, contain = true) {
     // The agent fence wraps the target itself (sandbox-exec then execs it, same pid).
     const sandboxed = confined(file, args, { ...bag, cwd: spawnOptions.cwd, temp: spawnOptions.env?.["TMPDIR"] });
     ({ file, args } = sandboxed);
-    spawnOptions = { ...spawnOptions, env: withSandboxEnv(spawnOptions.env, sandboxed.env) };
+    spawnOptions = { ...spawnOptions, env: withSandboxEnv(spawnOptions.env, sandboxed.env, (bag.fence?.length ?? 0) > 0) };
     // The policy refusal comes first: nothing is reserved, recorded or
     // spawned for a spawn that cannot be contained as required.
     const effective = contain ? currentContainment() : null;
@@ -583,7 +587,7 @@ export function run(file, args, options = {}) {
             encoding: "utf8",
             shell: false,
             windowsHide: true,
-            ...((env => env === undefined ? {} : { env }))(withSandboxEnv(childEnv, wrapped.env)),
+            ...((env => env === undefined ? {} : { env }))(withSandboxEnv(childEnv, wrapped.env, (options.fence?.length ?? 0) > 0)),
         }, (error, stdout, stderr) => {
             if (error === null) {
                 resolve({ result: { code: 0, stdout, stderr, timedOut: false, notFound: false }, transient: false });

package/dist/flow-gallery-ui.js

@@ -5,7 +5,7 @@
  * A template's tools show their marks and whether the project has them; one it lacks offers Connect first.
  */
 import { brandMarkHtml } from "./brand-mark.js";
-import { BLANK, GALLERY, GALLERY_GROUPS, galleryDiagram, galleryToolsOf, OUTDATED_COMMANDS, SEND_RESULT, sendsAlready } from "./flow-gallery.js";
+import { BLANK, GALLERY, GALLERY_GROUPS, galleryAdmitsAnyone, galleryDiagram, galleryToolsOf, OUTDATED_COMMANDS, SEND_RESULT, sendsAlready } from "./flow-gallery.js";
 import { choiceTargets } from "./flows.js";
 import { html, joinHtml, postForm, reauth } from "./html.js";
 export const GALLERY_CSS = `.gallery{max-width:1120px;min-width:0}.gallery h2{margin:28px 0 10px;font-size:.9375rem}.gallery h2:first-of-type{margin-top:8px}` +
@@ -107,7 +107,9 @@ export function galleryUseHtml(input) {
         : html `<input type="hidden" name="repo" value="${input.repo}">`;
     const preview = input.preview === null ? "" : html `<section class="gallery-preview" aria-labelledby="gallery-will"><h2 id="gallery-will">What it will do</h2><ul>${input.preview.built.does.map(one => html `<li>${one}</li>`)}</ul><p class="gallery-never">${input.preview.built.never}</p>${needing}${input.preview.startsFrom.length === 0 ? html `<p class="meta">Cards start when you add them.</p>` : input.preview.startsFrom.map(one => html `<p class="meta">Starts from: ${one}</p>`)}<details><summary>Every step</summary><ol>${input.preview.steps.map(one => html `<li>${one.replace(/^\d+\.\s/, "")}</li>`)}</ol></details></section>`;
     const sendResult = !sendsAlready(template) && html `<label class="gallery-check"><input type="checkbox" name="${SEND_RESULT.key}" value="yes"${input.answers[SEND_RESULT.key] === "yes" && html ` checked`} data-send-result><span>${SEND_RESULT.title}<small>When a card finishes, what was done comes to you in your chat apps.</small></span></label>`;
-    const actions = html `<p class="gallery-actions">${input.preview !== null && html `<button type="submit" name="intent" value="create"${missing.length > 0 && html ` class="secondary" data-without-tools`}>Create flow</button>`}<button type="submit" name="intent" value="preview" class="secondary">${input.preview === null ? "Preview" : "Update preview"}</button></p>`;
+    // A flow that brings in items from anyone takes the password to make (chat-management.md §0a.3).
+    const step = input.preview !== null && galleryAdmitsAnyone(template) ? reauth(html `<label>Your password <span class="meta">(it brings in items from anyone)</span><input type="password" name="password" autocomplete="current-password"></label>`) : "";
+    const actions = html `${step}<p class="gallery-actions">${input.preview !== null && html `<button type="submit" name="intent" value="create"${missing.length > 0 && html ` class="secondary" data-without-tools`}>Create flow</button>`}<button type="submit" name="intent" value="preview" class="secondary">${input.preview === null ? "Preview" : "Update preview"}</button></p>`;
     const form = postForm(`/flows/new/${template.id}`, html `${project}${template.asks.map(field)}<label>Name<input name="name" value="${input.name}" maxlength="80"></label>${sendResult}${preview}${actions}`, { attrs: { "data-gallery-use": true }, hidden: { previewed: input.preview?.digest ?? "" } });
     return html `<section class="gallery-use" data-gallery-template="${template.id}">${input.problem !== null && html `<p class="problem" role="alert">${input.problem}</p>`}${input.said ? html `<p role="status">${input.said}</p>` : ""}<p>${template.promise}</p>${input.diagram !== null && stepStrip(input.diagram)}${needsList(template)}${toolsBlock}${form}<p class="meta"><a href="/flows/new">All templates</a></p></section>`;
 }

package/dist/flow-gallery.d.ts

@@ -136,9 +136,12 @@ export type GalleryUsed = {
     said: string;
 };
 /** Use a template in a project: its scripts, its flow and its triggers, together or not at all. */
+/** Whether a template's triggers bring in items from anyone: making it takes the person's password. */
+export declare function galleryAdmitsAnyone(template: GalleryTemplate): boolean;
 export declare function useGalleryTemplate(store: Store, template: GalleryTemplate, repo: string, given: GalleryAnswers, input: {
     name?: string | null;
     by: string;
     now: Date;
     dir: string | null;
+    widening?: "proved";
 }): GalleryUsed;

package/dist/flow-gallery.js

@@ -20,7 +20,7 @@ import { scanForSecrets } from "./evidence.js";
 import { flowDefinitionOf } from "./flow-engine.js";
 import { saveScript, validateScript } from "./flow-scripts.js";
 import { isToolrollRepo, planeReviewSteps } from "./flow-starters.js";
-import { addFlowTriggerTo, describeTrigger, githubRepoOf, scheduleFromWords, validateTriggerConfig } from "./flow-triggers.js";
+import { addFlowTriggerTo, describeTrigger, githubRepoOf, rawAdmitsAnyone, scheduleFromWords, validateTriggerConfig } from "./flow-triggers.js";
 import { choiceTargets, clockTime, flowFromSteps, flowTerms, FLOW_TEMPLATES, ISSUE_LABEL } from "./flows.js";
 import { connectionsOf, localConnectOf, oneClickOf } from "./mcp-connect.js";
 import { publishingOf } from "./pull-request-flow.js";
@@ -640,6 +640,10 @@ export function galleryDigest(id, repo, answers) {
     return createHash("sha256").update(JSON.stringify([id, repo, Object.entries(answers).sort(([a], [b]) => a.localeCompare(b))])).digest("hex").slice(0, 24);
 }
 /** Use a template in a project: its scripts, its flow and its triggers, together or not at all. */
+/** Whether a template's triggers bring in items from anyone: making it takes the person's password. */
+export function galleryAdmitsAnyone(template) {
+    return template.triggers.some(one => rawAdmitsAnyone(one));
+}
 export function useGalleryTemplate(store, template, repo, given, input) {
     try {
         const built = buildFromGallery(store, template, repo, given);
@@ -656,7 +660,7 @@ export function useGalleryTemplate(store, template, repo, given, input) {
             const made = store.getFlow(id);
             for (const trigger of built.triggers) {
                 // No one is shown the gallery's addresses: a webhook is made with none until its panel makes one (v126).
-                const added = addFlowTriggerTo(store, made, { ...trigger, zone: trigger["zone"] ?? flowDefinitionOf(made).start }, input.by, input.now, input.dir, { shown: false });
+                const added = addFlowTriggerTo(store, made, { ...trigger, zone: trigger["zone"] ?? flowDefinitionOf(made).start }, input.by, input.now, input.dir, { shown: false, ...(input.widening === undefined ? {} : { widening: input.widening }) });
                 if (!added.ok)
                     throw new Error(added.message);
                 if (added.reveal !== null)

package/dist/flow-triggers.d.ts

@@ -57,6 +57,11 @@ export declare const senderOf: (config: Extract<TriggerConfig, {
 /** Whether this trigger takes deliveries at a secret address rather than being checked. */
 /** Whether a raw trigger the caller is about to add would take deliveries (an address): read leniently, before validation. */
 export declare function rawTakesDeliveries(raw: unknown): boolean;
+/** Whether a trigger brings in items from anyone (chat-management.md §0a.3): GitHub issues or pull requests from anyone,
+ * or mail from any sender. A widening: it takes a person's password, on every road that adds one. */
+export declare function admitsAnyone(config: TriggerConfig): boolean;
+/** The same, read leniently from a raw trigger before validation (so the form can ask for the password first). */
+export declare function rawAdmitsAnyone(raw: unknown): boolean;
 export declare function takesDeliveries(config: TriggerConfig): boolean;
 /** A webhook's signing secret (made here, or pasted from its sender). In the keychain (or an owner-only file where there's none), never a column. */
 export declare function saveHookSecret(dir: string, trigger: number, secret: string, credential?: string): void;
@@ -104,6 +109,9 @@ export type TriggerMade = {
 export declare function addFlowTriggerTo(store: Store, flow: FlowRow, raw: unknown, actor: string, now: Date, dir: string | null, options?: {
     shown?: boolean;
     ingress?: "proved";
+    /** The person proved themselves for this act (a password, or a session under Passwordless): a trigger that admits
+     * anyone is added only then. */
+    widening?: "proved";
 }): TriggerMade;
 /** A new secret address for a webhook trigger (the old one stops working at once). */
 export declare function renewFlowHook(store: Store, trigger: FlowTriggerRow, now: Date, dir: string): TriggerMade;

package/dist/flow-triggers.js

@@ -368,6 +368,18 @@ export function rawTakesDeliveries(raw) {
     const one = raw;
     return one["kind"] === "webhook" || ((one["kind"] === "github" || one["kind"] === "linear") && one["delivery"] === "webhook");
 }
+/** Whether a trigger brings in items from anyone (chat-management.md §0a.3): GitHub issues or pull requests from anyone,
+ * or mail from any sender. A widening: it takes a person's password, on every road that adds one. */
+export function admitsAnyone(config) {
+    return (config.kind === "github" && config.from === "anyone") || (config.kind === "email" && config.sender === null);
+}
+/** The same, read leniently from a raw trigger before validation (so the form can ask for the password first). */
+export function rawAdmitsAnyone(raw) {
+    if (raw === null || typeof raw !== "object")
+        return false;
+    const one = raw;
+    return (one["kind"] === "github" && one["from"] === "anyone") || (one["kind"] === "email" && (typeof one["sender"] !== "string" || one["sender"].trim() === ""));
+}
 export function takesDeliveries(config) {
     return config.kind === "webhook" || ((config.kind === "github" || config.kind === "linear") && config.delivery === "webhook");
 }
@@ -495,6 +507,9 @@ export function addFlowTriggerTo(store, flow, raw, actor, now, dir, options = {}
         return { ok: false, message: "Webhook addresses are set up on the console." };
     if (takesDeliveries(config) && config.kind !== "webhook" && options.ingress !== "proved")
         return { ok: false, message: "Webhook delivery is set up on the flow's trigger panel, with your password." };
+    // Items from anyone come in only on a person's proof (chat-management.md §0a.3): never from a card, an import or a template alone.
+    if (admitsAnyone(config) && options.ingress !== "proved" && options.widening !== "proved")
+        return { ok: false, message: "A trigger that brings in items from anyone takes your password. Add it on the flow's Triggers panel." };
     // v126: a webhook made where no one is shown its address (the gallery, an import) is made with none: its first
     // set-up or New address makes one and shows it. A webhook made on its panel is shown its address now.
     const token = takesDeliveries(config) && options.ingress === "proved" && (options.shown !== false || config.kind !== "webhook") ? randomBytes(24).toString("base64url") : null;

package/dist/flows-cli.js

@@ -21,7 +21,8 @@ import { deciderOf, FLOW_KIND_WORDS, FLOW_TEMPLATES, flowDigest, flowFromSteps,
 import { prepareUnattendedCandidates, activeUnattendedGrant, parseUnattendedAsk, revokeUnattended, signUnattended, unattendedViewOf, unattendedWords, untilWords, UNATTENDED_MAX_RUNS } from './flow-unattended.js';
 import { MODE_MAX_DAYS } from './modes.js';
 import { verifyApproverByPassword } from './principal.js';
-import { proveCredential } from './scope.js';
+import { authenticateApprover, proveCredential } from './scope.js';
+import { personProof } from './person-proof.js';
 import { projectName } from './project.js';
 const EXIT = { ok: 0, failed: 1, usage: 2, refused: 3 };
 const json = { name: 'json', takesValue: false, meaning: 'answer with one machine envelope on stdout' };
@@ -157,6 +158,12 @@ export async function runFlowsCommand(positional, flags, context) {
         store.recordAction({ at: context.clock().toISOString(), actor: who, repo: project, taskId: null, runId: null, action: command, outcome, source: 'request', detail: `command line${detail === null ? '' : ` · ${detail}`}` });
     };
     const refuse = (project, reason, message, code = EXIT.refused) => { record(project, 'refused', reason); return fail(reason, message, code); };
+    // A trigger from anyone widens what comes in (chat-management.md §0a.3): only the person's own proof counts, never a
+    // machine credential standing in for them (a remote run's API token, a lead's token), though both pass the check above.
+    const widening = (project) => {
+        const proved = authenticateApprover(store, acting.name, acting.token, project);
+        return proved.ok && personProof(proved.method) ? { widening: 'proved' } : {};
+    };
     const settle = (project) => { try {
         advanceFlows(store, project, context.clock(), { evidenceRoot: context.evidenceRoot });
     }
@@ -243,11 +250,13 @@ export async function runFlowsCommand(positional, flags, context) {
         if (!flags.has('yes'))
             return preview(project, `Create the ${flowName} flow in ${projectName(project)}`, terms, { definition });
         let id;
+        const proof = template?.trigger === undefined ? {} : widening(project);
         try {
             id = store.transact(() => {
                 const made = store.createFlow({ repo: project, name: flowName, definitionJson: JSON.stringify(definition), by: who }, now);
                 if (template?.trigger !== undefined) {
-                    const trigger = addFlowTriggerTo(store, store.getFlow(made), template.trigger, who, now, context.configDir);
+                    // A trigger from anyone only on the person's own proof (widening above); a machine credential's is refused.
+                    const trigger = addFlowTriggerTo(store, store.getFlow(made), template.trigger, who, now, context.configDir, proof);
                     if (!trigger.ok)
                         throw new Error(trigger.message);
                 }
@@ -508,7 +517,8 @@ export async function runFlowsCommand(positional, flags, context) {
         const ingress = rawTakesDeliveries(input.value);
         if (ingress && !proveCredential(store, acting.name, acting.token).ok)
             return refuse(flow.repo, 'unauthenticated', 'Making a webhook address takes your password, typed: pass --token.');
-        const made = addFlowTriggerTo(store, flow, input.value, who, now, context.configDir, ingress ? { ingress: 'proved' } : {});
+        // A trigger from anyone only on the person's own proof (widening above): a machine credential's is refused.
+        const made = addFlowTriggerTo(store, flow, input.value, who, now, context.configDir, ingress ? { ingress: 'proved' } : widening(flow.repo));
         if (!made.ok)
             return refuse(flow.repo, 'invalid-trigger', made.message);
         await prepareUnattendedCandidates(store, flow.id);

package/dist/guides.js

@@ -445,7 +445,13 @@ with a time limit.
 
 ## What it does, in order
 
-1. **gate**: files task \`release-<version>-<sha7>\` pinned to the
+1. **gate**: before filing, looks at the pull request's checks on the
+   branch's exact commit: a required check that failed stops here, before
+   anything is filed or sent for approval. Checks not started or still
+   running are named and waited for (GitHub not answering is waited out
+   too); if they don't finish within the gate's limit (60 min, \`--limit
+   gate=<min>\`), it stops here as well. A task already filed for the commit is kept and
+   not looked at again. Then it files task \`release-<version>-<sha7>\` pinned to the
    branch's exact commit with \`--checks full\`, regardless of the project's default.
 2. **approval**: waits for the owner to approve that exact scope
    (\`toolroll task approve <id> --digest <d>\`, or the console). A
@@ -499,6 +505,9 @@ instead of making them twice.
   checks and obtain a passing result; Quick and Off cannot authorize a release.
 - \`check-failed\`: fix the branch and release the new commit with \`--new\`.
 - \`ci-failed\`: fix the failed GitHub check, then rerun. Nothing was merged.
+  A stop at the gate comes before the task is filed, so nothing was filed
+  either: a fix pushed as a new commit is released with \`--new\`; after
+  rerunning the failed job on GitHub, run the same command again.
 - \`publish-failed\` / \`homebrew-failed\`: fix the failed workflow before
   resuming. A failed tag check cannot finish publication or update Homebrew.
 - \`base-moved\`: main gained a commit the branch doesn't have, so the

package/dist/kits-ui.js

@@ -1,6 +1,6 @@
 import { kitChecklist, kitInstalled, KITS } from "./kits.js";
 import { SUBAGENT_TEMPLATES } from "./subagents.js";
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 const CHECK = html `<svg viewBox="0 0 24 24" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>`;
 const RING = html `<svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="12" cy="12" r="8"/></svg>`;
 export const KITS_CSS = `.kits{max-width:960px;min-width:0}.kits-lede{color:var(--so-muted);margin:.25rem 0 1.5rem;max-width:40rem}.kit-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:16px}` +
@@ -35,7 +35,9 @@ export function kitPageHtml(store, kit, repo, dir, canSetUp, notice) {
     const rows = steps.map(step => {
         const go = step.done ? (step.href === null ? "" : html `<a class="kit-step-go" href="${step.href}">Open</a>`)
             : step.action === "sample" || step.action === "github"
-                ? (canSetUp ? postForm(`/kits/${kit.id}/${step.action}`, html `<button${step.action === "sample" ? "" : html ` class="secondary"`}>${step.action === "sample" ? "Try it" : "Bring them in"}</button>`, { hidden: { repo } }) : "")
+                ? (canSetUp ? postForm(`/kits/${kit.id}/${step.action}`, step.action === "sample" ? html `<button>Try it</button>`
+                    // Issues from anyone come in: it takes your password (an ordinary step-up; a session does under Passwordless).
+                    : html `${reauth(html `<input type="password" name="password" autocomplete="current-password" aria-label="Your password" placeholder="Your password">`)}<button class="secondary">Bring them in</button>`, { hidden: { repo } }) : "")
                 : step.href === null ? "" : html `<a class="kit-step-go" href="${step.href}">${step.action === "connect" ? "Connect" : "Set up"}</a>`;
         return html `<li data-step="${step.id}" data-done="${String(step.done)}">${step.done ? CHECK : RING}<span class="kit-step-said">${step.said}</span>${go}</li>`;
     });

package/dist/kits.d.ts

@@ -53,9 +53,11 @@ export declare function kitInstalled(store: Store, kit: Kit, repo: string): {
  * flow, and its button triggers; then its subagent may use whichever of the
  * kit's tools the project already has (reading free, writing asking first).
  */
-export declare function setUpKit(store: Store, kit: Kit, repo: string, by: string, now: Date, dir: string | null, io?: ToolIo): Promise<Done>;
-/** The same, all at once (a chat confirmation can't wait on a tool): its subagent is given the kit's connected tools by the names their last test found, and each is listed properly on its first turn. */
-export declare function setUpKitNow(store: Store, kit: Kit, repo: string, by: string, now: Date, dir: string | null, grantByName?: boolean): Done;
+export declare function setUpKit(store: Store, kit: Kit, repo: string, by: string, now: Date, dir: string | null, io?: ToolIo, options?: {
+    widening?: "proved";
+}): Promise<Done>;
+/** The same, all at once and without its tools (a chat confirmation is never a grant's proof): its subagent, its flow and its buttons. */
+export declare function setUpKitNow(store: Store, kit: Kit, repo: string, by: string, now: Date, dir: string | null): Done;
 /** One line of a kit's checklist: done, or the next step with where to take it. */
 export type KitStep = {
     id: string;
@@ -76,7 +78,7 @@ export declare function addKitSample(store: Store, kit: Kit, repo: string, by: s
     said: string;
 };
 /** Bring new issues from the project's GitHub repository into the kit's flow (issues from anyone, polled). */
-export declare function addKitGithubTrigger(store: Store, kit: Kit, repo: string, by: string, now: Date, dir: string | null): {
+export declare function addKitGithubTrigger(store: Store, kit: Kit, repo: string, by: string, now: Date, dir: string | null, proved?: "proved" | null): {
     ok: true;
     said: string;
 } | {

package/dist/kits.js

@@ -17,7 +17,7 @@ import { readEmailSettings } from "./email-settings.js";
 import { mailboxReady } from "./mailbox.js";
 import { projectToolsOf } from "./project-tools.js";
 import { createSubagentFrom, nameOf } from "./subagent-admin.js";
-import { grantListed, grantTool } from "./subagent-tools.js";
+import { grantTool } from "./subagent-tools.js";
 import { SUBAGENT_TEMPLATES } from "./subagents.js";
 export const KITS = [
     {
@@ -115,22 +115,23 @@ export function kitInstalled(store, kit, repo) {
  * flow, and its button triggers; then its subagent may use whichever of the
  * kit's tools the project already has (reading free, writing asking first).
  */
-export async function setUpKit(store, kit, repo, by, now, dir, io = {}) {
+export async function setUpKit(store, kit, repo, by, now, dir, io = {}, options = {}) {
     const made = setUpKitNow(store, kit, repo, by, now, dir);
-    if (!made.ok || made.said.endsWith("already set up here."))
+    // Its tools only with the person's proof (chat-management.md §0a.3); without it, the checklist says to let it use each.
+    if (!made.ok || made.said.endsWith("already set up here.") || options.widening !== "proved")
         return made;
     const mate = store.getSubagent(made.subagent);
     const present = new Set(projectToolsOf(store, repo).map(one => one.name));
     for (const tool of kit.tools.filter(one => present.has(one.tool))) {
         try {
-            await grantTool(store, mate, tool.tool, by, now, io);
+            await grantTool(store, mate, tool.tool, by, now, io, options);
         }
         catch { /* it can be given the tool on its page */ }
     }
     return made;
 }
-/** The same, all at once (a chat confirmation can't wait on a tool): its subagent is given the kit's connected tools by the names their last test found, and each is listed properly on its first turn. */
-export function setUpKitNow(store, kit, repo, by, now, dir, grantByName = false) {
+/** The same, all at once and without its tools (a chat confirmation is never a grant's proof): its subagent, its flow and its buttons. */
+export function setUpKitNow(store, kit, repo, by, now, dir) {
     const had = kitInstalled(store, kit, repo);
     if (had !== null)
         return { ok: true, said: `${kit.name} is already set up here.`, flow: had.flow.id, subagent: had.mate.id };
@@ -155,9 +156,6 @@ export function setUpKitNow(store, kit, repo, by, now, dir, grantByName = false)
     const flow = store.getFlow(flowId);
     for (const button of kit.buttons)
         addFlowTriggerTo(store, flow, { kind: "button", label: button.label, questions: button.questions, zone: definition.start }, by, now, dir);
-    if (grantByName)
-        for (const tool of projectToolsOf(store, repo).filter(one => kit.tools.some(each => each.tool === one.name)))
-            grantListed(store, mate, tool, null, by, now);
     return { ok: true, said: `${kit.name} is ready: ${nameOf(mate)} works its ${kit.flowName} flow.`, flow: flowId, subagent: mate.id };
 }
 /** What's set up and what's left, read fresh each time. */
@@ -205,11 +203,11 @@ export function addKitSample(store, kit, repo, by, now) {
     return added.ok ? { ok: true, href: flowCardHref(set.flow.id, added.card) } : { ok: false, said: added.message };
 }
 /** Bring new issues from the project's GitHub repository into the kit's flow (issues from anyone, polled). */
-export function addKitGithubTrigger(store, kit, repo, by, now, dir) {
+export function addKitGithubTrigger(store, kit, repo, by, now, dir, proved = null) {
     const set = kitInstalled(store, kit, repo);
     const github = githubRepoOf(repo);
     if (set === null || github === null)
         return { ok: false, said: "This project isn't on GitHub." };
-    const made = addFlowTriggerTo(store, set.flow, { kind: "github", repo: github, watch: "issues", from: "anyone", delivery: "poll", zone: flowDefinitionOf(set.flow)?.start }, by, now, dir);
+    const made = addFlowTriggerTo(store, set.flow, { kind: "github", repo: github, watch: "issues", from: "anyone", delivery: "poll", zone: flowDefinitionOf(set.flow)?.start }, by, now, dir, proved === null ? {} : { widening: proved });
     return made.ok ? { ok: true, said: `New issues on ${github} now come into ${kit.flowName}.` } : { ok: false, said: made.message };
 }

package/dist/mcp-connect.d.ts

@@ -117,6 +117,14 @@ export type ConnectVisit = {
     scope?: string | null;
     /** Where the service revokes a token, when its metadata said: a run's own token is revoked there when the run ends. */
     revoke?: string | null;
+    /** The signer's account generation when the password was typed at Connect: a rotation or revocation since ends the visit. */
+    generation?: number;
+    /** From a kit: the one grant the password at Connect proved (its subagent, this tool, this project); nothing else. */
+    grant?: {
+        subagent: number;
+        tool: string;
+        repo: string;
+    } | null;
 };
 /** A server's sign-in: the resource metadata its 401 names (or the well-known one), then its authorization server's metadata. */
 export declare function discoverSignIn(mcpUrl: string, fetcher?: Fetch): Promise<Server | null>;
@@ -154,6 +162,8 @@ export declare function finishConnect(store: Store, visit: ConnectVisit, code: s
     home?: string | undefined;
     test?: boolean;
     omitEnv?: readonly string[];
+    /** The signer's standing, checked again after the token answer and before anything changes. */
+    stillStanding?: () => boolean;
 }): Promise<{
     ok: true;
     said: string;

package/dist/mcp-connect.js

@@ -351,6 +351,8 @@ export async function finishConnect(store, visit, code, now, options = {}) {
     const tokens = tokensFrom(body, now.getTime());
     if (tokens.access === null)
         return { ok: false, said: `${service.label} didn't send a sign-in token.` };
+    if (options.stillStanding !== undefined && !options.stillStanding())
+        return { ok: false, said: "Your access changed during the sign-in, so nothing was connected. Connect again." };
     if (had === undefined) {
         const added = addToolTo(store, visit.repo, spec, `${service.label}, connected by signing in`, visit.by, now, { home });
         if (!added.ok)

package/dist/project-tools.js

@@ -22,6 +22,7 @@
 import { toolRefusal } from "./policy.js";
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
+import { isProtectedEnvName } from "./protected-storage.js";
 import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { realpathSync } from "node:fs";
@@ -572,7 +573,8 @@ function exchangeStdio(spec, values, timeoutMs, base, omit, request, fence) {
         let child;
         try {
             const launch = confined(spec.command, spec.args, { ...(fence ?? {}), temp: env["TMPDIR"] });
-            child = spawn(launch.file, launch.args, { env: { ...env, ...launch.env }, stdio: ["pipe", "pipe", "pipe"], detached: process.platform !== "win32" });
+            // A fenced server gets no chat or vault variable (protected-storage.ts) but the tool's own secrets, set by name.
+            child = spawn(launch.file, launch.args, { env: fence === null ? { ...env, ...launch.env } : { ...Object.fromEntries(Object.entries(env).filter(([name]) => !isProtectedEnvName(name) || Object.hasOwn(values, name))), ...launch.env }, stdio: ["pipe", "pipe", "pipe"], detached: process.platform !== "win32" });
         }
         catch (error) {
             if (error instanceof ContainmentRefusal) {

package/dist/protected-storage.d.ts

@@ -0,0 +1,67 @@
+/** One app's storage, relative to the home folder, per platform. */
+export type ProtectedApp = {
+    app: string;
+    darwin: readonly string[];
+    linux: readonly string[];
+};
+/**
+ * Every listed root. Checked against a real Mac (2026-10-25): existence only, never a file's contents. The 1Password
+ * containers and the extra Chrome, Edge and other browsers' folders below were found there and added.
+ */
+export declare const PROTECTED_STORAGE: readonly ProtectedApp[];
+/** The chat and vault variables no launch gets. */
+export declare const PROTECTED_ENV_PREFIXES: readonly string[];
+export declare function isProtectedEnvName(name: string): boolean;
+/** `env` without a chat or vault variable. */
+export declare function withoutProtectedEnv<T extends Record<string, string | undefined>>(env: T): T;
+/** How far the link walk goes in each present root. */
+export declare const PROTECTED_WALK: {
+    readonly depth: 4;
+    readonly entries: 5000;
+};
+/** The roots by name, under the (real) home folder and the overrides the plane's environment names. */
+export declare function protectedStorageNames(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform): string[];
+/**
+ * Every protected path one launch denies: each root by name and by real path, every link inside a present root that
+ * leads outward (where it leads, by real path and as spelled), and the overrides. Resolved at each launch, never kept.
+ * A link macOS makes in a sandboxed app's container to the same place under the home folder (its Desktop, Downloads,
+ * Fonts…) is the system's own mirror of the person's folders, not the app's data, and isn't followed (systemMirror).
+ *
+ * On a Mac, listing inside another app's container waits for the person to answer macOS's "access data from other apps"
+ * prompt when the process asking has no answer yet (a plane run by launchd: every launch, and the console with it, hung
+ * there in release check 3249). So the containers are walked only after a time-limited look in a child process
+ * (`containers`, containersListable) shows they can be listed without waiting. A look that fails any other way refuses
+ * the launch (it throws). When macOS is waiting on the person, the containers stay denied by name and real path, and
+ * the outward links the last complete walk found (kept in the plane's own state folder, linkCacheFile) stay denied too;
+ * with none kept, only the roots are denied, and that is said once.
+ */
+export declare function protectedStorageDenies(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform, say?: (line: string) => void, containers?: (roots: readonly string[]) => boolean, list?: (path: string) => import("node:fs").Dirent[]): string[];
+/** How long the look at other apps' containers may take before Toolroll takes it that macOS is waiting on the person. */
+export declare const CONTAINER_LOOK_MS = 3000;
+/** What a look at the containers found: listable without waiting, macOS waiting on the person (the look timed out), or
+ * the look itself failing (it couldn't start, crashed or was killed by anything but its own limit). */
+export type ContainerLook = "listable" | "waiting" | "failed";
+/**
+ * Whether this process can list inside these app containers without macOS stopping to ask the person: the walk run
+ * first in a child process that is killed at CONTAINER_LOOK_MS. Finishing in time (listed, or refused outright) means
+ * the walk can run here too; only running into that limit means macOS is waiting on the person (only the child waited).
+ * A look that fails any other way is tried once more, then throws: the launch is refused rather than fenced with less.
+ * A yes is kept (macOS keeps the person's answer); a no is looked at again after CONTAINER_RELOOK_MS.
+ */
+export declare function containersListable(roots: readonly string[], look?: (roots: readonly string[]) => ContainerLook, now?: () => number): boolean;
+/** A look's outcome from its child's result: only its own limit (ETIMEDOUT) is macOS waiting; any other error, signal
+ * or exit code is a failed look. */
+export declare function lookOutcome(result: {
+    error?: Error;
+    signal: NodeJS.Signals | null;
+    status: number | null;
+}): ContainerLook;
+/** Where the outward links the last complete container walk found are kept: the plane's own state folder (fenced from
+ * every build), one file per user. */
+export declare function linkCacheFile(home: string, env?: Readonly<Record<string, string | undefined>>): string;
+/** The kept links for this home: only a plain file of this user's (no link), at most LINK_CACHE_MAX, of exactly the
+ * kept shape; anything else is no cache at all. */
+export declare function readLinkCache(file: string, home: string): string[] | null;
+/** Keep a complete walk's links: written aside (owner-only) and renamed into place, only into a state folder that is
+ * already there. A failed write keeps whatever was kept before. */
+export declare function writeLinkCache(file: string, home: string, targets: readonly string[]): void;