toolroll 0.9.72 → 0.9.74

package/dist/live.js

@@ -13,17 +13,25 @@
  * Fail-soft everywhere: a live view that cannot be written must never
  * break, slow, or reclassify a build.
  */
-import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { closeSync, constants, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { join } from "node:path";
 import { scanForSecrets } from "./evidence.js";
 import { createLiveRecorder, parseLiveRecords, redactLiveLines, projectLiveText, serializeLiveRecord } from "./live-records.js";
+import { childLogWriter, createChildRecorder } from "./live-children.js";
+import { topLevelEvent } from "./stream-scope.js";
 export const LIVE_LINE_CAP = 2 * 1024;
 export const LIVE_FILE_CAP = 4 * 1024 * 1024;
 export const LIVE_REDACTED_LINE = "[a credential-shaped line was redacted]";
 /** Finalized runs keep their live file this long for the final drain. */
 export const LIVE_RETAIN_MS = 24 * 60 * 60 * 1000;
-/** The bounded sweep: at most this many FINALIZED files survive a pass. */
+/** The bounded sweep: at most this many FINALIZED runs' files survive a pass (a run's records and its subagents' file
+ * count as one). */
 export const LIVE_FILE_BOUND = 500;
+/** A run's subagent file (docs/plans/agents-view.md §2.3) is never larger than this; its writer stops there. */
+export const LIVE_SUB_FILE_CAP = 16 * 1024 * 1024;
+/** All finished and orphan live files together stay under this; the oldest runs go first past it. */
+export const LIVE_TOTAL_BYTES = 1024 * 1024 * 1024;
 export function liveDir(root) {
     return join(root, "live");
 }
@@ -33,6 +41,10 @@ export function liveDir(root) {
 export function liveLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.jsonl`);
 }
+/** A run's subagents' records (docs/plans/agents-view.md §2.3): the run's file, swept with it. */
+export function liveSubLogPath(root, runId) {
+    return join(liveDir(root), `${Math.trunc(runId)}.sub.jsonl`);
+}
 /** The plain-text file runs wrote before the live conversation; read until it ages out. */
 export function legacyLiveLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.log`);
@@ -62,6 +74,9 @@ const toolKind = (name) => TOOL_KINDS.get(typeof name === "string" ? name : "")
  */
 export function liveActivityKind(event) {
     try {
+        // A subagent's events, of every type, are not this run's activity (stream-scope.ts).
+        if (!topLevelEvent(event))
+            return null;
         const type = String(event["type"] ?? "");
         if ((type === "system" && String(event["subtype"] ?? "") === "init") || type === "thread.started" || type === "init")
             return "session";
@@ -76,9 +91,6 @@ export function liveActivityKind(event) {
             return toolKind(event["name"] ?? event["tool"]?.["name"]);
         if (type !== "assistant")
             return null;
-        const parent = event["parent_tool_use_id"];
-        if (parent !== undefined && parent !== null)
-            return null;
         const content = event["message"]?.["content"];
         if (!Array.isArray(content))
             return null;
@@ -140,7 +152,12 @@ export function openLiveLog(root, runId, options = {}) {
     catch {
         return null;
     }
-    const recorder = createLiveRecorder({ base: options.base ?? null, commands: options.commands === true, ...(options.clock === undefined ? {} : { clock: options.clock }) });
+    const recorderOptions = { base: options.base ?? null, commands: options.commands === true, ...(options.clock === undefined ? {} : { clock: options.clock }) };
+    // The run's subagents go to their own file (live-children.ts), under the same captured answer; this file is unchanged
+    // (the recorder only tells the subagents' side which step it wrote for each delegation).
+    const children = createChildRecorder(recorderOptions);
+    const recorder = createLiveRecorder({ ...recorderOptions, onStep: children.parentStep });
+    const childLog = childLogWriter(root, runId);
     let written = 0;
     let capped = false;
     let closed = false;
@@ -178,8 +195,13 @@ export function openLiveLog(root, runId, options = {}) {
     return {
         observe(event) {
             try {
-                for (const record of recorder.observe(event))
+                const mine = recorder.observe(event);
+                for (const record of mine)
                     append(record);
+                if (!closed) {
+                    const before = childLog.due() ? children.checkpoint() : null;
+                    childLog.append(children.observe(event), before);
+                }
             }
             catch {
                 // Recording is observational; a malformed event records nothing.
@@ -195,6 +217,12 @@ export function openLiveLog(root, runId, options = {}) {
             catch {
                 // the steps simply stay open in the file
             }
+            try {
+                const before = childLog.due() ? children.checkpoint() : null;
+                childLog.append(children.end(), before);
+            }
+            catch { /* the subagents' steps stay open in theirs */ }
+            childLog.close();
             closed = true;
             try {
                 closeSync(fd);
@@ -326,18 +354,42 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
         closeSync(fd);
     }
 }
-/** A window's complete lines as the plain words the run page and `toolroll peek` show, whatever its format. */
-export function liveWindowLines(read, keys = { inKey: false }) {
+/** A window's complete lines as the plain words the run page and `toolroll peek` show, whatever its format. `commands` is
+ * the run's own captured answer (store.ts runLiveCommands), never the file's say. */
+export function liveWindowLines(read, commands, keys = { inKey: false }) {
     if (read.format === "records")
-        return projectLiveText(parseLiveRecords(read.text, keys));
+        return projectLiveText(withholdCommands(parseLiveRecords(read.text, keys), commands));
     return cleanLegacy(read.text, keys).split("\n").filter(one => one !== "");
 }
-/** A window as records, whatever its format: an older plain file's lines become the agent's words. */
-export function liveWindowRecords(read, keys = { inKey: false }) {
+/** A window as records, whatever its format: an older plain file's lines become the agent's words. Command text and
+ * output show only when the run's own captured answer (`commands`) is on. */
+export function liveWindowRecords(read, commands, keys = { inKey: false }) {
     if (read.format === "records")
-        return parseLiveRecords(read.text, keys);
+        return withholdCommands(parseLiveRecords(read.text, keys), commands);
     return cleanLegacy(read.text, keys).split("\n").filter(one => one !== "").map(line => ({ k: "say", at: "", t: [line] }));
 }
+/**
+ * Enforce a run's captured "Show commands" answer on read: the file is build-writable, so an `open` record, a command
+ * step's text or a step's output may say anything. With the answer off, every `open` reads the base tier, command steps
+ * lose their text and steps lose their output. (The older plain-text format predates command detail and is unchanged.)
+ */
+export function withholdCommands(records, commands) {
+    if (commands)
+        return records;
+    return records.map(record => {
+        if (record.k === "open")
+            return record.detail === "base" ? record : { ...record, detail: "base" };
+        if (record.k === "step" && record.kind === "command" && record.target !== undefined) {
+            const { target: _target, ...rest } = record;
+            return rest;
+        }
+        if (record.k === "done" && record.out !== undefined) {
+            const { out: _out, ...rest } = record;
+            return rest;
+        }
+        return record;
+    });
+}
 /** Legacy text lines, cleaned again on read: the file may have been altered after it was written. */
 function cleanLegacy(text, keys) {
     const lines = text.split("\n");
@@ -348,10 +400,9 @@ function cleanLegacy(text, keys) {
     return ended ? `${shown.join("\n")}\n` : shown.join("\n");
 }
 /**
- * Enumerate the live directory for the reconcile sweep. Pure listing — the
- * CALLER decides which runs are finalized and when; this module only
- * refuses to guess. Non-run names are reported with runId null (orphans
- * from nothing this plane wrote; aged on mtime like everything else).
+ * Enumerate the live directory for the reconcile sweep: names only. Pure listing — the CALLER settles which runs are
+ * finalized before it measures anything; this module only refuses to guess. Non-run names are reported with runId
+ * null (orphans from nothing this plane wrote; aged on mtime like everything else).
  */
 export function listLiveFiles(root) {
     let names;
@@ -361,74 +412,172 @@ export function listLiveFiles(root) {
     catch {
         return [];
     }
-    const out = [];
-    for (const name of names) {
-        let mtimeMs = 0;
-        try {
-            mtimeMs = statSync(join(liveDir(root), name)).mtimeMs;
-        }
-        catch {
-            continue;
-        }
-        const match = /^(\d{1,15})\.(?:jsonl|log)$/.exec(name);
-        out.push({ runId: match === null ? null : Number(match[1]), fileName: name, mtimeMs });
-    }
-    return out;
+    // A sweep's private claim (QUARANTINE_PREFIX) is never listed: it is the sweep's own, and one it couldn't restore
+    // stays for a person to look at rather than be aged out under a name nobody chose.
+    return names.filter(name => !name.startsWith(QUARANTINE_PREFIX)).map(name => {
+        const match = /^(\d{1,15})\.(jsonl|log|sub\.jsonl)$/.exec(name);
+        // The writer stops at its cap and adds one last record; anything far past it is no file this plane wrote.
+        const cap = match === null ? null : (match[2] === "sub.jsonl" ? LIVE_SUB_FILE_CAP : LIVE_FILE_CAP) + 64 * 1024;
+        return { runId: match === null ? null : Number(match[1]), fileName: name, cap };
+    });
 }
-/** Remove one live file, silently: a sweep never throws over display state. */
-export function removeLiveFile(root, fileName) {
+/** Remove one live file, silently: a sweep never throws over display state. True when it is gone now. */
+export function removeLiveFile(root, fileName, unlink = unlinkSync) {
     // The name comes from listLiveFiles' own readdir, never from user input.
     if (fileName.includes("/") || fileName.includes("\\") || fileName.includes(".."))
-        return;
+        return false;
     try {
-        unlinkSync(join(liveDir(root), fileName));
+        unlink(join(liveDir(root), fileName));
+        return true;
     }
-    catch {
-        // already gone
+    catch (error) {
+        return error.code === "ENOENT";
     }
 }
+/** The prefix of a sweep's private claim on a file it is about to remove (never a name a writer uses). */
+const QUARANTINE_PREFIX = ".sweep-claim-";
 /**
  * The reconcile sweep (arc 1 §2): ACTIVE runs are exempt ABSOLUTELY — the
- * transport's no-truncation assumption depends on it. Finalized runs age
- * from finished_at; orphans (no run row, or a name this plane never
- * writes) age from mtime; and the 500-file bound applies only WITHIN the
- * finalized-or-orphan set, oldest first.
+ * transport's no-truncation assumption depends on it — and a run's files
+ * (its records, its subagents' file, an older text file) go together, as one.
+ * A run is settled finished (or absent) BEFORE its files are measured.
+ * Finalized runs age from finished_at; orphans (no run row, or a name this
+ * plane never writes) age from mtime. Among the finalized-or-orphan: a file
+ * far past its own cap goes at once, then the day's retention, then the
+ * 500-run bound, then the total byte limit, oldest first, until each limit is
+ * really met or nothing eligible is left. Each removal re-proves, under the
+ * store's write lock (the one run admission takes), that the run is still
+ * not active and the file is the very one measured; otherwise it is kept. A
+ * file that can't be removed stays counted and never stops the rest.
  */
-export function sweepLiveLogs(store, root, now) {
+export function sweepLiveLogs(store, root, now, io = {}) {
     const removed = [];
-    const removable = [];
-    for (const entry of listLiveFiles(root)) {
-        if (entry.runId !== null) {
-            const run = store.getRun(entry.runId);
-            if (run !== null && run.outcome === null)
-                continue; // live: untouchable
-            const finished = run?.finishedAt === null || run?.finishedAt === undefined ? null : Date.parse(run.finishedAt);
-            removable.push({
-                fileName: entry.fileName,
-                ageAnchorMs: finished === null || Number.isNaN(finished) ? entry.mtimeMs : finished,
-            });
+    const settled = (runId) => {
+        if (runId === null)
+            return null;
+        try {
+            const run = store.getRun(runId);
+            return run !== null && run.outcome === null ? "active" : run;
+        }
+        catch {
+            return "unknown";
+        }
+    };
+    const at = (name) => join(liveDir(root), name);
+    const lstat = io.lstat ?? ((path) => lstatSync(path));
+    /** A file as it is now: measured, confirmed gone (ENOENT only), or unknown (any other failure: never taken as gone). */
+    const measure = (fileName, runId, path = at(fileName)) => {
+        try {
+            const stat = lstat(path);
+            return { fileName, runId, dev: stat.dev, ino: stat.ino, size: stat.size, mtimeMs: stat.mtimeMs, bytes: stat.isFile() ? stat.size : 0 };
         }
-        else {
-            removable.push({ fileName: entry.fileName, ageAnchorMs: entry.mtimeMs });
+        catch (error) {
+            return error.code === "ENOENT" ? "gone" : "unknown";
         }
-    }
-    removable.sort((a, b) => a.ageAnchorMs - b.ageAnchorMs);
-    const cutoff = now.getTime() - LIVE_RETAIN_MS;
-    const survivors = [];
-    for (const one of removable) {
-        if (one.ageAnchorMs <= cutoff) {
-            removeLiveFile(root, one.fileName);
-            removed.push(one.fileName);
+    };
+    const same = (a, b) => a.dev === b.dev && a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs;
+    /** The run is still not active, proved under the store's write lock (the one run admission takes) — and only that. */
+    const stillSweepable = (runId) => {
+        const check = () => { const state = settled(runId); return state !== "active" && state !== "unknown"; };
+        try {
+            return store.transact === undefined ? check() : store.transact(check);
+        }
+        catch {
+            return false;
+        }
+    };
+    /** Put a claimed file back under its name without overwriting whatever may be there now. */
+    const restore = (claim, fileName) => {
+        try {
+            linkSync(at(claim), at(fileName));
+            unlinkSync(at(claim));
+        }
+        catch { /* the name is taken: the claim stays, unlisted */ }
+    };
+    /**
+     * Remove one measured file: its run still not active, then the name atomically claimed under a private name in the
+     * live directory, then the claim proved to be the very file measured (dev, inode, size, mtime) and the run still not
+     * active — and only then is the private claim deleted. A mismatch is put back without overwriting anything. The
+     * store's lock covers the run-state checks only; the filesystem work runs outside it.
+     */
+    const remove = (file) => {
+        if (file.failed === true)
+            return false;
+        const done = (gone) => { if (gone)
+            removed.push(file.fileName);
+        else
+            file.failed = true; return gone; };
+        io.beforeRemove?.(file.fileName);
+        if (file.fileName.includes("/") || file.fileName.includes("..") || !stillSweepable(file.runId))
+            return done(false);
+        io.afterCheck?.(file.fileName);
+        const claim = `${QUARANTINE_PREFIX}${randomBytes(12).toString("hex")}`;
+        try {
+            renameSync(at(file.fileName), at(claim));
+        }
+        catch (error) {
+            return done(error.code === "ENOENT");
         }
-        else {
-            survivors.push(one);
+        const claimed = measure(file.fileName, file.runId, at(claim));
+        if (claimed === "gone")
+            return done(true);
+        if (claimed === "unknown" || !same(claimed, file) || !stillSweepable(file.runId)) {
+            restore(claim, file.fileName);
+            return done(false);
         }
+        if (removeLiveFile(root, claim, io.unlink))
+            return done(true);
+        restore(claim, file.fileName);
+        return done(false);
+    };
+    // One group per finished run (keyed by id) or per orphan file, aged from the run's end or the file's mtime.
+    const groups = new Map();
+    // Settle every listed run first, then list again and measure: a file a run wrote (or grew) before it finished is
+    // seen at its final size, and one its run created after the first listing is counted with it.
+    const states = new Map();
+    for (const entry of listLiveFiles(root))
+        if (entry.runId !== null && !states.has(entry.runId))
+            states.set(entry.runId, settled(entry.runId));
+    for (const entry of listLiveFiles(root)) {
+        // A run first seen in this listing waits for the next pass: it was never settled before its files were listed.
+        if (entry.runId !== null && !states.has(entry.runId))
+            continue;
+        const state = entry.runId === null ? null : states.get(entry.runId);
+        if (state === "active" || state === "unknown")
+            continue; // live, or unknown this pass: kept, never guessed
+        // Measured only now, after the run is settled finished: its writer is done.
+        const file = measure(entry.fileName, entry.runId);
+        if (file === "gone" || file === "unknown")
+            continue;
+        if (entry.cap !== null && file.bytes > entry.cap && remove(file))
+            continue;
+        const finished = state === null || state.finishedAt === null ? null : Date.parse(state.finishedAt);
+        const anchor = finished === null || Number.isNaN(finished) ? file.mtimeMs : finished;
+        const key = entry.runId === null ? `file:${entry.fileName}` : `run:${entry.runId}`;
+        const group = groups.get(key) ?? { files: [], ageAnchorMs: anchor };
+        group.files.push(file);
+        group.ageAnchorMs = Math.min(group.ageAnchorMs, anchor);
+        groups.set(key, group);
     }
-    // Oldest-first beyond the bound — still never touching an active run.
-    for (let index = 0; index < survivors.length - LIVE_FILE_BOUND; index += 1) {
-        const one = survivors[index];
-        removeLiveFile(root, one.fileName);
-        removed.push(one.fileName);
+    /** Remove a group's files; what can't be removed stays in it (and in every count after). True when it's empty. */
+    const removeGroup = (group) => {
+        group.files = group.files.filter(file => !remove(file));
+        return group.files.length === 0;
+    };
+    const cutoff = now.getTime() - LIVE_RETAIN_MS;
+    let kept = [...groups.values()].sort((a, b) => a.ageAnchorMs - b.ageAnchorMs).filter(group => group.ageAnchorMs > cutoff || !removeGroup(group));
+    // Oldest-first beyond the bound, continuing past any that can't go — still never touching an active run.
+    let excess = kept.length - LIVE_FILE_BOUND;
+    kept = kept.filter(group => excess <= 0 || !removeGroup(group) || (excess -= 1, false));
+    // Then the total, oldest first, counting only what is really still there.
+    const bytesOf = (group) => group.files.reduce((sum, file) => sum + file.bytes, 0);
+    let total = kept.reduce((sum, group) => sum + bytesOf(group), 0);
+    for (const group of kept) {
+        if (total <= LIVE_TOTAL_BYTES)
+            break;
+        const before = bytesOf(group);
+        removeGroup(group);
+        total -= before - bytesOf(group);
     }
     return { removed };
 }

package/dist/mcp-connect.d.ts

@@ -117,6 +117,14 @@ export type ConnectVisit = {
     scope?: string | null;
     /** Where the service revokes a token, when its metadata said: a run's own token is revoked there when the run ends. */
     revoke?: string | null;
+    /** The signer's account generation when the password was typed at Connect: a rotation or revocation since ends the visit. */
+    generation?: number;
+    /** From a kit: the one grant the password at Connect proved (its subagent, this tool, this project); nothing else. */
+    grant?: {
+        subagent: number;
+        tool: string;
+        repo: string;
+    } | null;
 };
 /** A server's sign-in: the resource metadata its 401 names (or the well-known one), then its authorization server's metadata. */
 export declare function discoverSignIn(mcpUrl: string, fetcher?: Fetch): Promise<Server | null>;
@@ -154,6 +162,8 @@ export declare function finishConnect(store: Store, visit: ConnectVisit, code: s
     home?: string | undefined;
     test?: boolean;
     omitEnv?: readonly string[];
+    /** The signer's standing, checked again after the token answer and before anything changes. */
+    stillStanding?: () => boolean;
 }): Promise<{
     ok: true;
     said: string;

package/dist/mcp-connect.js

@@ -351,6 +351,8 @@ export async function finishConnect(store, visit, code, now, options = {}) {
     const tokens = tokensFrom(body, now.getTime());
     if (tokens.access === null)
         return { ok: false, said: `${service.label} didn't send a sign-in token.` };
+    if (options.stillStanding !== undefined && !options.stillStanding())
+        return { ok: false, said: "Your access changed during the sign-in, so nothing was connected. Connect again." };
     if (had === undefined) {
         const added = addToolTo(store, visit.repo, spec, `${service.label}, connected by signing in`, visit.by, now, { home });
         if (!added.ok)

package/dist/operate.js

@@ -4072,7 +4072,8 @@ async function requeueTask(positional, flags, context) {
  * `toolroll task regate <id>` — the approved check again on the last
  * attempt's exact commit (v70). A new attempt whose prepared candidate is
  * that commit: no agent, a fresh receipt and proof, the ordinary review.
- * The operator's yes seals the rerun scope; who asked is recorded.
+ * The operator's yes seals the rerun scope; who asked is recorded. A task
+ * that already names a prepared candidate keeps its approved scope as it is.
  */
 async function regateTaskCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
@@ -4087,7 +4088,7 @@ async function regateTaskCommand(positional, flags, context) {
     if (!result.ok)
         return fail(write, json, "task regate", result.reason, result.message, EXIT.refused);
     return succeed(write, json, "task regate", { id, run: result.run, head: result.head }, () => [
-        `${id} is queued again: the approved check runs on commit ${result.head.slice(0, 7)} exactly as attempt #${result.run} left it, with no agent. A fresh review follows.`,
+        `${id} is queued again: the approved check runs on commit ${result.head.slice(0, 7)}, the same files attempt #${result.run} checked, with no agent. A fresh review follows.`,
     ]);
 }
 /**

package/dist/peek-cli.d.ts

@@ -14,7 +14,7 @@
  * Read-only by construction: nothing here writes to the store or the
  * files; a peek is a look.
  */
-import type { Store } from "./store.js";
+import { type Store } from "./store.js";
 export declare const PEEK_TAIL_LINES = 400;
 export type PeekPane = {
     runId: number;
@@ -39,14 +39,21 @@ type Tail = {
     gen?: string;
     inKey?: boolean;
     keyTail?: string;
+    /** The "Show commands" answer the cached lines were made under; absent is unknown (treated as on: never trusted). */
+    commands?: boolean;
 };
 /**
  * Advance one run's tail from its offset; `replaced` resets visibly. The
  * offset always moves by the bytes read, even when nothing in them shows
  * (a finished step, a skipped line), and an offset is only ever used
- * against the file it came from.
+ * against the file it came from. `commands` is the run's own captured
+ * "Show commands" answer (store.ts runLiveCommands), read now: lines cached
+ * under any other answer (off, on, or unknown) are dropped and the file is
+ * read again from its start under this one, on every path — nothing
+ * projected with command detail outlives the answer turning off, and a
+ * recovered answer shows the detail again.
  */
-export declare function advanceTail(root: string, runId: number, tail: Tail): Tail;
+export declare function advanceTail(root: string, runId: number, previous: Tail, commands: boolean): Tail;
 /** The stage word for a pane: the machine's own phase, or what precedes it. */
 export declare function stageWord(run: {
     phase: string | null;

package/dist/peek-cli.js

@@ -17,6 +17,7 @@
 import { spawn } from "node:child_process";
 import { liveWindowLines, readLiveWindow } from "./live.js";
 import { validKeyTail } from "./live-records.js";
+import { runLiveCommands } from "./store.js";
 import { sleep } from "./sleep.js";
 export const PEEK_TAIL_LINES = 400;
 const ESC = "\u001b";
@@ -25,21 +26,29 @@ const REPLACED = { offset: 0, lines: ["[the live view was replaced — starting
  * Advance one run's tail from its offset; `replaced` resets visibly. The
  * offset always moves by the bytes read, even when nothing in them shows
  * (a finished step, a skipped line), and an offset is only ever used
- * against the file it came from.
+ * against the file it came from. `commands` is the run's own captured
+ * "Show commands" answer (store.ts runLiveCommands), read now: lines cached
+ * under any other answer (off, on, or unknown) are dropped and the file is
+ * read again from its start under this one, on every path — nothing
+ * projected with command detail outlives the answer turning off, and a
+ * recovered answer shows the detail again.
  */
-export function advanceTail(root, runId, tail) {
+export function advanceTail(root, runId, previous, commands) {
+    const tail = previous.commands !== commands && (previous.lines.length > 0 || previous.offset > 0)
+        ? { offset: 0, lines: [], state: "not-yet" }
+        : previous;
     const read = readLiveWindow(root, runId, tail.offset);
     if (!read.ok) {
         if (read.reason === "replaced")
-            return REPLACED;
-        return { ...tail, keyTail: validKeyTail(tail.keyTail ?? "") ? tail.keyTail ?? "" : "", state: read.reason === "missing" ? (tail.lines.length === 0 ? "not-yet" : tail.state) : "unreadable" };
+            return { ...REPLACED, commands };
+        return { ...tail, commands, keyTail: validKeyTail(tail.keyTail ?? "") ? tail.keyTail ?? "" : "", state: read.reason === "missing" ? (tail.lines.length === 0 ? "not-yet" : tail.state) : "unreadable" };
     }
     if (tail.gen !== undefined && tail.gen !== read.gen)
-        return { ...REPLACED, gen: read.gen };
+        return { ...REPLACED, gen: read.gen, commands };
     const keys = { inKey: tail.inKey === true, tail: validKeyTail(tail.keyTail ?? "") ? tail.keyTail ?? "" : "" };
-    const fresh = liveWindowLines(read, keys);
+    const fresh = liveWindowLines(read, commands, keys);
     const lines = [...tail.lines, ...fresh].slice(-PEEK_TAIL_LINES);
-    return { offset: read.nextOffset, lines, state: lines.length === 0 ? "not-yet" : "live", gen: read.gen, inKey: keys.inKey, keyTail: keys.tail };
+    return { offset: read.nextOffset, lines, state: lines.length === 0 ? "not-yet" : "live", gen: read.gen, inKey: keys.inKey, keyTail: keys.tail, commands };
 }
 /** The stage word for a pane: the machine's own phase, or what precedes it. */
 export function stageWord(run) {
@@ -58,7 +67,7 @@ export function snapshotLiveRuns(store, root, now, tails = new Map()) {
     const panes = [];
     for (const run of store.liveRuns(now)) {
         const previous = tails.get(run.id) ?? { offset: 0, lines: [], state: "not-yet" };
-        const tail = advanceTail(root, run.id, previous);
+        const tail = advanceTail(root, run.id, previous, runLiveCommands(store, run.id));
         tails.set(run.id, tail);
         panes.push({
             runId: run.id,

package/dist/planner.js

@@ -585,7 +585,7 @@ export async function plan(store, request) {
     }
     // The live window (peek): the same transcript file the builder keeps,
     // so `toolroll peek` and the run page can watch this session too.
-    const liveLog = withRunActivity(openLiveLog(root, request.runId, liveLogContext(store, taskRef, worktree)), store, request.runId, clock);
+    const liveLog = withRunActivity(openLiveLog(root, request.runId, liveLogContext(store, request.runId, taskRef, worktree, clock())), store, request.runId, clock);
     // The durable run row, not a caller's duplicate options, is the route
     // every correction inherits.
     const provider = logicalRun.provider;

package/dist/project-tools.js

@@ -22,6 +22,7 @@
 import { toolRefusal } from "./policy.js";
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
+import { isProtectedEnvName } from "./protected-storage.js";
 import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { realpathSync } from "node:fs";
@@ -572,7 +573,8 @@ function exchangeStdio(spec, values, timeoutMs, base, omit, request, fence) {
         let child;
         try {
             const launch = confined(spec.command, spec.args, { ...(fence ?? {}), temp: env["TMPDIR"] });
-            child = spawn(launch.file, launch.args, { env: { ...env, ...launch.env }, stdio: ["pipe", "pipe", "pipe"], detached: process.platform !== "win32" });
+            // A fenced server gets no chat or vault variable (protected-storage.ts) but the tool's own secrets, set by name.
+            child = spawn(launch.file, launch.args, { env: fence === null ? { ...env, ...launch.env } : { ...Object.fromEntries(Object.entries(env).filter(([name]) => !isProtectedEnvName(name) || Object.hasOwn(values, name))), ...launch.env }, stdio: ["pipe", "pipe", "pipe"], detached: process.platform !== "win32" });
         }
         catch (error) {
             if (error instanceof ContainmentRefusal) {

package/dist/protected-storage.d.ts

@@ -0,0 +1,67 @@
+/** One app's storage, relative to the home folder, per platform. */
+export type ProtectedApp = {
+    app: string;
+    darwin: readonly string[];
+    linux: readonly string[];
+};
+/**
+ * Every listed root. Checked against a real Mac (2026-10-25): existence only, never a file's contents. The 1Password
+ * containers and the extra Chrome, Edge and other browsers' folders below were found there and added.
+ */
+export declare const PROTECTED_STORAGE: readonly ProtectedApp[];
+/** The chat and vault variables no launch gets. */
+export declare const PROTECTED_ENV_PREFIXES: readonly string[];
+export declare function isProtectedEnvName(name: string): boolean;
+/** `env` without a chat or vault variable. */
+export declare function withoutProtectedEnv<T extends Record<string, string | undefined>>(env: T): T;
+/** How far the link walk goes in each present root. */
+export declare const PROTECTED_WALK: {
+    readonly depth: 4;
+    readonly entries: 5000;
+};
+/** The roots by name, under the (real) home folder and the overrides the plane's environment names. */
+export declare function protectedStorageNames(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform): string[];
+/**
+ * Every protected path one launch denies: each root by name and by real path, every link inside a present root that
+ * leads outward (where it leads, by real path and as spelled), and the overrides. Resolved at each launch, never kept.
+ * A link macOS makes in a sandboxed app's container to the same place under the home folder (its Desktop, Downloads,
+ * Fonts…) is the system's own mirror of the person's folders, not the app's data, and isn't followed (systemMirror).
+ *
+ * On a Mac, listing inside another app's container waits for the person to answer macOS's "access data from other apps"
+ * prompt when the process asking has no answer yet (a plane run by launchd: every launch, and the console with it, hung
+ * there in release check 3249). So the containers are walked only after a time-limited look in a child process
+ * (`containers`, containersListable) shows they can be listed without waiting. A look that fails any other way refuses
+ * the launch (it throws). When macOS is waiting on the person, the containers stay denied by name and real path, and
+ * the outward links the last complete walk found (kept in the plane's own state folder, linkCacheFile) stay denied too;
+ * with none kept, only the roots are denied, and that is said once.
+ */
+export declare function protectedStorageDenies(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform, say?: (line: string) => void, containers?: (roots: readonly string[]) => boolean, list?: (path: string) => import("node:fs").Dirent[]): string[];
+/** How long the look at other apps' containers may take before Toolroll takes it that macOS is waiting on the person. */
+export declare const CONTAINER_LOOK_MS = 3000;
+/** What a look at the containers found: listable without waiting, macOS waiting on the person (the look timed out), or
+ * the look itself failing (it couldn't start, crashed or was killed by anything but its own limit). */
+export type ContainerLook = "listable" | "waiting" | "failed";
+/**
+ * Whether this process can list inside these app containers without macOS stopping to ask the person: the walk run
+ * first in a child process that is killed at CONTAINER_LOOK_MS. Finishing in time (listed, or refused outright) means
+ * the walk can run here too; only running into that limit means macOS is waiting on the person (only the child waited).
+ * A look that fails any other way is tried once more, then throws: the launch is refused rather than fenced with less.
+ * A yes is kept (macOS keeps the person's answer); a no is looked at again after CONTAINER_RELOOK_MS.
+ */
+export declare function containersListable(roots: readonly string[], look?: (roots: readonly string[]) => ContainerLook, now?: () => number): boolean;
+/** A look's outcome from its child's result: only its own limit (ETIMEDOUT) is macOS waiting; any other error, signal
+ * or exit code is a failed look. */
+export declare function lookOutcome(result: {
+    error?: Error;
+    signal: NodeJS.Signals | null;
+    status: number | null;
+}): ContainerLook;
+/** Where the outward links the last complete container walk found are kept: the plane's own state folder (fenced from
+ * every build), one file per user. */
+export declare function linkCacheFile(home: string, env?: Readonly<Record<string, string | undefined>>): string;
+/** The kept links for this home: only a plain file of this user's (no link), at most LINK_CACHE_MAX, of exactly the
+ * kept shape; anything else is no cache at all. */
+export declare function readLinkCache(file: string, home: string): string[] | null;
+/** Keep a complete walk's links: written aside (owner-only) and renamed into place, only into a state folder that is
+ * already there. A failed write keeps whatever was kept before. */
+export declare function writeLinkCache(file: string, home: string, targets: readonly string[]): void;