toolroll 0.9.93 → 0.9.95

package/dist/invoke.js

@@ -21,13 +21,16 @@ import { adapterFor, auditOf, claudePluginEnv, isolationUnsupported, ALL_CREDENT
 import { readProviderKey, readAuthModeStrict, PROVIDER_KEY_ENV, OWN_KEY_ENV } from "./keys.js";
 import { ACP_AGENTS, isAcpProvider, isKeyedProvider } from "./acp-agents.js";
 import { launchFromJson, verifyLaunch } from "./acp-attest.js";
-import { classifyTerminal } from "./exhaustion.js";
+import { classifyTerminal, terminalMatchesLimit } from "./exhaustion.js";
+import { captureProviderFailure } from "./provider-capture.js";
+import { chainCustodyProblem, closeWalkSignedOut, pinnedEntryOf } from "./fallback.js";
+import { codexLoginBilling, livePlanLogin, PLAN_LOGIN_PROVABLE } from "./plan-login.js";
 import { liftAuthPause } from "./provider-auth.js";
-import { attestProvider } from "./attest.js";
+import { attestProvider, reportedVersion } from "./attest.js";
 import { run as runCommand, runOwnerTag, streamsInput } from "./exec.js";
 import { spawnSync } from "node:child_process";
 import { currentContainment } from "./containment.js";
-import { recordRunBillingBasis, recordRunCostUnknown, recordRunModelReported } from "./store.js";
+import { recordCheckStamp, recordRunBillingBasis, recordRunCostUnknown, recordRunModelReported } from "./store.js";
 import { witnessedRunner } from "./process-custody.js";
 import { underStopWatch } from "./task-control.js";
 import { childDatabaseEnv, isolatedChildDatabase, removeChildDatabase as removeAgentDatabase } from "./child-database.js";
@@ -37,12 +40,15 @@ import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSy
 import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { poolRootOf } from "./worktree.js";
+import { prepareProtectedStorage, storageRefusalOf } from "./protected-storage.js";
 import { checkLaunchRoot, signInGrants, signInIsItself } from "./agent-fence.js";
 import { localModeOn } from "./local-owner.js";
+import { CHECK_STAMP_VERSION, EVERYWHERE, unfencedStamp } from "./check-stamp.js";
 import { CHECK_ACCESS_DEFAULT, checkAccessHere, localModeCap, narrowestAccess, narrowestNetwork, signInsAvailable } from "./check-access.js";
 import { readDenyPath } from "./project-sandbox.js";
 import { sandboxRuntimeWords } from "./sandbox-runtime.js";
 import { canonicalJson } from "./canonical-json.js";
+import { deliveredFile } from "./code-map-admission.js";
 import { buildCacheEnv, buildCacheFolder, grantFolder, writeAllowlist, WRITES_DEFAULT, CheckoutBindingError, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, codexFenceArgv, fenceFor, fencedGitEnv, LEGACY_SANDBOX, launchSandboxOf, linuxFenceAvailable, macosFenceAvailable, NO_GRANTS, sandboxedSpawn, serverGrantsOf, runFolders, taskBoundary } from "./agent-fence.js";
 import { proxyEnv, providerOnlyNetwork, repositoryEcosystems, resolveNetwork, startEgressProxy } from "./egress.js";
 import { claudeConfigDir, claudeDefaults, codexDefaults, codexHomeDir, isolatedCodexHome } from "./provider-home.js";
@@ -271,7 +277,12 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             diagnostic: strict.problem,
         };
     }
-    const authMode = strict.mode;
+    // A run on an approved chain spends under the auth mode that entry was pinned to, never the provider's current setting.
+    const pinned = invocation.phase === "review" ? null : pinnedEntryOf(store, runId);
+    if (pinned !== null && "problem" in pinned) {
+        return { kind: "refused", reason: "route-authority", providerVersion: attested === null ? null : attested.version, diagnostic: `the fallback agent's authority lapsed before spawn — ${pinned.problem}` };
+    }
+    const authMode = pinned === null ? strict.mode : pinned.entry.authMode;
     if (spec.provider === "claude" && invocation.phase !== "review") {
         const problem = claudeSettingsAuthProblem(options.env?.["CLAUDE_CONFIG_DIR"] ?? process.env["CLAUDE_CONFIG_DIR"] ?? join(keyHome ?? homedir(), ".claude"));
         if (problem !== null)
@@ -284,6 +295,27 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     const managedKey = authMode === "api-key" && keyed !== null && keyEnvName !== null
         ? readProviderKey(keyed, keyHome) ?? (process.env[keyEnvName] || null)
         : null;
+    // A pinned API key that isn't there never falls through to some other credential.
+    if (pinned !== null && authMode === "api-key" && managedKey === null) {
+        return { kind: "refused", reason: "auth-mode", providerVersion: attested === null ? null : attested.version, diagnostic: `this fallback agent is approved on an API key, and ${spec.provider} has none here` };
+    }
+    // What decides the child's credential, computed once: the environment it starts from and every variable it sheds. The
+    // live plan proof below reads with exactly these, and the child launches with exactly these (childOmitEnv).
+    const childAuth = childAuthEnv({ provider: spec.provider, phase: invocation.phase, authMode, keyEnvName, ownKeyEnv,
+        extraOmitEnv: adapter.extraOmitEnv, runEnv: runOptions.env, runOmitEnv: runOptions.omitEnv });
+    // A fallback agent approved on its plan runs only on a login its CLI proves, live, is that plan: read with the run's
+    // own environment, before anything is started for it (no proxy, tools or homes to leave behind). A provider with no
+    // live proof never gets here (filing refuses it); if one does, it's refused too. A key is never read as paid.
+    if (pinned !== null && pinned.index > 0 && authMode === "subscription") {
+        const live = PLAN_LOGIN_PROVABLE.has(spec.provider)
+            ? await livePlanLogin(spec.provider, attested !== null ? attested.executable : adapter.binary, childAuth.omitEnv, childAuth.env)
+            : null;
+        if (live !== "subscription") {
+            closeWalkSignedOut(store, runId, clock());
+            return { kind: "refused", reason: "auth-mode", providerVersion: attested === null ? null : attested.version,
+                diagnostic: `this fallback agent is approved on its plan, and ${spec.provider} isn't signed in to one here${live === "api-key" ? " (it's signed in another way)" : ""}` };
+        }
+    }
     // Resume XOR mint, enforced at the GATEWAY (Codex gemini verify round 2,
     // finding 3): a resume and a minted start id are mutually exclusive —
     // geminiArgv silently prefers --resume, so a minted id that rides
@@ -362,12 +394,12 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // tool servers outside its command sandbox, so its own launch folder is
     // fenced too; Claude reads its config from there, inside the sandbox.
     const ownTools = tools?.privateDir === undefined ? null : realpathSync(tools.privateDir);
-    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [], grants: NO_GRANTS, gitPaths: [], cache: undefined, problem: undefined } : runFence(store, runId, spec.provider, options.keyHome, codexHarness ? null : ownTools, launchWrites ?? WRITES_DEFAULT, launchSandbox ?? LEGACY_SANDBOX);
+    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [], grants: NO_GRANTS, gitPaths: [], cache: undefined, problem: undefined } : await runFence(store, runId, spec.provider, options.keyHome, codexHarness ? null : ownTools, launchWrites ?? WRITES_DEFAULT, launchSandbox ?? LEGACY_SANDBOX);
     if (fenceOf.problem !== undefined) {
         tools?.cleanup();
         codexHome?.cleanup();
         removeAgentDatabase(isolatedDb.dir);
-        return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null, diagnostic: fenceOf.problem };
+        return { kind: "refused", reason: "storageRefused" in fenceOf && fenceOf.storageRefused === true ? "protected-storage" : "containment", providerVersion: attested?.version ?? null, diagnostic: fenceOf.problem };
     }
     const fence = [...fenceOf.fence, ...(fenceOf.fence.length > 0 && codexHarness ? [ownTools, codexHome === null ? null : realpathSync(codexHome.dir)].filter((path) => path !== null) : [])];
     const grants = { ...fenceOf.grants };
@@ -497,20 +529,8 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         // the live control database through a generic RunOptions override.
         ...childDatabaseEnv(isolatedDb.file),
     };
-    const childOmitEnv = [
-        ...(runOptions.omitEnv ?? []),
-        ...adapter.extraOmitEnv,
-        // A Claude build loads no plugin, from settings or the environment (a review's safe mode already loads none).
-        ...(spec.provider === "claude" && invocation.phase !== "review" ? claudePluginEnv({ ...process.env, ...(runOptions.env ?? {}) }) : []),
-        // Subscription mode: shed this provider's OWN key too, so an ambient
-        // one cannot force API billing over the login the operator prefers.
-        // Api-key mode: shed every OTHER own-key alias (finding 1) — gemini
-        // reads GOOGLE_API_KEY as well as GEMINI_API_KEY, and a stray alias
-        // must not override the ONE canonical key this mode injected.
-        ...(authMode === "subscription"
-            ? ownKeyEnv
-            : ownKeyEnv.filter(name => name !== keyEnvName)),
-    ];
+    // The one omit list (childAuthEnv): the live plan proof read with this same list.
+    const childOmitEnv = childAuth.omitEnv;
     const launchOptions = {
         ...(fenced.wrap.length === 0 ? {} : { fence: fenced.wrap, fenceGrants: grants, confinement: "required" }),
         ...runOptions,
@@ -678,12 +698,23 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
                 return { kind: "refused", reason: "provider-unattested", providerVersion: acpAttestation.agent.version, diagnostic: verified.problem };
             }
         }
-        if (attested !== null)
-            store.stampProviderStart(runId, clock(), attested.version);
-        else if (acpAttestation !== null)
-            store.stampProviderStart(runId, clock(), acpAttestation.agent.version);
-        else
-            store.stampProviderStart(runId, clock());
+        // THE CHAIN'S LAST LOOK (fallback.ts): the walk's place, the approval, and for a paid entry the live grant, read in
+        // the one transaction that stamps the spend, after every await.
+        const chainRefusal = store.transact(() => {
+            const custody = invocation.phase === "review" ? null : chainCustodyProblem(store, runId);
+            if (custody !== null)
+                return custody;
+            if (attested !== null)
+                store.stampProviderStart(runId, clock(), attested.version);
+            else if (acpAttestation !== null)
+                store.stampProviderStart(runId, clock(), acpAttestation.agent.version);
+            else
+                store.stampProviderStart(runId, clock());
+            return null;
+        });
+        if (chainRefusal !== null) {
+            return { kind: "refused", reason: "route-authority", providerVersion: attested === null ? null : attested.version, diagnostic: `the fallback chain's authority lapsed before spawn — ${chainRefusal}` };
+        }
         // The brief is queued only once the checkout has passed the fence check.
         liveInput?.begin(invocation.brief);
         spawnedAt = Date.now();
@@ -788,13 +819,28 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     const quietEarlyExit = result.code !== 0 && !result.timedOut && !result.notFound &&
         Date.now() - spawnedAt <= AUTH_EARLY_EXIT_MS &&
         envelope.promptConsumed !== true && (envelope.tokensOut ?? 0) === 0;
+    // Claude has no attested range (attest.ts), so a terminal that reads as a plan limit asks the installed CLI its version.
+    const limitVersion = !terminalMatchesLimit(spec.provider, authMode, envelope.structuralTerminal) ? null
+        : attested !== null ? attested.version : await reportedVersion(adapter.binary, options.versionProbe);
     const terminalClass = classifyTerminal({
         terminal: envelope.structuralTerminal,
+        run: { provider: spec.provider, authMode, version: limitVersion },
         // stderr and plain stdout only: a JSON event line can carry the agent's
         // own command output (codex aggregated_output), never its sign-in.
         earlyExit: quietEarlyExit ? `${result.stderr.slice(-4096)}\n${plainLines(result.stdout).slice(-4096)}` : null,
     });
-    store.stampTerminalClass(runId, authMode, terminalClass);
+    // A plan limit counts only from a run whose protocol and identity hold (fallback.ts moves work on it): a terminal from a
+    // conflicting session, a minted id it didn't echo, or a failure on exit 0 is refused below and is never exhaustion.
+    const protocolClean = envelope.protocolError === null
+        && !(startSessionId !== undefined && envelope.initObserved === true && envelope.sessionId !== startSessionId)
+        && sessionIdentityProblem === null
+        && !(result.code === 0 && envelope.structuralTerminal?.failed === true);
+    store.stampTerminalClass(runId, authMode, terminalClass === "usage-exhausted" && !protocolClean ? "not-exhausted" : terminalClass);
+    // What the provider said on its way out, saved for a person (provider-capture.ts). Nothing routes on it.
+    if (terminalClass !== "auth-expired" && !result.timedOut && !result.notFound && (result.code !== 0 || envelope.structuralTerminal?.failed === true)) {
+        captureProviderFailure(store, { run: runId, provider: spec.provider, model: spec.model ?? null, authMode, exitCode: result.code, code: envelope.structuralTerminal?.code ?? null,
+            texts: [envelope.structuralTerminal?.text, envelope.finalMessage?.slice(-1_000), result.stderr.slice(-2_000), plainLines(result.stdout).slice(-1_000)] }, new Date());
+    }
     // Contradictory structural identity is a provider protocol failure, not
     // a session selection problem. Usage above remains recorded because the
     // process ran and spent, but no downstream handoff or repair may trust
@@ -936,7 +982,7 @@ function linkedFor(store, worktree) {
 /** The paths this run's agent may not reach: the state folder around the live database (but not its own worktree),
  * ~/.toolroll (or its older name), its task boundary and other launches' private folders; what the fence gives back
  * (FenceGrants); and what only Claude's file tools refuse. */
-function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEFAULT, sandbox = LEGACY_SANDBOX) {
+async function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEFAULT, sandbox = LEGACY_SANDBOX) {
     try {
         // A plane always has a database file; an in-memory store (a test) has nothing to fence.
         const databaseFile = store.databaseFile();
@@ -949,7 +995,9 @@ function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEF
             throw new CheckoutBindingError("The checkout's Git pointer was changed or its trusted binding could not be verified.");
         const poolRoots = [join(dirname(databaseFile), "worktrees"), ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
         const binding = worktree === null || row === null ? null : trustedWorktreeBinding(row.repo, worktree, poolRoots);
-        const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home, binding, policy: sandbox.policy });
+        // The storage check, awaited off this thread (protected-storage.ts): a privacy prompt holds up only its child.
+        const storage = await prepareProtectedStorage(keyHome ?? homedir());
+        const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home, binding, policy: sandbox.policy, storage });
         const folders = runFolders(ownTools);
         // A build with a checkout writes only its workspace unless its approval said anywhere (arc 2): its checkout and
         // Git data, its launch folder, its project's caches and the provider state its CLI must write.
@@ -958,8 +1006,10 @@ function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEF
         // The shared install is granted only as the plane linked it: this checkout's project and stamped setup.
         // Every plane checkout pool is denied around this one: the plane's own beside the database, and the one this
         // checkout was recorded in (a --pool elsewhere), so another project's worktree, present at launch, is out of reach. Native wrappers also cover later creations.
-        const launch = fenceFor(provider === "command" ? "command" : "build", { databaseFile, worktree, ...home, boundary, binding, runFolders: folders, poolRoots,
+        const launch = fenceFor(provider === "command" ? "command" : "build", { databaseFile, worktree, ...home, boundary, binding, runFolders: folders, poolRoots, storage,
             extra: allowed?.deny ?? [], linked: linkedFor(store, worktree), writes: allowed === null ? null : { writes: allowed.writes, readOnly: allowed.readOnly }, policy: sandbox.policy, provider,
+            // This launch's code map file: exactly that file, read-only, inside the denied state folder. Commands don't get it.
+            ...(provider === "command" ? {} : { exactFile: deliveredFile(store, runId) }),
             // The sealed read denies, and whatever the project lists now too (adding a deny only narrows).
             readDeny: [...new Set([...sandbox.readDeny, ...(row === null ? [] : store.projectSandbox(row.repo).readDeny)])].map(one => readDenyPath(one, keyHome ?? homedir())), machLookup: sandbox.machLookup });
         return {
@@ -972,6 +1022,10 @@ function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEF
         };
     }
     catch (error) {
+        // The storage check's own words: what didn't finish, and which program macOS may need to allow.
+        const refused = storageRefusalOf(error);
+        if (refused !== null)
+            return { fence: [], fileTools: [], grants: NO_GRANTS, problem: refused.message, storageRefused: true };
         return { fence: [], fileTools: [], grants: NO_GRANTS, problem: error instanceof CheckoutBindingError ? error.message : "The build fence could not be prepared." };
     }
 }
@@ -992,6 +1046,7 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
         if (!available()) {
             if (store.unfencedAgentsAllowed()) {
                 store.stampRunCheckAccess(runId, "unsandboxed");
+                stampLaunch(store, [runId], unfencedStamp());
                 return inner(file, args, options);
             }
             return { code: 1, stdout: "", stderr: "This machine can't confine the build's commands (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, socat and ripgrep (Linux), or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
@@ -1002,13 +1057,17 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
             mkdirSync(temp, { mode: 0o700 });
             // Not sandboxed (check-access.ts): the project's checks are trusted by the whole instance, as before 0.9.66. Never
             // while local mode is on (easy-start C5): then they run in the fence, sandboxed.
-            if (access === "unsandboxed" && !localModeOn(store))
+            if (access === "unsandboxed" && !localModeOn(store)) {
+                stampLaunch(store, [runId], unfencedStamp());
                 return await inner(file, args, { ...options, env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp } });
-            const fenced = runFence(store, runId, "command", undefined, own, writes, sandbox);
+            }
+            const fenced = await runFence(store, runId, "command", undefined, own, writes, sandbox);
             if (fenced.problem !== undefined)
                 return { code: 1, stdout: "", stderr: `${fenced.problem}\n`, timedOut: false, notFound: false };
-            if (fenced.fence.length === 0)
+            if (fenced.fence.length === 0) {
+                stampLaunch(store, [runId], unfencedStamp());
                 return inner(file, args, options);
+            }
             // A self-hosted check's own database (child-database.ts) is the command's to write too.
             const database = options?.env?.["TOOLROLL_DB"];
             const checkData = database === undefined || fenced.grants.writes === undefined ? null : grantFolder(dirname(database), false);
@@ -1020,12 +1079,14 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
             if (signIns !== null && "problem" in signIns)
                 return { code: 1, stdout: "", stderr: `${signIns.problem}\n`, timedOut: false, notFound: false };
             try {
+                // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
+                // Never the keychain: the sign-ins kept there come in the environment, read outside (keychainSignIns).
+                const given = signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network };
+                stampLaunch(store, [runId], fencedStamp(signIns === null ? "sandboxed" : "sign-ins", fenced.fence, given, signIns === null ? undefined : network));
                 return await inner(file, args, {
                     ...options,
                     fence: fenced.fence,
-                    // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
-                    // Never the keychain: the sign-ins kept there come in the environment, read outside (keychainSignIns).
-                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network },
+                    fenceGrants: given,
                     confinement: "required",
                     env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(fenced.cache === undefined || fenced.grants.writes === undefined ? {} : buildCacheEnv(fenced.cache)), ...(signIns?.env ?? {}) },
                     ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
@@ -1046,26 +1107,32 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
  * project's writes setting, only that checkout, its Git data, its own temp folder, the project's caches and its check
  * database writable. Where nothing can confine them, they run only when an instance operator allowed unconfined agents.
  */
-export function fencedCheckoutCommands(store, repo, checkout, inner, available = () => macosFenceAvailable() || linuxFenceAvailable(), access = CHECK_ACCESS_DEFAULT, network, sandbox = LEGACY_SANDBOX) {
+export function fencedCheckoutCommands(store, repo, checkout, inner, available = () => macosFenceAvailable() || linuxFenceAvailable(), access = CHECK_ACCESS_DEFAULT, network, sandbox = LEGACY_SANDBOX, stampRuns = []) {
     if (inner !== runCommand)
         return inner;
     return async (file, args, options) => {
         if (!available()) {
-            if (store.unfencedAgentsAllowed())
+            if (store.unfencedAgentsAllowed()) {
+                stampLaunch(store, stampRuns, unfencedStamp());
                 return inner(file, args, options);
+            }
             return { code: 1, stdout: "", stderr: "This machine can't confine the project's checks (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, socat and ripgrep (Linux), or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
         }
         const databaseFile = store.databaseFile();
-        if (databaseFile === null)
+        if (databaseFile === null) {
+            stampLaunch(store, stampRuns, unfencedStamp());
             return inner(file, args, options);
+        }
         const own = realpathSync(mkdtempSync(join(checkLaunchRoot(), "so-cmd-")));
         try {
             const temp = join(own, "tmp");
             mkdirSync(temp, { mode: 0o700 });
             // Not sandboxed (check-access.ts): the project's checks are trusted by the whole instance, as before 0.9.66. Never
             // while local mode is on (easy-start C5): then they run in the fence, sandboxed.
-            if (access === "unsandboxed" && !localModeOn(store))
+            if (access === "unsandboxed" && !localModeOn(store)) {
+                stampLaunch(store, stampRuns, unfencedStamp());
                 return await inner(file, args, { ...options, env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp } });
+            }
             let binding;
             try {
                 binding = trustedWorktreeBinding(repo, checkout);
@@ -1074,13 +1141,20 @@ export function fencedCheckoutCommands(store, repo, checkout, inner, available =
                 return { code: 1, stdout: "", stderr: "The check's checkout couldn't be bound to its project, so nothing ran.\n", timedOut: false, notFound: false };
             }
             const poolRoots = [join(dirname(databaseFile), "worktrees"), ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
-            const boundary = taskBoundary({ worktree: checkout, provider: "command", binding, policy: sandbox.policy });
+            let storage;
+            try {
+                storage = await prepareProtectedStorage(homedir());
+            }
+            catch (error) {
+                return { code: 1, stdout: "", stderr: `${storageRefusalOf(error)?.message ?? "The check's fence could not be prepared, so nothing ran."}\n`, timedOut: false, notFound: false };
+            }
+            const boundary = taskBoundary({ worktree: checkout, provider: "command", binding, policy: sandbox.policy, storage });
             const folders = runFolders(own);
             const cache = buildCacheFolder(repo);
             const allowed = store.projectWrites(repo) !== "workspace" ? null : writeAllowlist({ provider: "command", home: homedir(), worktree: checkout, binding, launchFolder: own, cache });
             const database = options?.env?.["TOOLROLL_DB"];
             const checkData = allowed === null || database === undefined ? null : grantFolder(dirname(database), false);
-            const launch = fenceFor("check", { databaseFile, worktree: checkout, boundary, binding, runFolders: folders, poolRoots, extra: allowed?.deny ?? [], linked: linkedFor(store, checkout),
+            const launch = fenceFor("check", { databaseFile, worktree: checkout, boundary, binding, runFolders: folders, poolRoots, storage, extra: allowed?.deny ?? [], linked: linkedFor(store, checkout),
                 readDeny: sandbox.readDeny.map(one => readDenyPath(one, homedir())), machLookup: sandbox.machLookup, policy: sandbox.policy,
                 writes: allowed === null ? null : { writes: { ...allowed.writes, subpaths: [...allowed.writes.subpaths, ...(checkData === null ? [] : [checkData])] }, readOnly: allowed.readOnly } });
             const grants = launch.fenceGrants;
@@ -1091,12 +1165,14 @@ export function fencedCheckoutCommands(store, repo, checkout, inner, available =
             if (signIns !== null && "problem" in signIns)
                 return { code: 1, stdout: "", stderr: `${signIns.problem}\n`, timedOut: false, notFound: false };
             try {
+                // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
+                // Never the keychain: the sign-ins kept there come in the environment, read outside (keychainSignIns).
+                const given = signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network };
+                stampLaunch(store, stampRuns, fencedStamp(signIns === null ? "sandboxed" : "sign-ins", launch.fence, given, signIns === null ? undefined : network));
                 return await inner(file, args, {
                     ...options,
                     fence: launch.fence,
-                    // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
-                    // Never the keychain: the sign-ins kept there come in the environment, read outside (keychainSignIns).
-                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network },
+                    fenceGrants: given,
                     confinement: launch.confinement,
                     env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(allowed === null ? {} : buildCacheEnv(cache)), ...(signIns?.env ?? {}) },
                     ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
@@ -1157,18 +1233,6 @@ async function runTools(store, runId, spec, keyHome, clock, readOnly, withheld,
         return noToolsArgs(spec.provider);
     }
 }
-/** How Codex says it's signed in (`codex login status`): a ChatGPT sign-in is its plan; a key or Bedrock is a key;
- * null when it says neither (not signed in, or it didn't answer). */
-async function codexLoginBilling(binary, omitEnv) {
-    try {
-        const status = await runCommand(binary, ["login", "status"], { timeoutMs: 15_000, omitEnv, processGroup: true });
-        const said = `${status.stdout}\n${status.stderr}`;
-        return /using chatgpt/i.test(said) ? "subscription" : /api key|bedrock/i.test(said) ? "api-key" : null;
-    }
-    catch {
-        return null;
-    }
-}
 /** The lines of a harness's stdout that are not JSON events. */
 function plainLines(stdout) {
     return stdout.split("\n").filter(line => !line.trimStart().startsWith("{")).join("\n");
@@ -1284,7 +1348,7 @@ export function checkoutRunner(store, repo, checkout, inner, runIds, ran, platfo
     return (file, args, options) => {
         const launch = checkoutLaunchOf(store, repo, runIds, platform);
         ran(actualCheckAccess(store, launch.access));
-        return fencedCheckoutCommands(store, repo, checkout, inner, undefined, launch.access, launch.network, checkoutSandboxOf(store, repo, runIds))(file, args, options);
+        return fencedCheckoutCommands(store, repo, checkout, inner, undefined, launch.access, launch.network, checkoutSandboxOf(store, repo, runIds), runIds)(file, args, options);
     };
 }
 /**
@@ -1308,6 +1372,22 @@ export function checkoutSandboxOf(store, repo, runIds) {
         machLookup: common(one => one.machLookup, live.machLookup),
     };
 }
+/** A fenced launch's stamp: the level it runs at and exactly what it was given (check-stamp.ts), read from the grants the
+ * launch itself takes, never from what was asked for. */
+export function fencedStamp(level, fence, grants, network) {
+    const writes = grants.writes;
+    return {
+        version: CHECK_STAMP_VERSION, level, policyDigest: fenceDigest(fence, grants),
+        writable: writes === undefined ? [EVERYWHERE] : [...new Set([...writes.subpaths, ...writes.prefixes.map(one => `${one.path}${one.suffix}`)])].sort(),
+        readable: [...new Set([...grants.readable, ...(grants.signIns?.read ?? [])])].sort(),
+        network: network === undefined ? { mode: "machine" } : { mode: network.mode, hosts: [...network.hosts].sort() },
+    };
+}
+function stampLaunch(store, runs, stamp) {
+    const now = new Date();
+    for (const runId of runs)
+        recordCheckStamp(store, runId, stamp, now);
+}
 /** The digest of a launch's whole fence (its denied paths and grants, canonical), as stamped on its run (C11). */
 export function fenceDigest(fence, grants) {
     return createHash("sha256").update(`toolroll:fence:${canonicalJson({ fence: [...fence], grants: grants })}`).digest("hex").slice(0, 32);
@@ -1331,3 +1411,22 @@ export function observeClaudeBilling(seen, event) {
         seen.answered = true;
     }
 }
+/**
+ * What decides a child's credential: the environment it starts from (the plane's, then the caller's) and every variable
+ * it sheds. Subscription: this provider's own keys too, so an ambient key can't force API billing over the login.
+ * API key: every other own-key alias, so a stray one can't override the one key injected. Foreign keys and (for a
+ * Claude build) plugin variables always. The live plan proof and the launch both use this one answer.
+ */
+export function childAuthEnv(args) {
+    const env = { ...process.env, ...(args.runEnv ?? {}) };
+    return {
+        env,
+        omitEnv: [
+            ...(args.runOmitEnv ?? []),
+            ...args.extraOmitEnv,
+            // A Claude build loads no plugin, from settings or the environment (a review's safe mode already loads none).
+            ...(args.provider === "claude" && args.phase !== "review" ? claudePluginEnv(env) : []),
+            ...(args.authMode === "subscription" ? args.ownKeyEnv : args.ownKeyEnv.filter(name => name !== args.keyEnvName)),
+        ],
+    };
+}

package/dist/job-object-helper.ps1

@@ -25,7 +25,9 @@ param(
   # a space or a percent sign the controller passed.
   [Parameter(Position = 1)] [string] $Encoded,
   [string] $JobName,
-  [string] $QueryName
+  [string] $QueryName,
+  # A whole-job memory limit in bytes (the code map's bounded reads); 0 is none.
+  [long] $MemoryLimit = 0
 )
 
 $ErrorActionPreference = "Stop"
@@ -68,6 +70,7 @@ public static class SoJob {
   public const int JobObjectBasicAccountingInformation = 1;
   public const int JobObjectExtendedLimitInformation = 9;
   public const uint JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x2000;
+  public const uint JOB_OBJECT_LIMIT_JOB_MEMORY = 0x200;
   public const uint CREATE_SUSPENDED = 0x4;
   public const uint CREATE_UNICODE_ENVIRONMENT = 0x400;
   public const int STARTF_USESTDHANDLES = 0x100;
@@ -111,7 +114,7 @@ public static class SoJob {
     catch { return "unknown"; }
     finally { CloseHandle(job); }
   }
-  public static IntPtr MakeJob(string name) {
+  public static IntPtr MakeJob(string name, long memoryLimit) {
     IntPtr job = CreateJobObjectW(IntPtr.Zero, name);
     int createdError = Marshal.GetLastWin32Error();
     if (job != IntPtr.Zero && createdError == 183) { CloseHandle(job); throw new Exception("job name already exists"); }
@@ -119,6 +122,10 @@ public static class SoJob {
     var info = new JOBOBJECT_EXTENDED_LIMIT_INFORMATION();
     // Kill on close; NO breakaway flags, so nothing inside may leave the job.
     info.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+    if (memoryLimit > 0) {
+      info.BasicLimitInformation.LimitFlags |= JOB_OBJECT_LIMIT_JOB_MEMORY;
+      info.JobMemoryLimit = new UIntPtr((ulong)memoryLimit);
+    }
     int size = Marshal.SizeOf(typeof(JOBOBJECT_EXTENDED_LIMIT_INFORMATION));
     IntPtr buffer = Marshal.AllocHGlobal(size);
     try {
@@ -177,7 +184,7 @@ try {
   [string[]]$targetArguments = ConvertFrom-Json -InputObject ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Encoded)))
   if ($targetArguments.Count -lt 1) { throw "the target argv is empty" }
   # Admission arrives only after the controller durably records this helper.
-  $job = [SoJob]::MakeJob($JobName)
+  $job = [SoJob]::MakeJob($JobName, $MemoryLimit)
   Send "ready"
   $admission = $reader.ReadLineAsync()
   if (-not $admission.Wait(15000) -or $admission.Result -cne "go") { throw "job admission refused" }

package/dist/keymap.d.ts

@@ -0,0 +1,41 @@
+/** One keymap for the console and the terminal UI (docs/plans/plain-toolroll.md P1.7). A shortcut only ever presses a
+ * control the page already rendered, the same press a person's click makes, so any password field or confirm it opens
+ * still appears; with no such control on the page the key does nothing. Shortcuts sleep in text fields, with a
+ * modifier held, and while the shortcuts list is open. Navigation keys go to a page and post nothing. */
+/** What a key does in the console. `press`: the first visible, enabled control matching these, in order. */
+export type WebShortcut = {
+    kind: "go";
+    href: string;
+} | {
+    kind: "press";
+    selectors: readonly string[];
+} | {
+    kind: "search";
+} | {
+    kind: "help";
+};
+/** What a key does in the terminal UI, or null with the reason it has none there (a named gap). */
+export type TuiShortcut = "new" | "ink" | "send-back" | "retry" | "list" | "help";
+export type Shortcut = {
+    keys: string;
+    says: string;
+    web: WebShortcut;
+    tui: TuiShortcut | {
+        none: string;
+    };
+};
+/** The page's ink act: Approve (the approve control itself, password popover and all) or Accept. */
+export declare const INK_ACT_SELECTORS: readonly ["[data-ink-approve]", '[data-ink-act="accept"]', "[data-accept-result][data-primary-action]"];
+/** Send back: the control that opens the Send back form (never its submit: the note comes first). */
+export declare const SEND_BACK_SELECTORS: readonly ['[data-act="request-changes"]', '[data-act="revise"]', 'a.result-feedback-link[href="#request-changes"]'];
+/** Retry: the result's Retry, or the failed box's own Retry form. */
+export declare const RETRY_SELECTORS: readonly ['[data-act="retry"]', 'form[data-retry] button[type="submit"]', 'form[data-rebuild] button[type="submit"]'];
+export declare const SHORTCUTS: readonly Shortcut[];
+/** The keys typed, as the help list shows them: "g h" reads "g then h". */
+export declare const keyWords: (keys: string) => string;
+/**
+ * The console's key routing, as an inline script (it runs inside chromeScript's closure, which defines `show` for the
+ * jump-to palette, `toggleHelp`, `helpOpen`, `close` and `go`). Generated from SHORTCUTS, so the table is the only
+ * place a key is defined.
+ */
+export declare function webKeymapScript(): string;

package/dist/keymap.js

@@ -0,0 +1,51 @@
+/** One keymap for the console and the terminal UI (docs/plans/plain-toolroll.md P1.7). A shortcut only ever presses a
+ * control the page already rendered, the same press a person's click makes, so any password field or confirm it opens
+ * still appears; with no such control on the page the key does nothing. Shortcuts sleep in text fields, with a
+ * modifier held, and while the shortcuts list is open. Navigation keys go to a page and post nothing. */
+/** The page's ink act: Approve (the approve control itself, password popover and all) or Accept. */
+export const INK_ACT_SELECTORS = ["[data-ink-approve]", '[data-ink-act="accept"]', "[data-accept-result][data-primary-action]"];
+/** Send back: the control that opens the Send back form (never its submit: the note comes first). */
+export const SEND_BACK_SELECTORS = ['[data-act="request-changes"]', '[data-act="revise"]', 'a.result-feedback-link[href="#request-changes"]'];
+/** Retry: the result's Retry, or the failed box's own Retry form. */
+export const RETRY_SELECTORS = ['[data-act="retry"]', 'form[data-retry] button[type="submit"]', 'form[data-rebuild] button[type="submit"]'];
+export const SHORTCUTS = [
+    { keys: "n", says: "new task", web: { kind: "go", href: "/tasks/new" }, tui: "new" },
+    { keys: "a", says: "Approve or Accept (presses the button on the page)", web: { kind: "press", selectors: INK_ACT_SELECTORS }, tui: "ink" },
+    { keys: "b", says: "Send back (opens its note)", web: { kind: "press", selectors: SEND_BACK_SELECTORS }, tui: "send-back" },
+    { keys: "r", says: "Retry (presses the button on the page)", web: { kind: "press", selectors: RETRY_SELECTORS }, tui: "retry" },
+    { keys: "/", says: "search", web: { kind: "search" }, tui: { none: "The terminal has no search; press w to open the console." } },
+    { keys: "g h", says: "go Home", web: { kind: "go", href: "/" }, tui: "list" },
+    { keys: "g t", says: "go to Tasks", web: { kind: "go", href: "/tasks" }, tui: "list" },
+    { keys: "?", says: "these shortcuts", web: { kind: "help" }, tui: "help" },
+];
+/** The keys typed, as the help list shows them: "g h" reads "g then h". */
+export const keyWords = (keys) => keys.split(" ").join(" then ");
+/**
+ * The console's key routing, as an inline script (it runs inside chromeScript's closure, which defines `show` for the
+ * jump-to palette, `toggleHelp`, `helpOpen`, `close` and `go`). Generated from SHORTCUTS, so the table is the only
+ * place a key is defined.
+ */
+export function webKeymapScript() {
+    const single = {}, after = {};
+    for (const one of SHORTCUTS) {
+        const parts = one.keys.split(" ");
+        if (parts.length === 1)
+            single[parts[0]] = one.web;
+        else if (parts[0] === "g")
+            after[parts[1]] = one.web;
+    }
+    return `var KEYS=${JSON.stringify(single)},GKEYS=${JSON.stringify(after)};` +
+        // A control a person could press right now: rendered, shown, and not disabled.
+        `function pressable(el){if(!el||el.disabled||el.getAttribute("aria-disabled")==="true")return false;` +
+        `if(el.closest("[hidden],[inert]"))return false;var r=el.getClientRects();return r.length>0;}` +
+        // Press it exactly as a click would; a submit whose form isn't complete (an empty password, a required reason)
+        // shows the browser's own prompt for it instead of posting.
+        `function press(selectors){for(var s=0;s<selectors.length;s++){var all=document.querySelectorAll(selectors[s]);` +
+        `for(var i=0;i<all.length;i++){var el=all[i];if(!pressable(el))continue;` +
+        `var form=el.form||null;var submits=el.tagName.toLowerCase()==="button"&&(el.type==="submit"||el.getAttribute("type")===null)&&form;` +
+        `if(submits&&!form.checkValidity()){form.reportValidity();return true;}` +
+        `el.click();return true;}}return false;}` +
+        `function search(){if(document.querySelector("[data-workspace-shell]")){window.dispatchEvent(new CustomEvent("so:open-search",{detail:document.activeElement}));return;}show();}` +
+        `function run(act){if(act.kind==="go"){go(act.href);return true;}if(act.kind==="press")return press(act.selectors);` +
+        `if(act.kind==="search"){search();return true;}if(act.kind==="help"){toggleHelp();return true;}return false;}`;
+}

package/dist/knowledge-cli.js

@@ -112,7 +112,7 @@ export async function runKnowledgeCommand(positional, options, context) {
         admittedToken = token;
     }
     const cacheRoot = context.evidenceRoot ? join(dirname(context.evidenceRoot), 'repository-context') : namedPath(join(homedir(), '.cache'), ['repository-context']);
-    const result = await repositoryContext({ repo: resolve(repo), query, mode: spec.action === 'impact' ? 'impact' : 'search', refresh: spec.action === 'refresh', cacheRoot, ...(typeof base === 'string' ? { baseRevision: base } : {}) });
+    const result = await repositoryContext({ repo: resolve(repo), ...(admittedToken ? { project: resolve(repo) } : {}), query, mode: spec.action === 'impact' ? 'impact' : 'search', refresh: spec.action === 'refresh', cacheRoot, ...(typeof base === 'string' ? { baseRevision: base } : {}) });
     if (admittedToken) {
         const current = authenticateCoordinator(context.store, admittedToken);
         if (!current.ok)

package/dist/knowledge-ui.d.ts

@@ -1,17 +1,18 @@
 import { type KnowledgeDraft, type KnowledgeSelection, type KnowledgeView } from './project-knowledge.js';
 import { type Html } from './html.js';
+import { type MemoryUse } from './memory-use.js';
 /** A section as a frame (after ReUI's Frame, MIT): its heading on the raised well, its body one paper panel. The
  * cards inside become hairline-divided rows of that panel, never cards in a card. */
 export declare function framedSection(heading: string, body: Html | string, extra?: string): Html;
 export declare const KNOWLEDGE_CSS = ".knowledge{max-width:780px;min-width:0;overflow-wrap:anywhere}.knowledge .card{padding:20px;min-width:0;margin:16px 0}.knowledge h2{margin:0 0 12px}.knowledge form{display:grid;gap:12px;margin:0}.knowledge label{display:grid;gap:6px}.knowledge textarea,.knowledge input,.knowledge select{box-sizing:border-box;width:100%;min-width:0;max-width:100%}.knowledge textarea{resize:vertical;min-height:110px}.knowledge button,.knowledge summary,.knowledge .button-link{min-height:44px}.knowledge button{justify-self:start;white-space:nowrap}.knowledge summary{padding:12px 0;cursor:pointer}.knowledge pre{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit}.knowledge .knowledge-actions{display:flex;gap:12px;flex-wrap:wrap}.knowledge .meta{font-size:.86rem}.knowledge .knowledge-source{display:block}.knowledge details+details{border-top:1px solid var(--so-line)}.memory-stats{display:flex;flex-wrap:wrap;gap:.4rem}.memory-stats span+span::before{content:\"\u00B7\";margin-right:.4rem}.knowledge.frame{margin:0 0 16px}.knowledge.frame>.frame-head h2,.knowledge.frame>summary.frame-head{margin:0;font-size:13px;font-weight:600;line-height:1.4}.knowledge.frame>summary.frame-head{min-height:44px;padding:4px 10px}.knowledge.frame>.frame-panel{min-width:0}.knowledge.frame>.frame-panel>:first-child{margin-top:0}.knowledge.frame>.frame-panel>:last-child{margin-bottom:0}.knowledge .frame-panel>details.card,.knowledge .frame-panel .learning .card{margin:0;padding:0;border:0;border-radius:0;background:none;box-shadow:none}.knowledge .frame-panel>details.card+details.card,.knowledge .frame-panel .learning .card+.card{border-top:1px solid var(--so-line);padding-top:4px}.knowledge.frame>summary.frame-head{justify-content:flex-start}.knowledge form.field-row{grid-template-columns:minmax(0,1fr) auto;align-items:end}.knowledge form.field-row>label,.knowledge form.field-row :is(input,select,button){margin:0}@media(max-width:600px){.knowledge .card{padding:16px}.knowledge h2{font-size:1.1rem}}";
-export declare function knowledgeHtml(view: KnowledgeView, csrf: string, canManage: boolean, draft?: KnowledgeDraft, error?: string): Html;
+export declare function knowledgeHtml(view: KnowledgeView, csrf: string, canManage: boolean, draft?: KnowledgeDraft, error?: string, use?: ReadonlyMap<string, MemoryUse>): Html;
 export declare function knowledgeContextHtml(snapshot: KnowledgeSelection | null): Html | '';
 import type { Decision, MemoryHit } from './project-memory.js';
-export declare const MEMORY_INTRO = "What the lead and crew read before they work. Every change keeps its history.";
+export declare const MEMORY_INTRO = "What the lead and crew read before they work. Every change keeps its history. Last included is counted in runs.";
 export declare function decisionsHtml(repo: string, decisions: Decision[], csrf: string, canManage: boolean, draft?: {
     claim?: string;
     why?: string;
-}, error?: string): Html;
+}, error?: string, use?: ReadonlyMap<string, MemoryUse>, afterwards?: (decision: Decision) => string | null): Html;
 export declare function memorySearchHtml(repo: string, query: string, hits: MemoryHit[] | null): Html;
 import type { MemoryProposal } from './memory-pass.js';
 export declare function proposalsHtml(repo: string, proposals: MemoryProposal[], status: {
@@ -25,4 +26,20 @@ export declare function proposalsHtml(repo: string, proposals: MemoryProposal[],
     };
     openGaps: number;
     pending: number;
-} | null, csrf: string, canManage: boolean): Html;
+} | null, csrf: string, canManage: boolean, who?: string): Html;
+import type { TidyProposal } from './memory-tidy.js';
+export declare function cleanUpHtml(repo: string, proposals: readonly TidyProposal[], manage: boolean): Html;
+/** On a saved version's page: the references that aren't in current knowledge, each back as a new version. */
+export declare function referenceRestoreHtml(repo: string, revision: number, references: readonly {
+    id: string;
+    title: string;
+}[], manage: boolean): Html | '';
+/** Retired decisions, undoable merges and disabled lessons, each with its way back. */
+export declare function restoreHtml(repo: string, retired: readonly Decision[], merges: readonly {
+    merge: number;
+    successor: number;
+    predecessors: number[];
+}[], lessons: readonly {
+    id: number;
+    observation: string;
+}[], manage: boolean): Html | '';