diff --git a/tools/build/artifact.ts b/tools/build/artifact.ts
index 628afb76..e49c1da1 100644
--- a/tools/build/artifact.ts
+++ b/tools/build/artifact.ts
@@ -70,6 +70,7 @@ export interface RuleDecl {
     outputs : Artifact[];
     cmds : string[];                // flattened PRE-substitution templates
     display : string | null;        // nominally substituted; cosmetic
+    displayTemplate : string | null;  // pre-substitution; groups forEach rules
     nameSensitive : boolean;
 }
 
@@ -155,6 +156,7 @@ function makeDecl(inputs : Input[], deps : Input[], spec : CmdSpec, outputs : st
         outputs: [],
         cmds,
         display: null,
+        displayTemplate: spec.display ?? null,
         nameSensitive: spec.nameSensitive ?? false,
     };
     if (decl.nameSensitive) {
diff --git a/tools/deploy/package.json b/tools/deploy/package.json
index a617c672..d594f791 100644
--- a/tools/deploy/package.json
+++ b/tools/deploy/package.json
@@ -9,7 +9,7 @@
         "tar-stream": "^3.0.0"
     },
     "scripts": {
-        "test": "node --test test/script.test.ts"
+        "test": "node --test test/*.test.ts"
     },
     "type": "module"
 }
diff --git a/tools/deploy/script.ts b/tools/deploy/script.ts
index 3358afb3..860cad8b 100644
--- a/tools/deploy/script.ts
+++ b/tools/deploy/script.ts
@@ -145,6 +145,9 @@ export class ActionQueue {
                         fs.linkSync(op.src, dst);
                     } else {
                         fs.copyFileSync(op.src, dst);
+                        // The copy inherits the source mode; CAS objects are
+                        // read-only, which must not leak into deploy trees.
+                        fs.chmodSync(dst, 0o644);
                     }
                 } else if (op.type === 'Write') {
                     fs.writeFileSync(dst, op.data);
diff --git a/tools/deploy/tsconfig.json b/tools/deploy/tsconfig.json
index 84ef9ea6..7319ce4d 100644
--- a/tools/deploy/tsconfig.json
+++ b/tools/deploy/tsconfig.json
@@ -3,5 +3,6 @@
     "exclude": ["test"],
     "references": [
         {"path": "../../data/lib"},
+        {"path": "../build"},
     ]
 }