@foldrun/core 0.3.0 → 0.5.0

package/src/completions.ts

@@ -68,11 +68,14 @@ const EFFORTS: Completion[] = [
 // survive vendor renames — then the exact SDK names, accepted so a Claude Code
 // subagent runs here unchanged.
 const TOOL_GROUPS: Completion[] = [
+  // `files`, `bash` and `fetch` are retired (tool-names.ts) and not offered.
+  // `web` is our gallery tool, offered here because it is the one way onto
+  // the web.
   { label: "read", hint: "Read, Glob, Grep — may look, never write" },
-  { label: "files", hint: "Read, Write, Edit, Glob, Grep" },
-  { label: "web", hint: "WebSearch (Anthropic's servers, billed per search), WebFetch" },
-  { label: "fetch", hint: "WebFetch only — local; pair with the websearch tool" },
-  { label: "bash", hint: "Bash — arbitrary commands" },
+  { label: "write", hint: "Read, Write, Edit, Glob, Grep" },
+  { label: "code", hint: "Bash — runs anything in the sandbox" },
+  { label: "web", hint: "search, fetch, browse, crawl, map, extract, answer, monitor — providers under web:" },
+  { label: "ask", hint: "ask_person — ask the person running the desk mid-step, and wait for the answer" },
 ];
 
 const SDK_TOOL_NAMES: Completion[] = [
@@ -82,8 +85,6 @@ const SDK_TOOL_NAMES: Completion[] = [
   { label: "Glob", hint: "exact SDK name" },
   { label: "Grep", hint: "exact SDK name" },
   { label: "Bash", hint: "exact SDK name" },
-  { label: "WebSearch", hint: "exact SDK name" },
-  { label: "WebFetch", hint: "exact SDK name" },
 ];
 
 const METHODS: Completion[] = ["GET", "POST", "PUT", "PATCH", "DELETE"].map((m) => ({ label: m }));
@@ -134,14 +135,17 @@ const FIELDS: Record<string, Completion[]> = {
     { label: "description", insert: "description: ", hint: "required — what it does, and when" },
     { label: "model", insert: "model: default" },
     { label: "effort", insert: "effort: high", hint: "how hard it thinks" },
-    { label: "tools", insert: "tools:\n  - files", hint: "what the runtime gives it" },
+    { label: "tools", insert: "tools:\n  - write", hint: "what the runtime gives it" },
     { label: "secrets", insert: "secrets:\n  - ", hint: "credentials it may spend" },
     { label: "skills", insert: "skills:\n  - ", hint: "allowlist; omit to inherit all" },
     { label: "scripts", insert: "scripts:\n  - name: \n    run: \n    description: " },
     { label: "runtime", insert: "runtime:\n  python: \"3\"\n  packages: []" },
     { label: "mcpServers", insert: "mcpServers:\n  " },
+    { label: "ask", insert: "ask:\n  timeout: 30m", hint: "tools: [ask] — how long ask_person waits for a person (max 24h)" },
     { label: "permissionMode", insert: "permissionMode: plan", hint: "plan = read-only" },
     { label: "disallowedTools", insert: "disallowedTools:\n  - " },
+    { label: "subagents", insert: "subagents:\n  - ", hint: "colleagues it may delegate a job to — own context, own tools, no wider than its own" },
+    { label: "limits", insert: "limits:\n  web.search: 40\n  calls: 300", hint: "per step: a call past a limit is refused, never run" },
     {
       label: "provider",
       insert: "provider:\n  name: \n  token: ${PROVIDER_TOKEN}",
@@ -201,6 +205,8 @@ const FIELDS: Record<string, Completion[]> = {
     { label: "trigger", insert: "trigger: manual" },
     { label: "schedule", insert: "schedule: \"0 6 * * MON\"" },
     { label: "timezone", insert: "timezone: Australia/Sydney" },
+    { label: "language", insert: "language: en-AU" },
+    { label: "region", insert: "region: au", hint: "currency, units, calendar, weekend and text direction follow" },
     { label: "model", insert: "model: fast", hint: "every step, unless the step says" },
     { label: "effort", insert: "effort: high", hint: "every step, unless the step says" },
   ],
@@ -544,7 +550,7 @@ export function completionsAt(
       each: [
         { label: "lines", hint: "one instance per line of the previous result" },
         { label: "items", hint: "one per element of the previous output: json array" },
-        { label: "rows of ../../storage/x.csv", hint: "one per CSV row" },
+        { label: "rows of workspace/storage/x.csv", hint: "one per CSV row" },
       ],
     };
     const items = byKey[key];
@@ -569,6 +575,9 @@ export function completionsAt(
       ],
       secrets: vocab.secrets.map((s) => ({ label: s, hint: "secret" })),
       skills: vocab.skills.map((s) => ({ label: s, hint: "skill" })),
+      // Colleagues: a consult (agents:) or a delegate (subagents:).
+      agents: vocab.agents.map((a) => ({ label: a, hint: "consult — answers, no tools" })),
+      subagents: vocab.agents.map((a) => ({ label: a, hint: "delegate — own context and tools" })),
       disallowedTools: [...TOOL_GROUPS, { label: "Bash" }, { label: "Write" }],
       when: [{ label: "schema" }, { label: "urgent" }],
       expect: ASSERTIONS.map((a) => ({ ...a, insert: `${a.label}: ` })),

package/src/confine.ts

@@ -65,7 +65,7 @@ const PATH_KEYS = [
 ];
 
 const DENIED_WITHIN = [
-  /(^|\/)secrets\.json$/,
+  /(^|\/)secrets\.json(\.[^/]+)?$/, // and its lock and temp files
   /(^|\/)runs(\/|$)/,
 ];
 
@@ -119,6 +119,9 @@ const VIRTUAL = [
 
 const WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 
+/** Workspace-level directories an agent's own folder must never grow. */
+const SHARED_DIRS = new Set(["storage", "state", "workspace"]);
+
 // Only the built-in filesystem tools get path checks. foldrun's own MCP tools
 // are already confined at their own layer — script paths by resolveRunPath,
 // APIs by their declared base URL — and their arguments are not filesystem
@@ -148,7 +151,12 @@ export const isFilesystemTool = (toolName: string) => FS_TOOLS.has(toolName);
  */
 export function suggestPath(raw: string): string {
   const posix = raw.split(path.sep).join("/");
-  const m = posix.match(/(?:^|\/)(outputs|storage|state|memory|knowledge)\/(.+)$/);
+  // By segments, not by regex: an unanchored `(.+)$` re-scans from every
+  // slash, and this runs on a path an agent chose.
+  const KNOWN = ["outputs", "storage", "state", "memory", "knowledge"];
+  const segs = posix.split("/");
+  const at = segs.findIndex((seg, i) => KNOWN.includes(seg) && segs.slice(i + 1).join("/") !== "");
+  const m = at === -1 ? null : ([null, segs[at], segs.slice(at + 1).join("/")] as const);
   if (m) {
     const [, dir, rest] = m;
     return dir === "outputs"
@@ -164,11 +172,40 @@ export function suggestPath(raw: string): string {
   return `Use a path relative to your agent directory, or workspace/<dir>/… for the workspace root (workspace/storage/, workspace/state/).`;
 }
 
+/**
+ * A path an author wrote in a flow or an agent wrote in a tool call, as an
+ * absolute path: `workspace/…` from the workspace root, anything else from
+ * the agent's own folder (so the older `../../storage/x` lands in the same
+ * place as `workspace/storage/x`). Confinement is the caller's: this only
+ * says where the path points.
+ */
+export function resolveAgentPath(workspaceRoot: string, agentDir: string, raw: string): string {
+  const p = raw.trim();
+  if (p === "workspace" || p === "workspace/") return path.resolve(workspaceRoot);
+  if (p.startsWith("workspace/")) return path.resolve(workspaceRoot, p.slice("workspace/".length));
+  return path.resolve(agentDir, p);
+}
+
+/** True when `abs` is `root` or under it. */
+export function isWithin(root: string, abs: string): boolean {
+  const rel = path.relative(path.resolve(root), path.resolve(abs));
+  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
 /** Expand a virtual prefix to a real absolute path, or null if it has none. */
 export function expandVirtual(raw: string, roots: Roots): { abs: string; readOnly: boolean } | null {
+  // The SDK resolves a relative path against the cwd BEFORE canUseTool sees
+  // it, so `workspace/storage/x.json` arrives as
+  // `<agentDir>/workspace/storage/x.json` and never matched a prefix. The
+  // write then made a literal `workspace/` folder inside the agent's own
+  // directory and reported success: gbp-desk's reply-sheet, 2026-09-24, whose
+  // approved replies never reached the poster. Read the prefix off the path
+  // relative to the agent directory as well as off the raw one.
+  const rel = path.isAbsolute(raw) ? path.relative(roots.agentDir, raw).split(path.sep).join("/") : null;
+  const candidate = rel !== null && !rel.startsWith("..") && !path.isAbsolute(rel) ? rel : raw;
   for (const v of VIRTUAL) {
-    if (raw.startsWith(v.prefix)) {
-      return { abs: path.resolve(v.root(roots), raw.slice(v.prefix.length)), readOnly: v.readOnly };
+    if (candidate.startsWith(v.prefix)) {
+      return { abs: path.resolve(v.root(roots), candidate.slice(v.prefix.length)), readOnly: v.readOnly };
     }
   }
   return null;
@@ -243,6 +280,27 @@ export function checkPaths(
       };
     }
 
+    // storage/, state/ and workspace/ belong to the workspace. The same name
+    // under an agent's own folder is always a missing prefix — `storage/x`
+    // written from agents/<name>/ — and the write used to succeed there,
+    // where no other agent looks: gbp-desk's approved replies, lawyer-desk's
+    // batch, five files in all by 2026-09-24. Refuse it with the path that
+    // was meant; the model takes the correction on its next turn.
+    if (isWrite && !virtual) {
+      const own = path.relative(real(path.resolve(roots.agentDir)), abs).split(path.sep).join("/");
+      const [top, ...rest] = own.split("/");
+      if (!own.startsWith("..") && rest.length && SHARED_DIRS.has(top)) {
+        const meant = top === "workspace" ? `workspace/${rest.join("/")}` : `workspace/${top}/${rest.join("/")}`;
+        return {
+          ok: false,
+          reason:
+            `${toolName} was denied: "${raw}" would create ${top}/ inside your own agent folder, where no ` +
+            `other agent or run looks. Did you mean ${meant}? Shared files go under workspace/ ` +
+            `(workspace/storage/, workspace/state/, workspace/memory/); your own scratch goes to outputs/.`,
+        };
+      }
+    }
+
     if (isWrite && READ_ONLY_WITHIN.some((re) => re.test(within))) {
       return {
         ok: false,
@@ -258,6 +316,31 @@ export function checkPaths(
     if (virtual) rewritten = { ...(rewritten ?? input), [key]: abs };
   }
 
+  // Glob searches from `path` (the cwd when absent) and its PATTERN never
+  // climbs: `../../storage/draft/*.md` answered "No files found" with the
+  // files there (run-munef2am-439a), and an expanded `workspace/storage/*.md`
+  // is an absolute pattern the tool does not search by either. Split such a
+  // pattern at its first wildcard: the fixed directories become `path`, the
+  // rest stays the pattern — so both spellings find what is there.
+  if (toolName === "Glob") {
+    const cur = { ...input, ...(rewritten ?? {}) };
+    const pattern = typeof cur.pattern === "string" ? cur.pattern : "";
+    const climbs = pattern.startsWith("../");
+    if (pattern && (climbs || path.isAbsolute(pattern)) && (cur.path === undefined || cur.path === "")) {
+      const absPattern = climbs ? path.resolve(roots.agentDir, pattern) : pattern;
+      const segs = absPattern.split("/");
+      const wild = segs.findIndex((seg) => /[*?[{]/.test(seg));
+      if (wild > 0 && wild < segs.length) {
+        const base = segs.slice(0, wild).join("/") || "/";
+        const inWorkspace = !path.relative(workspace, real(base)).startsWith("..");
+        const inLibrary = !path.relative(library, real(base)).startsWith("..");
+        if (inWorkspace || inLibrary) {
+          rewritten = { ...(rewritten ?? input), path: base, pattern: segs.slice(wild).join("/") };
+        }
+      }
+    }
+  }
+
   return { ok: true, updatedInput: rewritten };
 }
 
@@ -348,3 +431,140 @@ export function checkBash(command: string): ConfineVerdict {
   }
   return { ok: true };
 }
+
+// ------------------------------------------------------------ workspace link
+
+/**
+ * `workspace/…` for a shell. The file tools expand the prefix themselves
+ * (expandVirtual above), but Bash, a script an agent runs, a scripts: tool
+ * and a shell `verify:` see only the filesystem — and there `workspace/` was
+ * a folder that did not exist, so the one spelling the docs teach worked in
+ * Read and failed in `cat`. For the length of a step the agent's folder holds
+ * a `workspace` link to the workspace root (`../..`), and nothing else.
+ *
+ * Why only for a step: a permanent link inside the tree it points at is a
+ * cycle, and anything that walks the tree following links walks it forever
+ * (a `shared` link was tried that way and reverted). Every walker this
+ * platform runs over a workspace skips links (storage harvest, the source
+ * listing, tar, the container copy-back), and the link is gone before the
+ * step's files are read back.
+ *
+ * Counted, because the parallel instances of one agent (`each:`, a fan-out)
+ * share its folder in one process: the last one out removes it. A real
+ * folder already called `workspace` (a stray from before the prefix was
+ * expanded) is left alone and reported — linking over it would hide files.
+ */
+const workspaceLinks = new Map<string, number>();
+
+export function linkWorkspace(agentDir: string, workspaceRoot: string): { release: () => void; note: string | null } {
+  const link = path.join(agentDir, "workspace");
+  const target = path.relative(path.resolve(agentDir), path.resolve(workspaceRoot)) || ".";
+  const held = workspaceLinks.get(link) ?? 0;
+  let note: string | null = null;
+  let own = false;
+  if (held > 0) {
+    own = true;
+  } else {
+    try {
+      const st = fs.lstatSync(link);
+      if (st.isSymbolicLink()) {
+        // Left by a step that ended without its cleanup — adopt it when it
+        // points where ours would, replace it when it does not.
+        if (fs.readlinkSync(link) !== target) {
+          fs.unlinkSync(link);
+          fs.symlinkSync(target, link, "dir");
+        }
+        own = true;
+      } else {
+        note =
+          `agents/${path.basename(agentDir)}/workspace/ is a real folder, so a shell command's ` +
+          `workspace/… reaches it rather than the workspace root — move what it holds to the ` +
+          `workspace's own storage/ or state/ and delete it`;
+      }
+    } catch {
+      try {
+        fs.symlinkSync(target, link, "dir");
+        own = true;
+      } catch (err) {
+        note = `could not link workspace/ for the shell: ${err instanceof Error ? err.message : String(err)}`;
+      }
+    }
+  }
+  if (own) workspaceLinks.set(link, held + 1);
+  let released = false;
+  return {
+    note,
+    release: () => {
+      if (!own || released) return;
+      released = true;
+      const left = (workspaceLinks.get(link) ?? 1) - 1;
+      if (left > 0) {
+        workspaceLinks.set(link, left);
+        return;
+      }
+      workspaceLinks.delete(link);
+      try {
+        if (fs.lstatSync(link).isSymbolicLink()) fs.unlinkSync(link);
+      } catch {
+        // already gone
+      }
+    },
+  };
+}
+
+/**
+ * A Node program started THROUGH the link is still its own main module.
+ *
+ * `node workspace/tools/x/run.mjs` loads the file by its real path —
+ * import.meta.url says `<ws>/tools/x/run.mjs` — while process.argv[1] keeps
+ * the path as typed, `<ws>/agents/a/workspace/tools/x/run.mjs`. The usual
+ * entry-point check, `import.meta.url === pathToFileURL(process.argv[1]).href`,
+ * was then false: the program did nothing, exited 0, and a `verify:` that
+ * ran it passed on every input.
+ *
+ * The fix rides NODE_OPTIONS into every child a step starts (the model's
+ * Bash, a shell `verify:`, a scripts: tool, the Test button): a preload that
+ * rewrites argv[1] to its real path, and only when it goes through this
+ * link. `--preserve-symlinks-main` was the obvious flag and the wrong one:
+ * it applies to EVERY linked entry point, and a `node_modules/.bin` shim
+ * then resolves `require("../lib/x.js")` beside the shim and fails.
+ *
+ * A data: URL rather than a file, so nothing has to be shipped to wherever
+ * the step runs (host, run container, pod, a runtime: venv). Node ≥ 20.6
+ * reads `--import` from NODE_OPTIONS; the runner image is Node 22. Python
+ * needs nothing: `python3 workspace/x.py` is `__main__` however it is
+ * reached.
+ */
+const MAIN_PRELOAD = [
+  `import{realpathSync}from"node:fs";`,
+  `import{resolve,sep,delimiter}from"node:path";`,
+  `const l=process.env.FOLDRUN_WORKSPACE_LINK,a=process.argv[1];`,
+  `if(l&&a){const f=resolve(a);`,
+  `if(l.split(delimiter).some(k=>k&&f.startsWith(k+sep))){`,
+  `try{process.argv[1]=realpathSync(f)}catch{}}}`,
+].join("");
+const MAIN_IMPORT = `--import=data:text/javascript,${encodeURIComponent(MAIN_PRELOAD)}`;
+
+/**
+ * `env` plus what makes `node workspace/…` its own main module (above):
+ * the link's path(s) in FOLDRUN_WORKSPACE_LINK, the preload appended to
+ * NODE_OPTIONS — after what it held, or the host's when it held nothing.
+ * Idempotent, and harmless where no link exists: the preload matches only
+ * a path under it.
+ */
+export function workspaceLinkEnv<T extends Record<string, string | undefined>>(env: T, agentDir: string): T {
+  const link = path.join(path.resolve(agentDir), "workspace");
+  let real = link;
+  try {
+    real = path.join(fs.realpathSync(agentDir), "workspace");
+  } catch {
+    // not there yet — the lexical path is the one a shell would type
+  }
+  const held = env.NODE_OPTIONS ?? process.env.NODE_OPTIONS ?? "";
+  const options = held.includes(MAIN_IMPORT) ? held : [held.trim(), MAIN_IMPORT].filter(Boolean).join(" ");
+  return {
+    ...env,
+    FOLDRUN_WORKSPACE_LINK: [...new Set([link, real])].join(path.delimiter),
+    NODE_OPTIONS: options,
+  };
+}

package/src/deploy.ts

@@ -23,16 +23,28 @@ import os from "node:os";
 import path from "node:path";
 import {
   saveWorkspace,
+  keptOnDeploy,
   workspaceDir,
   listRuns,
   parseFlow,
+  parseToolDef,
   WORKSPACE_DIRS,
   assertSafeName,
   type DeployFile,
   notifyWorkspaceChanged,
 } from "./store.ts";
+import { lintFlow } from "./flow-lint.ts";
+import { refNames } from "./refs.ts";
+import matter from "gray-matter";
 import { conformanceIssues } from "./okf.ts";
+import { timezoneProblem } from "./clock.ts";
+import { webProblems, webWarnings, runnerEngines } from "./providers.ts";
+import { readLimits } from "./limits.ts";
+import { actionProblems } from "./web-actions.ts";
+import { languageProblem } from "./language.ts";
+import { localeProblems } from "./locale.ts";
 import { repoDir } from "./gitrepo.ts";
+import { entriesNoFollow } from "./paths.ts";
 
 /** Directories a deploy never reads out of a source tree. */
 const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results"]);
@@ -42,6 +54,23 @@ const NOT_SOURCE_FILE = new Set([".DS_Store", "secrets.json"]);
 
 const IN_WORKSPACE_DIR = new RegExp(`^(${WORKSPACE_DIRS.join("|")})/`);
 
+/**
+ * Is this path, relative to a workspace root, one `readTree` would carry?
+ *
+ * The same question the walk above asks, asked of a path that is not on this
+ * machine — what the platform lists for a workspace, so `foldrun status` and
+ * `foldrun pull` compare like with like. Without it the comparison counted
+ * every run artefact and bookkeeping file the platform keeps as a local
+ * deletion, and every status was a wall of red.
+ */
+export function isSourcePath(rel: string): boolean {
+  const norm = rel.replaceAll("\\", "/");
+  const parts = norm.split("/");
+  if (parts.some((p) => NOT_SOURCE.has(p))) return false;
+  if (NOT_SOURCE_FILE.has(parts[parts.length - 1])) return false;
+  return norm === "AGENTS.md" || norm === "project.md" || IN_WORKSPACE_DIR.test(norm);
+}
+
 export interface DeployIssue {
   where: string;
   message: string;
@@ -55,12 +84,19 @@ export interface DeployPlan {
   updated: string[];
   /** Empty when the deploy is safe to apply. */
   issues: DeployIssue[];
+  /** Advisory, non-blocking: a deploy proceeds with these. Today this is
+   *  the outward-without-a-gate lint — the same one `foldrun check` fails
+   *  on, surfaced here so a push over the API is not the last to hear it. */
+  warnings: DeployIssue[];
   /** Set when a run is in flight, which blocks the swap. */
   blockedBy: string[];
 }
 
 export interface DeployResult extends DeployPlan {
   applied: boolean;
+  /** Set when `expectRemoved` was given and the deploy would have removed
+   *  paths outside it: those paths. The deploy was refused, nothing changed. */
+  unexpectedRemovals?: string[];
   /** The commit this workspace is now running, when the caller knows it. */
   commit: string | null;
   preserved: number;
@@ -166,6 +202,55 @@ export function readTree(dir: string): DeployFile[] {
  * not on disk yet. A deploy that would leave the workspace failing its own
  * checker should not be a deploy.
  */
+/** Best-effort warnings for a deploy: an agent's `web:` warnings (see
+ *  webWarnings), and the outward gate — a step whose agent grants
+ *  a workspace tool marked `outward: true` and has no `verify:`/gate. Reads
+ *  only the deployed files, so a library or gallery outward tool is not seen
+ *  here — `foldrun check`, which resolves every scope, remains the real gate.
+ *  Non-blocking by decision: the deploy proceeds and says so. */
+export function deployWarnings(files: DeployFile[]): DeployIssue[] {
+  const front = (content: string): Record<string, unknown> => {
+    try { return matter(content).data as Record<string, unknown>; } catch { return {}; }
+  };
+  // Workspace tools that change something outside the workspace.
+  const outwardTools = new Set<string>();
+  for (const f of files) {
+    const m = f.path.match(/^tools\/([^/]+?)(?:\/tool)?\.md$/);
+    if (!m) continue;
+    const data = front(f.content);
+    const def = parseToolDef(data, m[1], f.content);
+    // `outward: true` is read off the frontmatter, the same test the runtime
+    // and the CLI use; parseToolDef does not fold it onto the def.
+    if (def && data.outward === true) outwardTools.add(def.name ?? m[1]);
+  }
+  // Agents that grant one of them.
+  const outwardAgents: string[] = [];
+  const agentNames: string[] = [];
+  const out: DeployIssue[] = [];
+  // The web: warnings check prints — the old session: key, and a pinned
+  // user agent behind the runner image's Chrome, which the platform knows
+  // from FOLDRUN_RUNNER_ENGINES (the deploy read it from the image).
+  const { chrome, chromium } = runnerEngines() ?? {};
+  for (const f of files) {
+    const m = f.path.match(/^agents\/([^/]+)\/agent\.md$/);
+    if (!m) continue;
+    agentNames.push(m[1]);
+    const data = front(f.content);
+    if (refNames(data.tools).some((t: string) => outwardTools.has(t))) outwardAgents.push(m[1]);
+    for (const w of webWarnings(data, { chrome, chromium })) out.push({ where: f.path, message: w });
+  }
+  if (!outwardAgents.length) return out;
+  for (const f of files) {
+    if (!/^flows\/[^/]+\.md$/.test(f.path)) continue;
+    let flow;
+    try { flow = parseFlow(path.basename(f.path), f.content); } catch { continue; }
+    for (const w of lintFlow(flow, { agents: agentNames, outwardAgents })) {
+      if (w.kind === "outward") out.push({ where: `${f.path}${w.line ? `:${w.line}` : ""}`, message: w.message });
+    }
+  }
+  return out;
+}
+
 export function deployIssues(files: DeployFile[]): DeployIssue[] {
   const issues: DeployIssue[] = [];
   const at = (where: string, message: string) => issues.push({ where, message });
@@ -193,6 +278,34 @@ export function deployIssues(files: DeployFile[]): DeployIssue[] {
     const m = f.path.match(/^agents\/([^/]+)\/agent\.md$/);
     if (m) agents.add(m[1]);
   }
+
+  // `timezone:` is read at four levels and a value nothing can parse falls
+  // silently through to the level above — so it is refused where it was
+  // written, not discovered as a date that is a day out.
+  for (const f of files) {
+    if (!/^(AGENTS\.md|agents\/[^/]+\/agent\.md)$/.test(f.path)) continue;
+    let front: Record<string, unknown> = {};
+    try {
+      front = matter(f.content).data as Record<string, unknown>;
+    } catch {
+      continue; // unparseable frontmatter is its own report
+    }
+    const problem = timezoneProblem(front.timezone);
+    if (problem) at(f.path, problem);
+    // `schedule:` on an agent or AGENTS.md runs nothing — only a flow has a
+    // clock. Refuse it where it was written rather than deploy it dead.
+    if (front.schedule !== undefined) {
+      at(f.path, "schedule: an agent has no schedule of its own — only a flow runs on a clock. Put schedule: on the flow that runs this agent, or remove it.");
+    }
+    // The same refusal check gives: a web key that cannot work never ships.
+    for (const w of [...webProblems(front), ...actionProblems(front)]) at(f.path, w);
+    // `limits:` that cannot be read — a count of 0, a word, web.<not an
+    // action> — would run uncapped where the author meant a cap.
+    for (const w of readLimits(front.limits).problems) at(f.path, w);
+    const lang = languageProblem(front.language);
+    if (lang) at(f.path, lang);
+    for (const w of localeProblems(front)) at(f.path, w);
+  }
   if (agents.size === 0) {
     at("agents/", "no agents — a workspace needs at least one agents/<name>/agent.md");
   }
@@ -218,6 +331,7 @@ export function deployIssues(files: DeployFile[]): DeployIssue[] {
       continue;
     }
     if (parsed.steps.length === 0) at(f.path, "no steps");
+    for (const fp of parsed.frontProblems) at(f.path, fp);
     for (const s of parsed.steps) {
       const target = s.subflow ?? s.agent;
       const known = s.subflow ? flowNames.has(target) : agents.has(target);
@@ -284,7 +398,7 @@ export function planDeploy(tenant: string, workspace: string, files: DeployFile[
 
   const present = new Set<string>();
   if (fs.existsSync(dir)) {
-    for (const entry of fs.readdirSync(dir, { recursive: true })) {
+    for (const entry of entriesNoFollow(dir)) {
       const rel = String(entry).split(path.sep).join("/");
       if (NOT_SOURCE.has(rel.split("/")[0])) continue;
       if (/(^|\/)(runs|outputs|\.results)\//.test(rel)) continue;
@@ -312,11 +426,11 @@ export function planDeploy(tenant: string, workspace: string, files: DeployFile[
     }
   }
 
-  // What saveWorkspace will keep regardless — reporting these as removals
-  // would be a lie, and the alarming kind.
-  const kept = (rel: string) =>
-    /(^|\/)state\//.test(rel) || /(^|\/)memory\/[^/]+\.md$/.test(rel);
-  const removed = [...present].filter((rel) => !shipped.has(rel) && !kept(rel));
+  // What saveWorkspace will keep regardless — storage/, state/, agent
+  // memory, the platform's own files. Reporting these as removals would be
+  // a lie, and the alarming kind; one predicate serves both.
+  const shippedPaths = new Set(shipped.keys());
+  const removed = [...present].filter((rel) => !shipped.has(rel) && !keptOnDeploy(rel, shippedPaths));
 
   return {
     files,
@@ -324,6 +438,7 @@ export function planDeploy(tenant: string, workspace: string, files: DeployFile[
     updated: updated.sort(),
     removed: removed.sort(),
     issues: deployIssues(files),
+    warnings: deployWarnings(files),
     blockedBy: runsInFlight(tenant, workspace),
   };
 }
@@ -336,6 +451,15 @@ export interface DeployOptions {
   message?: string;
   /** Apply even while runs are in flight. */
   force?: boolean;
+  /**
+   * The removals a person confirmed from a dry run. When given, the deploy
+   * is refused (applied: false, `unexpectedRemovals` set) if it would remove
+   * anything not in this list — a run can write new storage/ outputs between
+   * the question and the answer, and a yes to one list is not a yes to
+   * another. Checked in the same synchronous call that writes, so there is
+   * no window between the check and the swap. Absent: no check, as before.
+   */
+  expectRemoved?: string[];
 }
 
 /**
@@ -427,6 +551,13 @@ export function deployWorkspace(
   if (plan.issues.length > 0 || blocked) {
     return { ...plan, applied: false, commit: null, preserved: 0 };
   }
+  if (opts.expectRemoved) {
+    const ok = new Set(opts.expectRemoved.map((p) => path.normalize(p).split(path.sep).join("/")));
+    const unexpectedRemovals = plan.removed.filter((p) => !ok.has(p));
+    if (unexpectedRemovals.length) {
+      return { ...plan, applied: false, commit: null, preserved: 0, unexpectedRemovals };
+    }
+  }
 
   const { preserved } = saveWorkspace(tenant, workspace, files, { commit: opts.commit ?? null, by: opts.by ?? "deploy", message: opts.message });
   const commit = opts.commit ?? null;

package/src/egress.ts

@@ -35,6 +35,9 @@
 // platform's (it needs a long-lived process and a Service); the pod side is
 // here in core, because it is what the runner image runs.
 
+import { trimSlashes } from "./paths.ts";
+import type { TestEffect } from "./test-mode.ts";
+
 /** `${NAME}` — the shape a secret reference takes everywhere in foldrun. */
 export const PLACEHOLDER = /\$\{([A-Z][A-Z0-9_]*)\}/g;
 
@@ -51,7 +54,7 @@ export const MODEL_KEY_NAME = "FOLDRUN_MODEL_KEY";
  */
 export function viaEgress(egress: string | undefined | null, target: string): string {
   if (!egress) return target;
-  return `${egress.replace(/\/+$/, "")}/${target}`;
+  return `${trimSlashes(egress)}/${target}`;
 }
 
 /** The names referenced by placeholders in a string. */
@@ -86,6 +89,16 @@ export function hostOf(url: string): string | null {
 export interface EgressGrant {
   /** Secret name → the hosts that secret may be substituted for. */
   secrets: Record<string, { value: string; hosts: string[] }>;
+  /** Secret name → the vault entry it came from, as secret-health keys it:
+   *  "account:NAME" or "workspace:<ws>:NAME". Two workspaces each holding an
+   *  API_KEY are two credentials, and one's refusal must not paint the
+   *  other red. Absent for a secret whose origin the runner did not know. */
+  healthKeys?: Record<string, string>;
+  /** The step's own timezone, from the clock cascade. The proxy is the only
+   *  party that sees an upstream response's headers, so it is the party
+   *  that has to put a rate-limit reset into words — and a reset time is
+   *  only useful in the calendar the step works to. See refusal.ts. */
+  timezone?: string;
 }
 
 export interface EgressLease {
@@ -96,19 +109,28 @@ export interface EgressLease {
    *  lease URL first), so a store that is not this process's memory has
    *  to be told when the grant is complete. Call before every attempt. */
   commit(): Promise<void>;
-  /** One line per request, for the run trace. Drained by the runner. */
-  drainLog(): Promise<string[]>;
+  /** One line per request, for the run trace. Drained by the runner. A
+   *  line may carry a test-mode effect beside its text — what the proxy
+   *  refused or redirected on a test lease — for the run page to list. */
+  drainLog(): Promise<EgressLogLine[]>;
   /** The step is over: the lease is void and its values are dropped. */
   release(): Promise<void>;
 }
 
+export type EgressLogLine = string | { text: string; effect: TestEffect };
+
 /**
  * The seam the platform fills. `null` from `lease` (or no `egress` at all)
  * means "no proxy here" and the runner falls back to materialising, exactly
  * as it always did.
  */
 export interface EgressHooks {
-  lease(args: { tenant: string; runId: string; grant: EgressGrant }): Promise<EgressLease | null>;
+  /** `test` — the run is a test run: the proxy applies the outward-write
+   *  policy in test-mode.ts to every request on this lease. Carried on the
+   *  lease, not the request, because the pod is the party not trusted to
+   *  say so. */
+  /** `step` — the step's index in run.steps; keys that step's operator inbox. */
+  lease(args: { tenant: string; runId: string; grant: EgressGrant; test?: boolean; step?: number }): Promise<EgressLease | null>;
 }
 
 /** Strip a header set of the proxy's own and hop-by-hop headers. */
@@ -172,5 +194,11 @@ export function addGrant(grant: EgressGrant, name: string, value: string, host:
   const existing = grant.secrets[name];
   if (existing) {
     if (!existing.hosts.includes(h)) existing.hosts.push(h);
+    // A name granted again with a different value is a rotation: the
+    // runner re-grants the model key after awaitRotatedCredential, on the
+    // same grant object the lease holds by reference. Keeping the first
+    // value here meant the "retry on the new one" sent the revoked token —
+    // every 4-hourly refresh on 2026-09-18..22 failed the step it landed on.
+    existing.value = value;
   } else grant.secrets[name] = { value, hosts: [h] };
 }