@foldrun/core 0.4.0 → 0.5.0

package/dist/src/confine.js

@@ -62,7 +62,7 @@ const PATH_KEYS = [
     "edits", // NotebookEdit-style payloads are checked via file_path too
 ];
 const DENIED_WITHIN = [
-    /(^|\/)secrets\.json$/,
+    /(^|\/)secrets\.json(\.[^/]+)?$/, // and its lock and temp files
     /(^|\/)runs(\/|$)/,
 ];
 /**
@@ -96,6 +96,8 @@ const VIRTUAL = [
     { prefix: "workspace/", root: (r) => r.workspaceRoot, readOnly: false },
 ];
 const WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
+/** Workspace-level directories an agent's own folder must never grow. */
+const SHARED_DIRS = new Set(["storage", "state", "workspace"]);
 // Only the built-in filesystem tools get path checks. foldrun's own MCP tools
 // are already confined at their own layer — script paths by resolveRunPath,
 // APIs by their declared base URL — and their arguments are not filesystem
@@ -141,11 +143,40 @@ export function suggestPath(raw) {
     }
     return `Use a path relative to your agent directory, or workspace/<dir>/… for the workspace root (workspace/storage/, workspace/state/).`;
 }
+/**
+ * A path an author wrote in a flow or an agent wrote in a tool call, as an
+ * absolute path: `workspace/…` from the workspace root, anything else from
+ * the agent's own folder (so the older `../../storage/x` lands in the same
+ * place as `workspace/storage/x`). Confinement is the caller's: this only
+ * says where the path points.
+ */
+export function resolveAgentPath(workspaceRoot, agentDir, raw) {
+    const p = raw.trim();
+    if (p === "workspace" || p === "workspace/")
+        return path.resolve(workspaceRoot);
+    if (p.startsWith("workspace/"))
+        return path.resolve(workspaceRoot, p.slice("workspace/".length));
+    return path.resolve(agentDir, p);
+}
+/** True when `abs` is `root` or under it. */
+export function isWithin(root, abs) {
+    const rel = path.relative(path.resolve(root), path.resolve(abs));
+    return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
 /** Expand a virtual prefix to a real absolute path, or null if it has none. */
 export function expandVirtual(raw, roots) {
+    // The SDK resolves a relative path against the cwd BEFORE canUseTool sees
+    // it, so `workspace/storage/x.json` arrives as
+    // `<agentDir>/workspace/storage/x.json` and never matched a prefix. The
+    // write then made a literal `workspace/` folder inside the agent's own
+    // directory and reported success: gbp-desk's reply-sheet, 2026-09-24, whose
+    // approved replies never reached the poster. Read the prefix off the path
+    // relative to the agent directory as well as off the raw one.
+    const rel = path.isAbsolute(raw) ? path.relative(roots.agentDir, raw).split(path.sep).join("/") : null;
+    const candidate = rel !== null && !rel.startsWith("..") && !path.isAbsolute(rel) ? rel : raw;
     for (const v of VIRTUAL) {
-        if (raw.startsWith(v.prefix)) {
-            return { abs: path.resolve(v.root(roots), raw.slice(v.prefix.length)), readOnly: v.readOnly };
+        if (candidate.startsWith(v.prefix)) {
+            return { abs: path.resolve(v.root(roots), candidate.slice(v.prefix.length)), readOnly: v.readOnly };
         }
     }
     return null;
@@ -205,6 +236,25 @@ export function checkPaths(toolName, input, roots) {
                     `environment variables, and the run journal is not yours to read or rewrite.`,
             };
         }
+        // storage/, state/ and workspace/ belong to the workspace. The same name
+        // under an agent's own folder is always a missing prefix — `storage/x`
+        // written from agents/<name>/ — and the write used to succeed there,
+        // where no other agent looks: gbp-desk's approved replies, lawyer-desk's
+        // batch, five files in all by 2026-09-24. Refuse it with the path that
+        // was meant; the model takes the correction on its next turn.
+        if (isWrite && !virtual) {
+            const own = path.relative(real(path.resolve(roots.agentDir)), abs).split(path.sep).join("/");
+            const [top, ...rest] = own.split("/");
+            if (!own.startsWith("..") && rest.length && SHARED_DIRS.has(top)) {
+                const meant = top === "workspace" ? `workspace/${rest.join("/")}` : `workspace/${top}/${rest.join("/")}`;
+                return {
+                    ok: false,
+                    reason: `${toolName} was denied: "${raw}" would create ${top}/ inside your own agent folder, where no ` +
+                        `other agent or run looks. Did you mean ${meant}? Shared files go under workspace/ ` +
+                        `(workspace/storage/, workspace/state/, workspace/memory/); your own scratch goes to outputs/.`,
+                };
+            }
+        }
         if (isWrite && READ_ONLY_WITHIN.some((re) => re.test(within))) {
             return {
                 ok: false,
@@ -218,6 +268,30 @@ export function checkPaths(toolName, input, roots) {
         if (virtual)
             rewritten = { ...(rewritten ?? input), [key]: abs };
     }
+    // Glob searches from `path` (the cwd when absent) and its PATTERN never
+    // climbs: `../../storage/draft/*.md` answered "No files found" with the
+    // files there (run-munef2am-439a), and an expanded `workspace/storage/*.md`
+    // is an absolute pattern the tool does not search by either. Split such a
+    // pattern at its first wildcard: the fixed directories become `path`, the
+    // rest stays the pattern — so both spellings find what is there.
+    if (toolName === "Glob") {
+        const cur = { ...input, ...(rewritten ?? {}) };
+        const pattern = typeof cur.pattern === "string" ? cur.pattern : "";
+        const climbs = pattern.startsWith("../");
+        if (pattern && (climbs || path.isAbsolute(pattern)) && (cur.path === undefined || cur.path === "")) {
+            const absPattern = climbs ? path.resolve(roots.agentDir, pattern) : pattern;
+            const segs = absPattern.split("/");
+            const wild = segs.findIndex((seg) => /[*?[{]/.test(seg));
+            if (wild > 0 && wild < segs.length) {
+                const base = segs.slice(0, wild).join("/") || "/";
+                const inWorkspace = !path.relative(workspace, real(base)).startsWith("..");
+                const inLibrary = !path.relative(library, real(base)).startsWith("..");
+                if (inWorkspace || inLibrary) {
+                    rewritten = { ...(rewritten ?? input), path: base, pattern: segs.slice(wild).join("/") };
+                }
+            }
+        }
+    }
     return { ok: true, updatedInput: rewritten };
 }
 // A shell can defeat any argument-level path check, so Bash is handled
@@ -301,3 +375,144 @@ export function checkBash(command) {
     }
     return { ok: true };
 }
+// ------------------------------------------------------------ workspace link
+/**
+ * `workspace/…` for a shell. The file tools expand the prefix themselves
+ * (expandVirtual above), but Bash, a script an agent runs, a scripts: tool
+ * and a shell `verify:` see only the filesystem — and there `workspace/` was
+ * a folder that did not exist, so the one spelling the docs teach worked in
+ * Read and failed in `cat`. For the length of a step the agent's folder holds
+ * a `workspace` link to the workspace root (`../..`), and nothing else.
+ *
+ * Why only for a step: a permanent link inside the tree it points at is a
+ * cycle, and anything that walks the tree following links walks it forever
+ * (a `shared` link was tried that way and reverted). Every walker this
+ * platform runs over a workspace skips links (storage harvest, the source
+ * listing, tar, the container copy-back), and the link is gone before the
+ * step's files are read back.
+ *
+ * Counted, because the parallel instances of one agent (`each:`, a fan-out)
+ * share its folder in one process: the last one out removes it. A real
+ * folder already called `workspace` (a stray from before the prefix was
+ * expanded) is left alone and reported — linking over it would hide files.
+ */
+const workspaceLinks = new Map();
+export function linkWorkspace(agentDir, workspaceRoot) {
+    const link = path.join(agentDir, "workspace");
+    const target = path.relative(path.resolve(agentDir), path.resolve(workspaceRoot)) || ".";
+    const held = workspaceLinks.get(link) ?? 0;
+    let note = null;
+    let own = false;
+    if (held > 0) {
+        own = true;
+    }
+    else {
+        try {
+            const st = fs.lstatSync(link);
+            if (st.isSymbolicLink()) {
+                // Left by a step that ended without its cleanup — adopt it when it
+                // points where ours would, replace it when it does not.
+                if (fs.readlinkSync(link) !== target) {
+                    fs.unlinkSync(link);
+                    fs.symlinkSync(target, link, "dir");
+                }
+                own = true;
+            }
+            else {
+                note =
+                    `agents/${path.basename(agentDir)}/workspace/ is a real folder, so a shell command's ` +
+                        `workspace/… reaches it rather than the workspace root — move what it holds to the ` +
+                        `workspace's own storage/ or state/ and delete it`;
+            }
+        }
+        catch {
+            try {
+                fs.symlinkSync(target, link, "dir");
+                own = true;
+            }
+            catch (err) {
+                note = `could not link workspace/ for the shell: ${err instanceof Error ? err.message : String(err)}`;
+            }
+        }
+    }
+    if (own)
+        workspaceLinks.set(link, held + 1);
+    let released = false;
+    return {
+        note,
+        release: () => {
+            if (!own || released)
+                return;
+            released = true;
+            const left = (workspaceLinks.get(link) ?? 1) - 1;
+            if (left > 0) {
+                workspaceLinks.set(link, left);
+                return;
+            }
+            workspaceLinks.delete(link);
+            try {
+                if (fs.lstatSync(link).isSymbolicLink())
+                    fs.unlinkSync(link);
+            }
+            catch {
+                // already gone
+            }
+        },
+    };
+}
+/**
+ * A Node program started THROUGH the link is still its own main module.
+ *
+ * `node workspace/tools/x/run.mjs` loads the file by its real path —
+ * import.meta.url says `<ws>/tools/x/run.mjs` — while process.argv[1] keeps
+ * the path as typed, `<ws>/agents/a/workspace/tools/x/run.mjs`. The usual
+ * entry-point check, `import.meta.url === pathToFileURL(process.argv[1]).href`,
+ * was then false: the program did nothing, exited 0, and a `verify:` that
+ * ran it passed on every input.
+ *
+ * The fix rides NODE_OPTIONS into every child a step starts (the model's
+ * Bash, a shell `verify:`, a scripts: tool, the Test button): a preload that
+ * rewrites argv[1] to its real path, and only when it goes through this
+ * link. `--preserve-symlinks-main` was the obvious flag and the wrong one:
+ * it applies to EVERY linked entry point, and a `node_modules/.bin` shim
+ * then resolves `require("../lib/x.js")` beside the shim and fails.
+ *
+ * A data: URL rather than a file, so nothing has to be shipped to wherever
+ * the step runs (host, run container, pod, a runtime: venv). Node ≥ 20.6
+ * reads `--import` from NODE_OPTIONS; the runner image is Node 22. Python
+ * needs nothing: `python3 workspace/x.py` is `__main__` however it is
+ * reached.
+ */
+const MAIN_PRELOAD = [
+    `import{realpathSync}from"node:fs";`,
+    `import{resolve,sep,delimiter}from"node:path";`,
+    `const l=process.env.FOLDRUN_WORKSPACE_LINK,a=process.argv[1];`,
+    `if(l&&a){const f=resolve(a);`,
+    `if(l.split(delimiter).some(k=>k&&f.startsWith(k+sep))){`,
+    `try{process.argv[1]=realpathSync(f)}catch{}}}`,
+].join("");
+const MAIN_IMPORT = `--import=data:text/javascript,${encodeURIComponent(MAIN_PRELOAD)}`;
+/**
+ * `env` plus what makes `node workspace/…` its own main module (above):
+ * the link's path(s) in FOLDRUN_WORKSPACE_LINK, the preload appended to
+ * NODE_OPTIONS — after what it held, or the host's when it held nothing.
+ * Idempotent, and harmless where no link exists: the preload matches only
+ * a path under it.
+ */
+export function workspaceLinkEnv(env, agentDir) {
+    const link = path.join(path.resolve(agentDir), "workspace");
+    let real = link;
+    try {
+        real = path.join(fs.realpathSync(agentDir), "workspace");
+    }
+    catch {
+        // not there yet — the lexical path is the one a shell would type
+    }
+    const held = env.NODE_OPTIONS ?? process.env.NODE_OPTIONS ?? "";
+    const options = held.includes(MAIN_IMPORT) ? held : [held.trim(), MAIN_IMPORT].filter(Boolean).join(" ");
+    return {
+        ...env,
+        FOLDRUN_WORKSPACE_LINK: [...new Set([link, real])].join(path.delimiter),
+        NODE_OPTIONS: options,
+    };
+}

package/dist/src/deploy.d.ts

@@ -1,4 +1,14 @@
 import { type DeployFile } from "./store.ts";
+/**
+ * Is this path, relative to a workspace root, one `readTree` would carry?
+ *
+ * The same question the walk above asks, asked of a path that is not on this
+ * machine — what the platform lists for a workspace, so `foldrun status` and
+ * `foldrun pull` compare like with like. Without it the comparison counted
+ * every run artefact and bookkeeping file the platform keeps as a local
+ * deletion, and every status was a wall of red.
+ */
+export declare function isSourcePath(rel: string): boolean;
 export interface DeployIssue {
     where: string;
     message: string;
@@ -11,11 +21,18 @@ export interface DeployPlan {
     updated: string[];
     /** Empty when the deploy is safe to apply. */
     issues: DeployIssue[];
+    /** Advisory, non-blocking: a deploy proceeds with these. Today this is
+     *  the outward-without-a-gate lint — the same one `foldrun check` fails
+     *  on, surfaced here so a push over the API is not the last to hear it. */
+    warnings: DeployIssue[];
     /** Set when a run is in flight, which blocks the swap. */
     blockedBy: string[];
 }
 export interface DeployResult extends DeployPlan {
     applied: boolean;
+    /** Set when `expectRemoved` was given and the deploy would have removed
+     *  paths outside it: those paths. The deploy was refused, nothing changed. */
+    unexpectedRemovals?: string[];
     /** The commit this workspace is now running, when the caller knows it. */
     commit: string | null;
     preserved: number;
@@ -37,6 +54,13 @@ export declare function readTree(dir: string): DeployFile[];
  * not on disk yet. A deploy that would leave the workspace failing its own
  * checker should not be a deploy.
  */
+/** Best-effort warnings for a deploy: an agent's `web:` warnings (see
+ *  webWarnings), and the outward gate — a step whose agent grants
+ *  a workspace tool marked `outward: true` and has no `verify:`/gate. Reads
+ *  only the deployed files, so a library or gallery outward tool is not seen
+ *  here — `foldrun check`, which resolves every scope, remains the real gate.
+ *  Non-blocking by decision: the deploy proceeds and says so. */
+export declare function deployWarnings(files: DeployFile[]): DeployIssue[];
 export declare function deployIssues(files: DeployFile[]): DeployIssue[];
 /**
  * Runs that make this a bad moment to swap the files under them.
@@ -57,6 +81,15 @@ export interface DeployOptions {
     message?: string;
     /** Apply even while runs are in flight. */
     force?: boolean;
+    /**
+     * The removals a person confirmed from a dry run. When given, the deploy
+     * is refused (applied: false, `unexpectedRemovals` set) if it would remove
+     * anything not in this list — a run can write new storage/ outputs between
+     * the question and the answer, and a yes to one list is not a yes to
+     * another. Checked in the same synchronous call that writes, so there is
+     * no window between the check and the swap. Absent: no check, as before.
+     */
+    expectRemoved?: string[];
 }
 /**
  * Deploy a file list to a workspace, if it checks out.

package/dist/src/deploy.js

@@ -20,14 +20,42 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { saveWorkspace, workspaceDir, listRuns, parseFlow, WORKSPACE_DIRS, assertSafeName, notifyWorkspaceChanged, } from "./store.js";
+import { saveWorkspace, keptOnDeploy, workspaceDir, listRuns, parseFlow, parseToolDef, WORKSPACE_DIRS, assertSafeName, notifyWorkspaceChanged, } from "./store.js";
+import { lintFlow } from "./flow-lint.js";
+import { refNames } from "./refs.js";
+import matter from "gray-matter";
 import { conformanceIssues } from "./okf.js";
+import { timezoneProblem } from "./clock.js";
+import { webProblems, webWarnings, runnerEngines } from "./providers.js";
+import { readLimits } from "./limits.js";
+import { actionProblems } from "./web-actions.js";
+import { languageProblem } from "./language.js";
+import { localeProblems } from "./locale.js";
 import { repoDir } from "./gitrepo.js";
+import { entriesNoFollow } from "./paths.js";
 /** Directories a deploy never reads out of a source tree. */
 const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results"]);
 /** Files that are never part of a workspace, whatever directory they sit in. */
 const NOT_SOURCE_FILE = new Set([".DS_Store", "secrets.json"]);
 const IN_WORKSPACE_DIR = new RegExp(`^(${WORKSPACE_DIRS.join("|")})/`);
+/**
+ * Is this path, relative to a workspace root, one `readTree` would carry?
+ *
+ * The same question the walk above asks, asked of a path that is not on this
+ * machine — what the platform lists for a workspace, so `foldrun status` and
+ * `foldrun pull` compare like with like. Without it the comparison counted
+ * every run artefact and bookkeeping file the platform keeps as a local
+ * deletion, and every status was a wall of red.
+ */
+export function isSourcePath(rel) {
+    const norm = rel.replaceAll("\\", "/");
+    const parts = norm.split("/");
+    if (parts.some((p) => NOT_SOURCE.has(p)))
+        return false;
+    if (NOT_SOURCE_FILE.has(parts[parts.length - 1]))
+        return false;
+    return norm === "AGENTS.md" || norm === "project.md" || IN_WORKSPACE_DIR.test(norm);
+}
 /**
  * Read a directory into the file list a deploy ships.
  *
@@ -130,6 +158,72 @@ export function readTree(dir) {
  * not on disk yet. A deploy that would leave the workspace failing its own
  * checker should not be a deploy.
  */
+/** Best-effort warnings for a deploy: an agent's `web:` warnings (see
+ *  webWarnings), and the outward gate — a step whose agent grants
+ *  a workspace tool marked `outward: true` and has no `verify:`/gate. Reads
+ *  only the deployed files, so a library or gallery outward tool is not seen
+ *  here — `foldrun check`, which resolves every scope, remains the real gate.
+ *  Non-blocking by decision: the deploy proceeds and says so. */
+export function deployWarnings(files) {
+    const front = (content) => {
+        try {
+            return matter(content).data;
+        }
+        catch {
+            return {};
+        }
+    };
+    // Workspace tools that change something outside the workspace.
+    const outwardTools = new Set();
+    for (const f of files) {
+        const m = f.path.match(/^tools\/([^/]+?)(?:\/tool)?\.md$/);
+        if (!m)
+            continue;
+        const data = front(f.content);
+        const def = parseToolDef(data, m[1], f.content);
+        // `outward: true` is read off the frontmatter, the same test the runtime
+        // and the CLI use; parseToolDef does not fold it onto the def.
+        if (def && data.outward === true)
+            outwardTools.add(def.name ?? m[1]);
+    }
+    // Agents that grant one of them.
+    const outwardAgents = [];
+    const agentNames = [];
+    const out = [];
+    // The web: warnings check prints — the old session: key, and a pinned
+    // user agent behind the runner image's Chrome, which the platform knows
+    // from FOLDRUN_RUNNER_ENGINES (the deploy read it from the image).
+    const { chrome, chromium } = runnerEngines() ?? {};
+    for (const f of files) {
+        const m = f.path.match(/^agents\/([^/]+)\/agent\.md$/);
+        if (!m)
+            continue;
+        agentNames.push(m[1]);
+        const data = front(f.content);
+        if (refNames(data.tools).some((t) => outwardTools.has(t)))
+            outwardAgents.push(m[1]);
+        for (const w of webWarnings(data, { chrome, chromium }))
+            out.push({ where: f.path, message: w });
+    }
+    if (!outwardAgents.length)
+        return out;
+    for (const f of files) {
+        if (!/^flows\/[^/]+\.md$/.test(f.path))
+            continue;
+        let flow;
+        try {
+            flow = parseFlow(path.basename(f.path), f.content);
+        }
+        catch {
+            continue;
+        }
+        for (const w of lintFlow(flow, { agents: agentNames, outwardAgents })) {
+            if (w.kind === "outward")
+                out.push({ where: `${f.path}${w.line ? `:${w.line}` : ""}`, message: w.message });
+        }
+    }
+    return out;
+}
 export function deployIssues(files) {
     const issues = [];
     const at = (where, message) => issues.push({ where, message });
@@ -157,6 +251,40 @@ export function deployIssues(files) {
         if (m)
             agents.add(m[1]);
     }
+    // `timezone:` is read at four levels and a value nothing can parse falls
+    // silently through to the level above — so it is refused where it was
+    // written, not discovered as a date that is a day out.
+    for (const f of files) {
+        if (!/^(AGENTS\.md|agents\/[^/]+\/agent\.md)$/.test(f.path))
+            continue;
+        let front = {};
+        try {
+            front = matter(f.content).data;
+        }
+        catch {
+            continue; // unparseable frontmatter is its own report
+        }
+        const problem = timezoneProblem(front.timezone);
+        if (problem)
+            at(f.path, problem);
+        // `schedule:` on an agent or AGENTS.md runs nothing — only a flow has a
+        // clock. Refuse it where it was written rather than deploy it dead.
+        if (front.schedule !== undefined) {
+            at(f.path, "schedule: an agent has no schedule of its own — only a flow runs on a clock. Put schedule: on the flow that runs this agent, or remove it.");
+        }
+        // The same refusal check gives: a web key that cannot work never ships.
+        for (const w of [...webProblems(front), ...actionProblems(front)])
+            at(f.path, w);
+        // `limits:` that cannot be read — a count of 0, a word, web.<not an
+        // action> — would run uncapped where the author meant a cap.
+        for (const w of readLimits(front.limits).problems)
+            at(f.path, w);
+        const lang = languageProblem(front.language);
+        if (lang)
+            at(f.path, lang);
+        for (const w of localeProblems(front))
+            at(f.path, w);
+    }
     if (agents.size === 0) {
         at("agents/", "no agents — a workspace needs at least one agents/<name>/agent.md");
     }
@@ -184,6 +312,8 @@ export function deployIssues(files) {
         }
         if (parsed.steps.length === 0)
             at(f.path, "no steps");
+        for (const fp of parsed.frontProblems)
+            at(f.path, fp);
         for (const s of parsed.steps) {
             const target = s.subflow ?? s.agent;
             const known = s.subflow ? flowNames.has(target) : agents.has(target);
@@ -245,7 +375,7 @@ export function planDeploy(tenant, workspace, files) {
     const shipped = new Map(files.map((f) => [path.normalize(f.path), f.content]));
     const present = new Set();
     if (fs.existsSync(dir)) {
-        for (const entry of fs.readdirSync(dir, { recursive: true })) {
+        for (const entry of entriesNoFollow(dir)) {
             const rel = String(entry).split(path.sep).join("/");
             if (NOT_SOURCE.has(rel.split("/")[0]))
                 continue;
@@ -278,16 +408,18 @@ export function planDeploy(tenant, workspace, files) {
             updated.push(rel);
         }
     }
-    // What saveWorkspace will keep regardless — reporting these as removals
-    // would be a lie, and the alarming kind.
-    const kept = (rel) => /(^|\/)state\//.test(rel) || /(^|\/)memory\/[^/]+\.md$/.test(rel);
-    const removed = [...present].filter((rel) => !shipped.has(rel) && !kept(rel));
+    // What saveWorkspace will keep regardless — storage/, state/, agent
+    // memory, the platform's own files. Reporting these as removals would be
+    // a lie, and the alarming kind; one predicate serves both.
+    const shippedPaths = new Set(shipped.keys());
+    const removed = [...present].filter((rel) => !shipped.has(rel) && !keptOnDeploy(rel, shippedPaths));
     return {
         files,
         added: added.sort(),
         updated: updated.sort(),
         removed: removed.sort(),
         issues: deployIssues(files),
+        warnings: deployWarnings(files),
         blockedBy: runsInFlight(tenant, workspace),
     };
 }
@@ -351,6 +483,13 @@ export function deployWorkspace(tenant, workspace, files, opts = {}) {
     if (plan.issues.length > 0 || blocked) {
         return { ...plan, applied: false, commit: null, preserved: 0 };
     }
+    if (opts.expectRemoved) {
+        const ok = new Set(opts.expectRemoved.map((p) => path.normalize(p).split(path.sep).join("/")));
+        const unexpectedRemovals = plan.removed.filter((p) => !ok.has(p));
+        if (unexpectedRemovals.length) {
+            return { ...plan, applied: false, commit: null, preserved: 0, unexpectedRemovals };
+        }
+    }
     const { preserved } = saveWorkspace(tenant, workspace, files, { commit: opts.commit ?? null, by: opts.by ?? "deploy", message: opts.message });
     const commit = opts.commit ?? null;
     if (commit)

package/dist/src/egress.d.ts

@@ -36,6 +36,11 @@ export interface EgressGrant {
      *  API_KEY are two credentials, and one's refusal must not paint the
      *  other red. Absent for a secret whose origin the runner did not know. */
     healthKeys?: Record<string, string>;
+    /** The step's own timezone, from the clock cascade. The proxy is the only
+     *  party that sees an upstream response's headers, so it is the party
+     *  that has to put a rate-limit reset into words — and a reset time is
+     *  only useful in the calendar the step works to. See refusal.ts. */
+    timezone?: string;
 }
 export interface EgressLease {
     /** The base the pod sends through: `http://…/e/<token>`. */
@@ -66,11 +71,13 @@ export interface EgressHooks {
      *  policy in test-mode.ts to every request on this lease. Carried on the
      *  lease, not the request, because the pod is the party not trusted to
      *  say so. */
+    /** `step` — the step's index in run.steps; keys that step's operator inbox. */
     lease(args: {
         tenant: string;
         runId: string;
         grant: EgressGrant;
         test?: boolean;
+        step?: number;
     }): Promise<EgressLease | null>;
 }
 /** Strip a header set of the proxy's own and hop-by-hop headers. */

package/dist/src/egress.js

@@ -128,6 +128,12 @@ export function addGrant(grant, name, value, host) {
     if (existing) {
         if (!existing.hosts.includes(h))
             existing.hosts.push(h);
+        // A name granted again with a different value is a rotation: the
+        // runner re-grants the model key after awaitRotatedCredential, on the
+        // same grant object the lease holds by reference. Keeping the first
+        // value here meant the "retry on the new one" sent the revoked token —
+        // every 4-hourly refresh on 2026-09-18..22 failed the step it landed on.
+        existing.value = value;
     }
     else
         grant.secrets[name] = { value, hosts: [h] };

package/dist/src/eol.d.ts

@@ -0,0 +1,2 @@
+export declare const toLF: (raw: string) => string;
+export declare const asRaw: (raw: string, out: string) => string;

package/dist/src/eol.js

@@ -0,0 +1,7 @@
+// Flow (and other markdown) rewrites work on LF text: the parser and the
+// line rules read "\n"-separated lines, and a CRLF line's trailing "\r"
+// defeats them (an option line never matched, so setting it again added a
+// second copy; a CRLF step line was no step at all). So each rewrite takes a
+// CRLF file as LF and gives it back as CRLF.
+export const toLF = (raw) => raw.replace(/\r\n/g, "\n");
+export const asRaw = (raw, out) => (raw.includes("\r\n") ? out.replace(/\r?\n/g, "\r\n") : out);

package/dist/src/evals.d.ts

@@ -42,6 +42,11 @@ export interface EvalInfo {
      *  unless the file says `live: true`. A flow eval that must really send
      *  to prove itself opts in; nothing opts in by accident. */
     live: boolean;
+    /** A file of saved inputs for a flow, not a test: `inputs: true`. Its
+     *  cases are named tasks the dashboard's "Run with…" and `foldrun invoke
+     *  --inputs` start the flow with; nothing is asserted, so no eval run,
+     *  deploy or `foldrun eval` ever runs them. */
+    inputs: boolean;
     cases: EvalCase[];
 }
 export declare function parseEval(file: string, raw: string): EvalInfo;

package/dist/src/evals.js

@@ -139,6 +139,7 @@ export function parseEval(file, raw) {
         effort: resolveEffort(data.effort ?? "low"),
         trigger: data.trigger === "manual" ? "manual" : "deploy",
         live: data.live === true,
+        inputs: data.inputs === true,
         cases,
     };
 }
@@ -419,7 +420,10 @@ async function checkAssertion(assertion, output, agentDir, model, effort) {
 export async function runEval(tenant, workspace, info) {
     const startedAt = new Date().toISOString();
     const results = [];
-    for (const testCase of info.cases) {
+    // Saved inputs carry no assertions: running them would start and bill a
+    // run per case only to report every one failed. Nothing to grade.
+    const cases = info.inputs ? [] : info.cases;
+    for (const testCase of cases) {
         const target = info.flow ? null : info.agent;
         let runId = null;
         let output = "";
@@ -601,7 +605,7 @@ commit = null) {
         return { ran: 0, skipped: "no revision to stamp the result with" };
     // Only the evals that asked to run on deploy — a `trigger: manual` eval is
     // one a person runs on purpose, because it costs a whole flow run.
-    const evals = listEvals(tenant, workspace).filter((e) => e.trigger !== "manual");
+    const evals = listEvals(tenant, workspace).filter((e) => e.trigger !== "manual" && !e.inputs);
     if (evals.length === 0)
         return { ran: 0, skipped: "no evals" };
     const dir = path.join(workspaceDir(tenant, workspace), "evals", ".results");

package/dist/src/flow-lint.d.ts

@@ -10,11 +10,19 @@ export interface FlowWarning {
      *  `foldrun check` must fail on rather than note. Absent means advisory,
      *  which every structural warning in this file is. */
     level?: "error" | "warn";
+    /** A stable tag for warnings a caller wants to single out — the deploy
+     *  surfaces `kind: "outward"` as a non-blocking warning. */
+    kind?: string;
 }
 /** What exists in the workspace, when the caller knows. Optional: the lint
  *  is useful without it, and a caller that has the lists gets the reference
  *  checks too. */
 export interface KnownNames {
     agents: string[];
+    /** Agents that hold a tool declaring `outward: true` — one that sends,
+     *  posts, buys or publishes. The caller resolves the grants; this file only
+     *  needs the answer. Absent means the caller did not look, and the outward
+     *  rule is skipped rather than guessed at. */
+    outwardAgents?: string[];
 }
 export declare function lintFlow(flow: FlowInfo, known?: KnownNames): FlowWarning[];