toolroll 0.9.72 → 0.9.74

package/dist/commit-extract.js

@@ -167,10 +167,11 @@ export function extractCommit(gitDir, sha, dest, limits = EXTRACTION_LIMITS) {
     return { ok: true, files: files.length };
 }
 /** A reader over the project's object store that hashes every object it hands back, or why it can't be one. */
-function verifiedReader(gitDir) {
+function verifiedReader(gitDir, runner = {}) {
     const refuse = (message) => ({ ok: false, message });
-    const env = { ...checkoutGitEnv(), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_ATTR_NOSYSTEM: "1" };
-    const git = (args, input) => spawnSync("git", ["--git-dir", gitDir, "--no-replace-objects", ...HARDENED_GIT_ARGS, ...args], { env, input, maxBuffer: MAX_BYTES, timeout: 300_000 });
+    const env = { ...(runner.env ?? checkoutGitEnv()), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_ATTR_NOSYSTEM: "1" };
+    // The commit-graph file is a cache a build can write: parents come from the objects themselves, never from it.
+    const git = (args, input) => spawnSync(runner.git ?? "git", ["--git-dir", gitDir, "--no-replace-objects", ...HARDENED_GIT_ARGS, "-c", "core.commitGraph=false", ...args], { cwd: "/", env, input, maxBuffer: MAX_BYTES, timeout: 300_000 });
     // History a build could have rewritten around the objects: a shallow boundary, grafts, or replacement refs. Each is
     // refused outright, so no reader here ever has to decide whether to believe one.
     if (existsSync(join(gitDir, "shallow")))
@@ -221,7 +222,7 @@ function verifiedReader(gitDir) {
         }
         return found;
     };
-    return { ok: true, value: { format, hexLength, read } };
+    return { ok: true, value: { format, hexLength, read, git } };
 }
 /** Parse a commit from its verified bytes: tree, parents, message. Null when malformed. */
 function parseCommit(id, bytes, hexLength) {
@@ -434,3 +435,80 @@ export function verifiedBlobs(gitDir, tree, paths) {
         return { ok: false, message: `A file couldn't be verified: ${blobs}.` };
     return { ok: true, value: new Map(wanted.map(one => [one.path, { id: one.id, bytes: blobs.get(one.id).bytes }])) };
 }
+/**
+ * The commits reachable from `to` and not from `from`, as Git lists them (newest first), each read from its own verified
+ * bytes: what a release card says changed (release-card.ts). Git only names them. Each is hashed here and its parents
+ * checked against Git's listing; every commit the range stops at (a parent outside it) must be reached from `from`
+ * through verified parents within `reach` commits, so history a build rewrote around the objects can't shorten the
+ * list. A shallow boundary, grafts or replacement refs refuse (verifiedReader), as does a range longer than `max`.
+ */
+export function verifiedRange(gitDir, from, to, options = {}) {
+    const { max = 1_000, reach = 5_000 } = options;
+    const reader = verifiedReader(gitDir, options);
+    if (!reader.ok)
+        return reader;
+    const { git, read, hexLength } = reader.value;
+    const id = new RegExp(`^[0-9a-f]{${hexLength}}$`);
+    if (!id.test(from) || !id.test(to))
+        return { ok: false, message: "A commit id isn't a full id." };
+    /** Git's listing: each line's commit (`-` marks a boundary) and the parents it names. */
+    const listing = (args) => {
+        const listed = git(["rev-list", "--parents", ...args]);
+        if (listed.status !== 0)
+            return null;
+        const rows = String(listed.stdout).split("\n").filter(line => line !== "").map(line => {
+            const [first = "", ...parents] = line.split(" ");
+            return { id: first.replace(/^-/, ""), boundary: first.startsWith("-"), parents };
+        });
+        return rows.every(row => id.test(row.id) && row.parents.every(one => id.test(one))) ? rows : null;
+    };
+    const range = listing(["--boundary", `${from}..${to}`, "--"]);
+    if (range === null)
+        return { ok: false, message: "The commits between the releases couldn't be listed." };
+    const inside = range.filter(row => !row.boundary), stops = new Set(range.filter(row => row.boundary).map(row => row.id));
+    if (inside.length > max)
+        return { ok: false, message: `More than ${max} commits lie between the releases.` };
+    const objects = read(inside.map(row => row.id));
+    if (typeof objects === "string")
+        return { ok: false, message: `A commit couldn't be verified: ${objects}.` };
+    const listed = new Set(inside.map(row => row.id));
+    const commits = [];
+    for (const row of inside) {
+        const object = objects.get(row.id);
+        const commit = object.type === "commit" ? parseCommit(row.id, object.bytes, hexLength) : null;
+        if (commit === null)
+            return { ok: false, message: `${row.id.slice(0, 7)} isn't a commit.` };
+        // Git's parents must be the commit's own, and each one inside the range or where it stops.
+        if (commit.parents.join(" ") !== row.parents.join(" "))
+            return { ok: false, message: `Git's history of ${row.id.slice(0, 7)} isn't its own.` };
+        if (commit.parents.some(parent => !listed.has(parent) && !stops.has(parent)))
+            return { ok: false, message: `The history of ${row.id.slice(0, 7)} is incomplete.` };
+        commits.push(commit);
+    }
+    if (inside.length > 0 && !listed.has(to))
+        return { ok: false, message: `${to.slice(0, 7)} isn't in its own range.` };
+    // Where the range stops: each must be `from` or one of its verified ancestors. An empty range says `to` is already in
+    // the last release: that too is proved, never taken from Git's listing.
+    const wanted = [...stops, ...(inside.length === 0 ? [to] : [])].filter(one => one !== from);
+    if (wanted.length === 0)
+        return { ok: true, value: commits };
+    const before = listing([`--max-count=${reach}`, from, "--"]);
+    if (before === null)
+        return { ok: false, message: "The last release's history couldn't be listed." };
+    const ancestry = read(before.map(row => row.id));
+    if (typeof ancestry === "string")
+        return { ok: false, message: `The last release's history couldn't be verified: ${ancestry}.` };
+    const reached = new Set([from]);
+    const queue = [from];
+    while (queue.length > 0) {
+        const object = ancestry.get(queue.shift());
+        const commit = object === undefined || object.type !== "commit" ? null : parseCommit("", object.bytes, hexLength);
+        for (const parent of commit?.parents ?? [])
+            if (!reached.has(parent)) {
+                reached.add(parent);
+                queue.push(parent);
+            }
+    }
+    const unreached = wanted.find(one => !reached.has(one));
+    return unreached === undefined ? { ok: true, value: commits } : { ok: false, message: `${unreached.slice(0, 7)} isn't verified as part of the last release's history.` };
+}

package/dist/contracts/console-api.d.ts

@@ -75,8 +75,8 @@ export declare const CONSOLE_FORMS: {
     readonly term: FormContract<"password" | "program" | "repo">;
     readonly skillsRevise: FormContract<"feedback" | "nonce" | "repo" | "run">;
     readonly skillsChange: FormContract<"action" | "content" | "files" | "identity" | "method" | "nonce" | "repo" | "restore" | "revision" | "sample" | "sha" | "url">;
-    readonly kit: FormContract<"repo">;
-    readonly subagents: FormContract<"choice" | "dailyTurns" | "id" | "manager" | "model" | "name" | "note" | "op" | "repo" | "schedule" | "soul" | "state" | "template" | "text" | "tool" | `field.${string}` | `over.${string}` | `undo.${string}` | `use.${string}`>;
+    readonly kit: FormContract<"password" | "repo">;
+    readonly subagents: FormContract<"choice" | "dailyTurns" | "id" | "manager" | "model" | "name" | "note" | "op" | "password" | "repo" | "schedule" | "soul" | "state" | "template" | "text" | "tool" | `field.${string}` | `over.${string}` | `undo.${string}` | `use.${string}`>;
     readonly galleryUse: FormContract<string>;
     readonly flows: FormContract<"about" | "address" | "answers" | "approve" | "body" | "budget" | "choice" | "confirm" | "days" | "decision" | "definition" | "description" | "document" | "draft" | "entry" | "file" | "include" | "key" | "label" | "language" | "name" | "note" | "owner" | "password" | "previewed" | "project" | "remove" | "repo" | "revision" | "runs" | "schedules" | "secret" | "sender" | "stage" | "team" | "template" | "timeoutMinutes" | "title" | "trigger" | "url" | "value" | "watching" | `param.${string}`>;
     readonly spendBudget: FormContract<"action" | "password" | "stop" | "target" | "usd">;
@@ -118,7 +118,7 @@ export declare const CONSOLE_FORMS: {
     readonly teams: FormContract<"app-id" | "password" | "secret" | "tenant">;
     readonly discord: FormContract<"bot-token" | "password">;
     readonly messaging: FormContract<"primary">;
-    readonly permissionDefault: FormContract<"permission-mode">;
+    readonly permissionDefault: FormContract<"password" | "permission-mode">;
     readonly qualityDefault: FormContract<"quality-mode">;
     readonly notifications: FormContract<"digest" | "mode" | "screenshots">;
     readonly notificationsMute: FormContract<"pings" | "repo">;

package/dist/contracts/console-api.js

@@ -84,9 +84,9 @@ export const CONSOLE_FORMS = {
     term: formContract("POST /term/start, /term/<terminal>/close, /term/<terminal>/remove", ["repo", "program", "password"]),
     skillsRevise: formContract("POST /settings/skills/revise", ["run", "repo", "feedback", "nonce"]),
     skillsChange: formContract("POST /settings/skills/import, /settings/skills/change", ["repo", "identity", "revision", "method", "content", "files", "url", "action", "sha", "sample", "nonce", "restore"]),
-    kit: formContract("POST /kits/<kit>/<act>", ["repo"]),
-    subagents: formContract("POST /settings/lead/subagents/new, /settings/lead/subagents/<id>/<part>, /settings/lead/subagents/questions/<id>/answer", ["choice", "text", "repo", "template", "name", "soul", "op", "id", "schedule", "tool", "state", "note", "model", "dailyTurns", "manager"], { prefixes: ["use.", "undo.", "field.", "over."] }),
-    galleryUse: formContract("POST /flows/new/<template>", ["repo", "send-result", "name", "intent", "previewed"], { dynamic: true }),
+    kit: formContract("POST /kits/<kit>/<act>", ["repo", "password"]),
+    subagents: formContract("POST /settings/lead/subagents/new, /settings/lead/subagents/<id>/<part>, /settings/lead/subagents/questions/<id>/answer", ["choice", "text", "repo", "template", "name", "soul", "op", "id", "schedule", "tool", "state", "note", "model", "dailyTurns", "manager", "password"], { prefixes: ["use.", "undo.", "field.", "over."] }),
+    galleryUse: formContract("POST /flows/new/<template>", ["repo", "send-result", "name", "intent", "previewed", "password"], { dynamic: true }),
     flows: formContract("POST /flows/new, /flows/example, /flows/import, /flows/<id>/<act>, /flows/<id>/cards/<card>/<act>, /flows/<id>/triggers/<trigger>/<act>", ["repo", "document", "url", "confirm", "previewed", "template", "name", "answers", "password", "secret", "sender", "project", "team", "trigger", "approve", "remove", "about", "body", "timeoutMinutes", "language", "file", "address", "key", "definition", "owner", "revision", "value", "title", "description", "stage", "decision", "note", "draft", "choice", "entry", "label", "watching", "days", "budget", "runs", "include", "schedules"], { prefixes: ["param."] }),
     spendBudget: formContract("POST /spend/budget", ["password", "target", "action", "usd", "stop"]),
     projectConcurrency: formContract("POST /settings/project/concurrency", ["repo", "concurrency"]),
@@ -127,7 +127,7 @@ export const CONSOLE_FORMS = {
     teams: formContract("POST /settings/teams/connect|pair|unpair|disconnect|alerts", ["password", "app-id", "tenant", "secret"]),
     discord: formContract("POST /settings/discord/connect|pair|unpair|disconnect|alerts", ["password", "bot-token"]),
     messaging: formContract("POST /settings/messaging", ["primary"]),
-    permissionDefault: formContract("POST /settings/permission-default", ["permission-mode"]),
+    permissionDefault: formContract("POST /settings/permission-default", ["permission-mode", "password"]),
     qualityDefault: formContract("POST /settings/quality-default", ["quality-mode"]),
     notifications: formContract("POST /settings/notifications", ["mode", "digest", "screenshots"]),
     notificationsMute: formContract("POST /settings/notifications/mute", ["repo", "pings"]),

package/dist/contracts/release-terms.d.ts

@@ -13,6 +13,7 @@ export declare const releasePolicySchema: z.ZodObject<{
         files: z.ZodInt;
         churn: z.ZodInt;
     }, z.core.$strict>;
+    unsandboxedCarry: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 export type ReleasePolicy = z.infer<typeof releasePolicySchema>;
 export declare const releaseTermsSchema: z.ZodObject<{
@@ -35,12 +36,17 @@ export declare const releaseTermsSchema: z.ZodObject<{
             files: z.ZodInt;
             churn: z.ZodInt;
         }, z.core.$strict>;
+        unsandboxedCarry: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>;
     grant: z.ZodObject<{
         id: z.ZodInt;
         digest: z.ZodString;
     }, z.core.$strict>;
-    access: z.ZodLiteral<"sandboxed">;
+    access: z.ZodEnum<{
+        sandboxed: "sandboxed";
+        "sign-ins": "sign-ins";
+        unsandboxed: "unsandboxed";
+    }>;
     expiresAt: z.ZodISODateTime;
 }, z.core.$strict>;
 export type ReleaseTerms = z.infer<typeof releaseTermsSchema>;

package/dist/contracts/release-terms.js

@@ -17,6 +17,9 @@ export const releasePolicySchema = versioned(1, {
     protectProject: z.boolean(),
     protectedPaths: z.array(z.string().min(1).max(400)).max(200),
     limits: z.strictObject({ lines: z.int().min(0).max(1_000_000), files: z.int().min(0).max(100_000), churn: z.int().min(0).max(1_000_000) }),
+    /** "Carry release approvals when checks aren't sandboxed" (a person's project setting, off by default). Absent (a
+     * policy sealed before it existed): off. */
+    unsandboxedCarry: z.boolean().optional(),
 });
 const sha = z.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/);
 export const releaseTermsSchema = versioned(1, {
@@ -29,8 +32,9 @@ export const releaseTermsSchema = versioned(1, {
     approvedTree: sha,
     policy: releasePolicySchema,
     grant: z.strictObject({ id: z.int(), digest: z.string().min(1).max(128) }),
-    /** The check access the release check runs with: only the fence ever carries. */
-    access: z.literal("sandboxed"),
+    /** The check access the release check runs with at approval: the fence, or (only with unsandboxedCarry sealed in the
+     * policy) a wider one. Never wider later: a check that reaches further than this stops the release. */
+    access: z.enum(["sandboxed", "sign-ins", "unsandboxed"]),
     expiresAt: z.iso.datetime(),
 });
 export function readReleaseTerms(input) {

package/dist/deploy-gate.js

@@ -18,8 +18,11 @@ export function deploymentGate(store, input) {
     if (run === null || ref === null || head === null)
         return refuse(`Run ${input.runId} is not a built candidate.`);
     // `task regate` reruns the approved check on the last built commit and records no-change: a candidate only for that commit.
-    const regated = run.outcome === "no-change" && scope?.candidate === head &&
-        store.runsFor(run.taskRef).find(one => one.id < input.runId && one.role === "builder" && one.outcome === "built")?.headRevision === head;
+    // A prepared candidate's build records a commit of its own holding exactly the candidate's tree; its rerun under the same
+    // signed scope is the same check of that commit (the digest is held to the approved one below).
+    const built = store.runsFor(run.taskRef).find(one => one.id < input.runId && one.role === "builder" && one.outcome === "built");
+    const regated = run.outcome === "no-change" && built?.headRevision === head &&
+        (scope?.candidate === head || ((scope?.candidate ?? null) !== null && built.scopeDigest === run.scopeDigest));
     if (run.role !== "builder" || !(run.outcome === "built" || regated))
         return refuse(`Run ${input.runId} is not a built candidate at ${head.slice(0, 7)}.`);
     if (scope === null || scope.approvedDigest !== scope.digest || scope.digest !== run.scopeDigest)

package/dist/desktop-update.d.ts

@@ -94,6 +94,7 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
+    version?: never;
     active: boolean;
     phase: string;
     detail: string;
@@ -107,7 +108,6 @@ export declare function desktopUpdateStatus(stateDir: string): {
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
-    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/dispose.js

@@ -23,7 +23,7 @@ import { nightlyTaskRef, releaseTaskRef } from "./store.js";
 import {} from "./proof.js";
 import { verificationEvidence, failedVerificationEvidence } from "./verification-evidence.js";
 import { classifyGateFailure, describeGateFailure, gateFailureSummary } from "./gate-failure.js";
-import { propose, approve } from "./scope.js";
+import { propose, approve, liveReleaseOf } from "./scope.js";
 import { headWithin } from "./names.js";
 /** The reasons tick classifies as the attempt itself breaking. */
 const TICK_FAILURE_REASONS = new Set([
@@ -456,6 +456,35 @@ export function regateTask(store, taskId, now, approval) {
         return { ok: false, reason: "no-attempt", message: `${taskId} has no scope` };
     const head = last.headRevision;
     const actor = approval.kind === "operator" ? approval.name : `mode ${approval.name}`;
+    // A prepared candidate (a release gate, the nightly check) already names the approved commit, and the builder loads
+    // exactly its tree on every attempt. The rerun keeps that scope and its approval as they are: nothing is proposed or
+    // sealed again, so a regate can never swap the approved commit, its release terms or the person's yes for others
+    // (2026-10-27: a regate rewrote release-0.9.73's candidate to its own build commit and the release refused it).
+    if ((scope.candidate ?? null) !== null || (scope.releaseTerms ?? null) !== null) {
+        const candidate = scope.candidate ?? null;
+        if (candidate === null || scope.approvedDigest !== scope.digest || last.scopeDigest !== scope.digest) {
+            return { ok: false, reason: "not-approved", message: `${taskId}'s approved commit or scope changed since attempt #${last.id}, or its approval no longer stands; approve its scope again instead` };
+        }
+        // A release's task runs again only while its one approval still stands for it (the dispatch would refuse it anyway).
+        const release = liveReleaseOf(store, taskId, "dispatch", now);
+        if (release.applies && !release.ok)
+            return { ok: false, reason: "not-approved", message: `${taskId} can't run again: ${release.why}` };
+        // Any other seal stands only while its authority does (an expired mode, a revoked approver): the queue would never
+        // dispatch it, so the regate says so instead of queueing a rerun that can't start.
+        if (!store.modeApprovalLive(ref.id, now))
+            return { ok: false, reason: "not-approved", message: `${taskId}'s approval no longer stands; approve its scope again instead` };
+        return store.transact(() => {
+            if (store.getTask(taskId)?.state !== "queued") {
+                const queued = store.requeueTask(taskId, actor, now);
+                if (!queued.ok) {
+                    const why = { claimed: "claimed", "accepted-result": "accepted-result", published: "published" };
+                    return { ok: false, reason: why[queued.reason] ?? "not-rejected", message: `${taskId} could not be queued again: ${queued.reason}` };
+                }
+            }
+            store.addRunNote(last.id, "Toolroll", `The check will run again on the approved commit ${candidate.slice(0, 7)}, under the same approval, as a new attempt, ${approval.kind === "operator" ? `on ${approval.name}'s say-so` : "automatically once, because the failure was outside this change"}.`, now);
+            return { ok: true, run: last.id, head: candidate };
+        });
+    }
     return store.transact(() => {
         const proposed = propose(store, {
             taskId, goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd,
@@ -520,7 +549,11 @@ export function maybeTriggerRepair(store, repo, evidenceRoot, sourceRunId, verdi
     // to a person. No repair draft, no third pass, on either road.
     {
         const rerunTask = store.refById(run.taskRef)?.externalId ?? "";
-        if (run.headRevision && store.getScope(rerunTask)?.candidate === run.headRevision && store.builderAttemptsAt(run.taskRef, run.headRevision) >= 2) {
+        // A prepared candidate's attempts each record their own commit of the candidate's tree, so a rerun under the same
+        // approved scope is the same commit's check even when its head isn't the candidate itself.
+        const rerunScope = store.getScope(rerunTask);
+        const sameCommit = rerunScope !== null && (rerunScope.candidate === run.headRevision || ((rerunScope.candidate ?? null) !== null && rerunScope.digest === run.scopeDigest));
+        if (run.headRevision && sameCommit && store.builderAttemptsAt(run.taskRef, run.headRevision) >= 2) {
             const contradicted = cause === "review";
             store.enqueueNotification({ source: { run: sourceRunId }, dedupeKey: `regate-failed:${sourceRunId}`, kind: "repair-evidence", pushClass: "attention",
                 subject: contradicted ? "The rerun on the same commit was contradicted by its review" : "The project check failed again on the same commit",

package/dist/exec.d.ts

@@ -200,7 +200,7 @@ export declare function confined(file: string, args: readonly string[], bag: {
     env: Record<string, string>;
 };
 /** A spawn's environment with what its sandbox needs added (nothing added: the caller's, as it was). */
-export declare function withSandboxEnv<T extends Record<string, string | undefined>>(env: T | undefined, added: Record<string, string>): T | Record<string, string | undefined> | undefined;
+export declare function withSandboxEnv<T extends Record<string, string | undefined>>(env: T | undefined, added: Record<string, string>, fenced?: boolean): T | Record<string, string | undefined> | undefined;
 /** Run IDs are local to a database. Connections to the same file share
  * custody; separate files and separate in-memory databases never do. */
 export declare function runOwnerTag(store: Store, runId: number): string;

package/dist/exec.js

@@ -8,6 +8,7 @@
  */
 import { ACP_LINE_CAP, createAcpConversation } from "./acp-client.js";
 import { linuxFenceAvailable, macosFenceAvailable, sandboxedSpawn } from "./agent-fence.js";
+import { withoutProtectedEnv } from "./protected-storage.js";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { readlinkSync, realpathSync } from "node:fs";
 import { observeProcessTree, stopProcessTree } from "./process-tree.js";
@@ -15,6 +16,7 @@ import { jsonlDiscriminants } from "./jsonl-discriminants.js";
 import { createContainer, currentContainment } from "./containment.js";
 import { claudeLimitsOf, noteLimits } from "./provider-limits.js";
 import { sleep as defaultSleep } from "./sleep.js";
+import { primaryResultEvent, topLevelEvent } from "./stream-scope.js";
 /** Shell convention for "could not be executed": the refusal before any target ran. */
 export const CONTAINMENT_REFUSED_CODE = 126;
 /** Live provider children, for the deterministic stop. Registered only when `processGroup` was set. */
@@ -75,7 +77,10 @@ export function confined(file, args, bag) {
     return { file, args: [...args], env: {} };
 }
 /** A spawn's environment with what its sandbox needs added (nothing added: the caller's, as it was). */
-export function withSandboxEnv(env, added) {
+export function withSandboxEnv(env, added, fenced = false) {
+    // A fenced launch never gets a chat or vault variable (protected-storage.ts), whoever made its environment.
+    if (fenced)
+        return withoutProtectedEnv({ ...(env ?? process.env), ...added });
     return Object.keys(added).length === 0 ? env : { ...(env ?? process.env), ...added };
 }
 /** A spawn callback refused custody AFTER the child existed: the caller
@@ -107,7 +112,7 @@ function spawnContained(file, args, spawnOptions, label, bag, contain = true) {
     // The agent fence wraps the target itself (sandbox-exec then execs it, same pid).
     const sandboxed = confined(file, args, { ...bag, cwd: spawnOptions.cwd, temp: spawnOptions.env?.["TMPDIR"] });
     ({ file, args } = sandboxed);
-    spawnOptions = { ...spawnOptions, env: withSandboxEnv(spawnOptions.env, sandboxed.env) };
+    spawnOptions = { ...spawnOptions, env: withSandboxEnv(spawnOptions.env, sandboxed.env, (bag.fence?.length ?? 0) > 0) };
     // The policy refusal comes first: nothing is reserved, recorded or
     // spawned for a spawn that cannot be contained as required.
     const effective = contain ? currentContainment() : null;
@@ -583,7 +588,7 @@ export function run(file, args, options = {}) {
             encoding: "utf8",
             shell: false,
             windowsHide: true,
-            ...((env => env === undefined ? {} : { env }))(withSandboxEnv(childEnv, wrapped.env)),
+            ...((env => env === undefined ? {} : { env }))(withSandboxEnv(childEnv, wrapped.env, (options.fence?.length ?? 0) > 0)),
         }, (error, stdout, stderr) => {
             if (error === null) {
                 resolve({ result: { code: 0, stdout, stderr, timedOut: false, notFound: false }, transient: false });
@@ -1756,23 +1761,17 @@ function syntheticMessageLine(content, truncated) {
  *
  *   - a bounded identity witness for `system`/`init`: the first init signal,
  *     the first usable session id, and one conflicting id
- *   - the FIRST primary `result` event, selected STRUCTURALLY (finding 10):
- *     origin absent or `origin.kind === "human"` — an allowlist, so a
- *     background task's result (or any future origin kind) can never be
- *     mistaken for the main query's accounting. Later results are dropped.
+ *   - the FIRST primary `result` event, selected STRUCTURALLY (finding 10;
+ *     stream-scope.ts `primaryResultEvent`): top-level, and origin absent or
+ *     `origin.kind === "human"` — an allowlist, so a subagent's or background
+ *     task's result (or any future origin kind) can never be mistaken for the
+ *     main query's accounting. Later results are dropped. A subagent's init
+ *     never enters the identity witness.
  *
  * The result's stdout is the retained lines joined — a synthetic, bounded
  * envelope `claudeParse` reads exactly like test fixtures. Timeout,
  * process-group, kill, and spawn semantics match `runStreamJsonl`.
  */
-function primaryResultOrigin(event) {
-    const origin = event["origin"];
-    if (origin === undefined || origin === null)
-        return true;
-    if (typeof origin === "object" && String(origin["kind"] ?? "") === "human")
-        return true;
-    return false; // task-notification, channel, peer, coordinator, unknown: never the envelope
-}
 /** The usage fields Claude reports per message (not per session): a live session's account adds them up. */
 const LIVE_SUMMED_USAGE = ["input_tokens", "output_tokens", "cache_creation_input_tokens", "cache_read_input_tokens"];
 /**
@@ -1930,7 +1929,10 @@ export function runClaudeStreamJsonl(file, args, options = {}) {
             if (event === null || typeof event !== "object")
                 return;
             const type = String(event["type"] ?? "");
-            if (type === "system" && String(event["subtype"] ?? "") === "init") {
+            // A subagent's init, words and result are not the session's (stream-scope.ts): they never witness its identity,
+            // name its session, fire its receipt or stand as its result. They still reach the observers below, which filter
+            // for themselves.
+            if (type === "system" && String(event["subtype"] ?? "") === "init" && topLevelEvent(event)) {
                 if (initLine === null)
                     initLine = line;
                 const id = transportSessionId(event["session_id"]);
@@ -1959,15 +1961,14 @@ export function runClaudeStreamJsonl(file, args, options = {}) {
                 // Top-level only (finding 11): assistant events carry no origin;
                 // parent_tool_use_id is the correlation field, and a subagent's
                 // words prove nothing about the main prompt.
-                const parent = event["parent_tool_use_id"];
-                if (parent === undefined || parent === null)
+                if (topLevelEvent(event))
                     fireReceipt();
             }
             else if (type === "rate_limit_event") {
                 // v105: the plan's usage windows, as Claude says them each turn (the Tasks page's limits).
                 noteLimits(claudeLimitsOf(event));
             }
-            else if (type === "result" && (resultLine === null || live !== null) && primaryResultOrigin(event)) {
+            else if (type === "result" && (resultLine === null || live !== null) && primaryResultEvent(event)) {
                 // A live session ends a turn with a result each time: the run's account is the last one, with every main
                 // result's usage and turns added up (account). After an oversized main result the retained result stays the
                 // fail-closed overflow, but later results still count toward its cost.

package/dist/first-run.d.ts

@@ -77,10 +77,13 @@ export declare function firstResultWords(since: string, at: string): string | nu
 export declare const JOURNEY_STEPS: readonly [readonly ["plan", "Plan"], readonly ["approve", "You approve"], readonly ["build", "Build"], readonly ["checks", "Checks"], readonly ["ready", "Ready"]];
 export type JourneyKey = (typeof JOURNEY_STEPS)[number][0];
 /** `stuck`: the step it stopped at (Failed, Stopped, or waiting on something other than the approval). */
+/** `skipped`: a stage the task went past without it happening (its checks didn't run or couldn't be read). `needsYou`:
+ * the current or stuck step waits on a person, so it is the one step drawn amber. */
 export type JourneyStep = {
     key: JourneyKey;
     label: string;
-    state: "done" | "current" | "stuck" | "todo";
+    state: "done" | "current" | "stuck" | "skipped" | "todo";
+    needsYou?: true;
 };
 /**
  * Where the first task stands on Plan → You approve → Build → Checks → Ready, from the one stage every surface reads
@@ -91,4 +94,17 @@ export declare function firstTaskJourney(read: {
     stage: "queued" | "planning" | "needs-you" | "waiting" | "building" | "checking" | "reviewing" | "finished" | "complete" | "failed" | "stopped";
     need?: string | undefined;
 }, approved: boolean, built?: boolean): JourneyStep[];
+/** What a task's checks recorded, for its road: `null` when nothing says (the step is then shown skipped, never done). */
+export type RoadChecks = "passed" | "running" | "failed" | "not-run" | "unread" | null;
+/**
+ * Any task's road (the read-only stepper on its page, after ReUI's Stepper): the first task's five steps, told only
+ * from recorded facts. You approve is done only when the plan was approved (a rewritten plan waiting on approval
+ * stands there again); a task that never needed one shows it skipped. Checks is done only when a check passed; a
+ * running, failed, missing or unread check says so, and with no checks fact it is skipped. A research report has
+ * no Checks step: a report stopped there stops at Ready. The step that waits on a person carries `needsYou`.
+ */
+export declare function taskRoad(read: Parameters<typeof firstTaskJourney>[0], approved: boolean, built: boolean, facts: {
+    report?: boolean;
+    checks?: RoadChecks;
+}): JourneyStep[];
 export {};

package/dist/first-run.js

@@ -141,3 +141,41 @@ export function firstTaskJourney(read, approved, built = false) {
     return JOURNEY_STEPS.map(([key, label], index) => ({ key, label,
         state: index < at.index ? "done" : index === at.index ? (at.stuck ? "stuck" : "current") : "todo" }));
 }
+/**
+ * Any task's road (the read-only stepper on its page, after ReUI's Stepper): the first task's five steps, told only
+ * from recorded facts. You approve is done only when the plan was approved (a rewritten plan waiting on approval
+ * stands there again); a task that never needed one shows it skipped. Checks is done only when a check passed; a
+ * running, failed, missing or unread check says so, and with no checks fact it is skipped. A research report has
+ * no Checks step: a report stopped there stops at Ready. The step that waits on a person carries `needsYou`.
+ */
+export function taskRoad(read, approved, built, facts) {
+    const replan = read.stage === "needs-you" && read.need === "replan";
+    const plainApproved = approved && !replan;
+    let steps = firstTaskJourney(replan ? { stage: "needs-you", need: "approval" } : read, plainApproved, built);
+    steps = steps.map(step => {
+        if (step.key === "approve" && step.state === "done" && !plainApproved)
+            return { ...step, state: "skipped" };
+        if (step.key !== "checks" || (step.state !== "done" && step.state !== "current"))
+            return step;
+        // At Checks now: only a recorded failure or a running check changes how it reads.
+        if (step.state === "current")
+            return facts.checks === "failed" ? { ...step, state: "stuck", label: "Checks failed" } : facts.checks === "running" ? { ...step, label: "Checks running" } : step;
+        switch (facts.checks ?? null) {
+            case "passed": return step;
+            case "running": return { ...step, state: "current", label: "Checks running" };
+            case "failed": return { ...step, state: "stuck", label: "Checks failed" };
+            case "not-run": return { ...step, state: "skipped", label: "Checks not run" };
+            case "unread": return { ...step, state: "skipped", label: "Checks unread" };
+            default: return { ...step, state: "skipped" };
+        }
+    });
+    if (facts.report === true) {
+        const checks = steps.find(step => step.key === "checks");
+        if (checks !== undefined && (checks.state === "current" || checks.state === "stuck")) {
+            steps = steps.map(step => step.key === "ready" ? { ...step, state: checks.state } : step);
+        }
+        steps = steps.filter(step => step.key !== "checks");
+    }
+    const waiting = read.stage === "needs-you";
+    return steps.map(step => waiting && (step.state === "current" || step.state === "stuck") ? { ...step, needsYou: true } : step);
+}

package/dist/flow-gallery-ui.js

@@ -5,7 +5,7 @@
  * A template's tools show their marks and whether the project has them; one it lacks offers Connect first.
  */
 import { brandMarkHtml } from "./brand-mark.js";
-import { BLANK, GALLERY, GALLERY_GROUPS, galleryDiagram, galleryToolsOf, OUTDATED_COMMANDS, SEND_RESULT, sendsAlready } from "./flow-gallery.js";
+import { BLANK, GALLERY, GALLERY_GROUPS, galleryAdmitsAnyone, galleryDiagram, galleryToolsOf, OUTDATED_COMMANDS, SEND_RESULT, sendsAlready } from "./flow-gallery.js";
 import { choiceTargets } from "./flows.js";
 import { html, joinHtml, postForm, reauth } from "./html.js";
 export const GALLERY_CSS = `.gallery{max-width:1120px;min-width:0}.gallery h2{margin:28px 0 10px;font-size:.9375rem}.gallery h2:first-of-type{margin-top:8px}` +
@@ -107,7 +107,9 @@ export function galleryUseHtml(input) {
         : html `<input type="hidden" name="repo" value="${input.repo}">`;
     const preview = input.preview === null ? "" : html `<section class="gallery-preview" aria-labelledby="gallery-will"><h2 id="gallery-will">What it will do</h2><ul>${input.preview.built.does.map(one => html `<li>${one}</li>`)}</ul><p class="gallery-never">${input.preview.built.never}</p>${needing}${input.preview.startsFrom.length === 0 ? html `<p class="meta">Cards start when you add them.</p>` : input.preview.startsFrom.map(one => html `<p class="meta">Starts from: ${one}</p>`)}<details><summary>Every step</summary><ol>${input.preview.steps.map(one => html `<li>${one.replace(/^\d+\.\s/, "")}</li>`)}</ol></details></section>`;
     const sendResult = !sendsAlready(template) && html `<label class="gallery-check"><input type="checkbox" name="${SEND_RESULT.key}" value="yes"${input.answers[SEND_RESULT.key] === "yes" && html ` checked`} data-send-result><span>${SEND_RESULT.title}<small>When a card finishes, what was done comes to you in your chat apps.</small></span></label>`;
-    const actions = html `<p class="gallery-actions">${input.preview !== null && html `<button type="submit" name="intent" value="create"${missing.length > 0 && html ` class="secondary" data-without-tools`}>Create flow</button>`}<button type="submit" name="intent" value="preview" class="secondary">${input.preview === null ? "Preview" : "Update preview"}</button></p>`;
+    // A flow that brings in items from anyone takes the password to make (chat-management.md §0a.3).
+    const step = input.preview !== null && galleryAdmitsAnyone(template) ? reauth(html `<label>Your password <span class="meta">(it brings in items from anyone)</span><input type="password" name="password" autocomplete="current-password"></label>`) : "";
+    const actions = html `${step}<p class="gallery-actions">${input.preview !== null && html `<button type="submit" name="intent" value="create"${missing.length > 0 && html ` class="secondary" data-without-tools`}>Create flow</button>`}<button type="submit" name="intent" value="preview" class="secondary">${input.preview === null ? "Preview" : "Update preview"}</button></p>`;
     const form = postForm(`/flows/new/${template.id}`, html `${project}${template.asks.map(field)}<label>Name<input name="name" value="${input.name}" maxlength="80"></label>${sendResult}${preview}${actions}`, { attrs: { "data-gallery-use": true }, hidden: { previewed: input.preview?.digest ?? "" } });
     return html `<section class="gallery-use" data-gallery-template="${template.id}">${input.problem !== null && html `<p class="problem" role="alert">${input.problem}</p>`}${input.said ? html `<p role="status">${input.said}</p>` : ""}<p>${template.promise}</p>${input.diagram !== null && stepStrip(input.diagram)}${needsList(template)}${toolsBlock}${form}<p class="meta"><a href="/flows/new">All templates</a></p></section>`;
 }

package/dist/flow-gallery.d.ts

@@ -136,9 +136,12 @@ export type GalleryUsed = {
     said: string;
 };
 /** Use a template in a project: its scripts, its flow and its triggers, together or not at all. */
+/** Whether a template's triggers bring in items from anyone: making it takes the person's password. */
+export declare function galleryAdmitsAnyone(template: GalleryTemplate): boolean;
 export declare function useGalleryTemplate(store: Store, template: GalleryTemplate, repo: string, given: GalleryAnswers, input: {
     name?: string | null;
     by: string;
     now: Date;
     dir: string | null;
+    widening?: "proved";
 }): GalleryUsed;

package/dist/flow-gallery.js

@@ -20,7 +20,7 @@ import { scanForSecrets } from "./evidence.js";
 import { flowDefinitionOf } from "./flow-engine.js";
 import { saveScript, validateScript } from "./flow-scripts.js";
 import { isToolrollRepo, planeReviewSteps } from "./flow-starters.js";
-import { addFlowTriggerTo, describeTrigger, githubRepoOf, scheduleFromWords, validateTriggerConfig } from "./flow-triggers.js";
+import { addFlowTriggerTo, describeTrigger, githubRepoOf, rawAdmitsAnyone, scheduleFromWords, validateTriggerConfig } from "./flow-triggers.js";
 import { choiceTargets, clockTime, flowFromSteps, flowTerms, FLOW_TEMPLATES, ISSUE_LABEL } from "./flows.js";
 import { connectionsOf, localConnectOf, oneClickOf } from "./mcp-connect.js";
 import { publishingOf } from "./pull-request-flow.js";
@@ -640,6 +640,10 @@ export function galleryDigest(id, repo, answers) {
     return createHash("sha256").update(JSON.stringify([id, repo, Object.entries(answers).sort(([a], [b]) => a.localeCompare(b))])).digest("hex").slice(0, 24);
 }
 /** Use a template in a project: its scripts, its flow and its triggers, together or not at all. */
+/** Whether a template's triggers bring in items from anyone: making it takes the person's password. */
+export function galleryAdmitsAnyone(template) {
+    return template.triggers.some(one => rawAdmitsAnyone(one));
+}
 export function useGalleryTemplate(store, template, repo, given, input) {
     try {
         const built = buildFromGallery(store, template, repo, given);
@@ -656,7 +660,7 @@ export function useGalleryTemplate(store, template, repo, given, input) {
             const made = store.getFlow(id);
             for (const trigger of built.triggers) {
                 // No one is shown the gallery's addresses: a webhook is made with none until its panel makes one (v126).
-                const added = addFlowTriggerTo(store, made, { ...trigger, zone: trigger["zone"] ?? flowDefinitionOf(made).start }, input.by, input.now, input.dir, { shown: false });
+                const added = addFlowTriggerTo(store, made, { ...trigger, zone: trigger["zone"] ?? flowDefinitionOf(made).start }, input.by, input.now, input.dir, { shown: false, ...(input.widening === undefined ? {} : { widening: input.widening }) });
                 if (!added.ok)
                     throw new Error(added.message);
                 if (added.reveal !== null)

package/dist/flow-triggers.d.ts

@@ -57,6 +57,11 @@ export declare const senderOf: (config: Extract<TriggerConfig, {
 /** Whether this trigger takes deliveries at a secret address rather than being checked. */
 /** Whether a raw trigger the caller is about to add would take deliveries (an address): read leniently, before validation. */
 export declare function rawTakesDeliveries(raw: unknown): boolean;
+/** Whether a trigger brings in items from anyone (chat-management.md §0a.3): GitHub issues or pull requests from anyone,
+ * or mail from any sender. A widening: it takes a person's password, on every road that adds one. */
+export declare function admitsAnyone(config: TriggerConfig): boolean;
+/** The same, read leniently from a raw trigger before validation (so the form can ask for the password first). */
+export declare function rawAdmitsAnyone(raw: unknown): boolean;
 export declare function takesDeliveries(config: TriggerConfig): boolean;
 /** A webhook's signing secret (made here, or pasted from its sender). In the keychain (or an owner-only file where there's none), never a column. */
 export declare function saveHookSecret(dir: string, trigger: number, secret: string, credential?: string): void;
@@ -104,6 +109,9 @@ export type TriggerMade = {
 export declare function addFlowTriggerTo(store: Store, flow: FlowRow, raw: unknown, actor: string, now: Date, dir: string | null, options?: {
     shown?: boolean;
     ingress?: "proved";
+    /** The person proved themselves for this act (a password, or a session under Passwordless): a trigger that admits
+     * anyone is added only then. */
+    widening?: "proved";
 }): TriggerMade;
 /** A new secret address for a webhook trigger (the old one stops working at once). */
 export declare function renewFlowHook(store: Store, trigger: FlowTriggerRow, now: Date, dir: string): TriggerMade;