@foldrun/core 0.5.0 → 0.6.0

package/README.md

@@ -208,16 +208,19 @@ To *run* an agent you need one of:
 
 - **`ANTHROPIC_API_KEY`** — an API key from
   [console.anthropic.com](https://console.anthropic.com).
+- **`CLAUDE_CODE_OAUTH_TOKEN`** — a Claude login token, from
+  `claude setup-token`. Used when no API key is set.
 - **Your own provider.** An agent that names a `provider:` needs no
   Anthropic key: 29 endpoints are known by name, including `ollama`,
   `lmstudio` and `vllm`, so a local model is a complete answer. Anything
   not in that list works by spelling out `base_url:`, `format:` and
   `auth:`. See [providers](https://docs.foldrun.io/providers).
 
-A **Claude Code or claude.ai subscription login is not one of them**, and
-the CLI will not look for one. Anthropic does not permit products built on
-its Agent SDK to run on consumer subscriptions, so using that login here
-would put you outside their terms — an API key is the supported path.
+The first one set is used, and every step records which. The login Claude
+Code keeps on the machine is never picked up by itself. Anthropic does not
+allow products built on its Agent SDK to offer claude.ai login unless
+Anthropic has approved them, so check that the terms cover your use before
+you rely on a login token.
 
 ## Status
 

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export * from "./src/layout.ts";
 export * from "./src/paths.ts";
 export * from "./src/store.ts";
+export * from "./src/model-credential.ts";
 export * from "./src/starter.ts";
 export * from "./src/runner.ts";
 export * from "./src/okf.ts";

package/dist/index.js

@@ -12,6 +12,7 @@
 export * from "./src/layout.js";
 export * from "./src/paths.js";
 export * from "./src/store.js";
+export * from "./src/model-credential.js";
 export * from "./src/starter.js";
 export * from "./src/runner.js";
 export * from "./src/okf.js";

package/dist/src/browser-pod.d.ts

@@ -30,8 +30,27 @@ export interface ClassifyContext {
     /** Web actions a paid provider answers this step — from the env's
      *  FOLDRUN_WEB_<ACTION>_VIA. */
     paidWeb?: Record<string, string>;
+    /** Page scripts the agent's web.browse block runs in every page — the
+     *  env's FOLDRUN_BROWSER_INIT. They make every browse call a write. */
+    browseInit?: string;
 }
-/** The browse actions a call asked for, nested `if` branches included. */
+/**
+ * The browse actions a call asked for, nested `if` branches included.
+ *
+ * Read the way the web tool reads them (platform gallery.ts, browse.mjs
+ * checkSteps): `actions` is an array of steps, a step's action is one of its
+ * OWN keys (the first the tool knows), and the only steps inside a step are
+ * an `if`'s `then` and `else`. Every own key of a step is returned — the
+ * caller keeps the ones it cares about, and a step holding a write key beside
+ * a read key counts as the write. What sits inside an option's value — an
+ * extract's `fields` (column names), a mock's `json` body, a webmcp `input` —
+ * is data, not an action: `{"fields": {"type": "td.kind"}}` is no typing.
+ *
+ * A shape the tool would refuse (an object where the array belongs, a step
+ * that is not an object, `then` that is not a list) is walked key by key at
+ * every depth, as before; nesting past MAX_DEPTH is unreadable, so a write
+ * buried deep is never taken for a read.
+ */
 export declare function browseActionNames(actions: unknown): string[];
 /** What a browse call's arguments would write, or null when it only reads. */
 export declare function browseWrites(input: Record<string, unknown>): string | null;

package/dist/src/browser-pod.js

@@ -45,8 +45,9 @@ export const BROWSE_WRITE_ACTIONS = [
     "select", "check", "uncheck", "upload", "dialog", "login", "eval", "webmcp", "solve",
 ];
 /** Call arguments of web action=browse that are writes whatever the actions:
- *  page script, a paid captcha solver, a confirmation of a credential step. */
-const BROWSE_WRITE_ARGS = ["js", "captcha", "captcha_solver", "confirm"];
+ *  page script (js=, or init= scripts run in every page), a paid captcha
+ *  solver, a confirmation of a credential step. */
+const BROWSE_WRITE_ARGS = ["js", "init", "captcha", "captcha_solver", "confirm"];
 /** Web actions that only read — when foldrun's own answers them. A paid
  *  provider answering one (FOLDRUN_WEB_<ACTION>_VIA) makes it a write: doing
  *  it twice is paying twice. `monitor` keeps state, so it always writes. */
@@ -57,32 +58,78 @@ const READ_BUILTINS = new Set(["Read", "Glob", "Grep", "WebSearch", "WebFetch",
  *  answer; a delegation's own calls come through on their own. */
 const READ_SERVERS = new Set(["foldrun_search", "foldrun_history", "foldrun_desks", "foldrun_agents"]);
 const DELEGATE = new Set(["Agent", "Task"]);
-/** The browse actions a call asked for, nested `if` branches included. */
+/**
+ * The browse actions a call asked for, nested `if` branches included.
+ *
+ * Read the way the web tool reads them (platform gallery.ts, browse.mjs
+ * checkSteps): `actions` is an array of steps, a step's action is one of its
+ * OWN keys (the first the tool knows), and the only steps inside a step are
+ * an `if`'s `then` and `else`. Every own key of a step is returned — the
+ * caller keeps the ones it cares about, and a step holding a write key beside
+ * a read key counts as the write. What sits inside an option's value — an
+ * extract's `fields` (column names), a mock's `json` body, a webmcp `input` —
+ * is data, not an action: `{"fields": {"type": "td.kind"}}` is no typing.
+ *
+ * A shape the tool would refuse (an object where the array belongs, a step
+ * that is not an object, `then` that is not a list) is walked key by key at
+ * every depth, as before; nesting past MAX_DEPTH is unreadable, so a write
+ * buried deep is never taken for a read.
+ */
 export function browseActionNames(actions) {
+    const UNREADABLE = "(unreadable actions)";
+    const MAX_DEPTH = 32;
     let steps = actions;
     if (typeof steps === "string") {
         try {
             steps = JSON.parse(steps);
         }
         catch {
-            return ["(unreadable actions)"];
+            return [UNREADABLE];
         }
     }
     const out = [];
-    const walk = (v, depth) => {
-        if (depth > 8 || v === null || typeof v !== "object")
+    // Unknown shapes: every key anywhere is a candidate action.
+    const walkAny = (v, depth) => {
+        if (v === null || typeof v !== "object")
+            return;
+        if (depth > MAX_DEPTH) {
+            out.push(UNREADABLE);
             return;
+        }
         if (Array.isArray(v)) {
             for (const x of v)
-                walk(x, depth + 1);
+                walkAny(x, depth + 1);
             return;
         }
         for (const [k, x] of Object.entries(v)) {
             out.push(k);
-            walk(x, depth + 1);
+            walkAny(x, depth + 1);
+        }
+    };
+    const walkSteps = (v, depth) => {
+        if (v === null || v === undefined)
+            return;
+        if (depth > MAX_DEPTH) {
+            out.push(UNREADABLE);
+            return;
+        }
+        if (!Array.isArray(v)) {
+            walkAny(v, depth);
+            return;
+        }
+        for (const step of v) {
+            if (step === null || typeof step !== "object" || Array.isArray(step)) {
+                walkAny(step, depth + 1);
+                continue;
+            }
+            for (const [k, x] of Object.entries(step)) {
+                out.push(k);
+                if (k === "then" || k === "else")
+                    walkSteps(x, depth + 1);
+            }
         }
     };
-    walk(steps, 0);
+    walkSteps(steps, 0);
     return out;
 }
 /** What a browse call's arguments would write, or null when it only reads. */
@@ -135,6 +182,8 @@ export function classifyCall(tool, input, ctx = {}) {
             const w = browseWrites(args);
             if (w)
                 return write(w);
+            if (ctx.browseInit)
+                return write(`browse init scripts (${ctx.browseInit})`);
         }
         return { write: false };
     }

package/dist/src/container.d.ts

@@ -15,6 +15,13 @@ export interface ContainerRunOptions {
     agentDir: string;
     /** Extra read-only mounts: host path → container path. */
     readOnly?: Record<string, string>;
+    /** Workspace paths a script was handed as `workspace/…`: copied in at
+     *  `container` before it runs, and what it created or changed under them
+     *  copied back to `host` after — the host's workspace link, as a copy. */
+    staged?: {
+        host: string;
+        container: string;
+    }[];
     image: string;
     argv: string[];
     env: Record<string, string>;
@@ -28,3 +35,5 @@ export declare function runInContainer(opts: ContainerRunOptions): Promise<{
     code: number | null;
     out: string;
 }>;
+/** Write `from` over `to` where the bytes differ; recurse into folders. */
+export declare function syncChanged(from: string, to: string): void;

package/dist/src/container.js

@@ -9,6 +9,7 @@
 // Falls back to host execution when Docker isn't available, so local
 // development keeps working with zero configuration.
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { dataRoot } from "./paths.js";
 import { spawnSync, spawn } from "node:child_process";
@@ -135,16 +136,41 @@ export async function runInContainer(opts) {
     }
     const cid = (created.stdout ?? "").trim();
     try {
-        // The agent's own directory becomes /workspace…
-        const copied = docker(["cp", `${opts.agentDir}/.`, `${cid}:/workspace`], 120_000);
-        if (copied.status !== 0) {
-            return { code: null, out: `copy in failed: ${(copied.stderr ?? "").slice(-300)}` };
-        }
+        // The agent's own directory becomes /workspace… — its entries staged
+        // like the workspace paths below (a scratch copy, opened up for the
+        // script's user, one tar), minus the step's `workspace` link. A step
+        // holds that link (→ ../..) so the shell can say workspace/…, and
+        // `docker cp` refuses a link that climbs out of what it copies
+        // ("invalid symlink"), so every Docker-run script failed before it
+        // started. And `docker cp` lands files as root while scripts run as
+        // `agent`, so a script could never write its own outputs/.
+        const own = fs
+            .readdirSync(opts.agentDir)
+            .filter((name) => {
+            if (name !== "workspace")
+                return true;
+            try {
+                return !fs.lstatSync(path.join(opts.agentDir, name)).isSymbolicLink();
+            }
+            catch {
+                return false;
+            }
+        })
+            .map((name) => ({ host: path.join(opts.agentDir, name), container: `/workspace/${name}` }));
+        const copiedIn = stageIn(CLI, cid, own, ["/workspace"]);
+        if (copiedIn)
+            return { code: null, out: `copy in failed: ${copiedIn}` };
         // …and any shared directories land at their declared paths.
         for (const [host, mount] of Object.entries(opts.readOnly ?? {})) {
             if (fs.existsSync(host))
                 docker(["cp", `${host}/.`, `${cid}:${mount}`], 120_000);
         }
+        const staged = opts.staged ?? [];
+        if (staged.length) {
+            const failed = stageIn(CLI, cid, staged);
+            if (failed)
+                return { code: null, out: `copy in failed: ${failed}` };
+        }
         const result = await new Promise((resolve) => {
             const child = spawn(CLI, ["start", "-a", cid], { timeout: opts.timeoutMs });
             let out = "";
@@ -164,9 +190,93 @@ export async function runInContainer(opts) {
         });
         // Bring deliverables back so outputs/ behaves the same either way.
         docker(["cp", `${cid}:/workspace/outputs/.`, path.join(opts.agentDir, "outputs")], 120_000);
+        for (const s of staged)
+            stageBack(CLI, cid, s);
         return result;
     }
     finally {
         docker(["rm", "-f", cid], 30_000);
     }
 }
+/**
+ * Copy the staged workspace paths into a created container: one tar, built
+ * in a scratch directory that mirrors the container paths, extracted at /.
+ * A path that does not exist yet (an output the script is told to write)
+ * gets its parent directory, so the write has somewhere to land.
+ */
+function stageIn(cli, cid, staged, dirs = []) {
+    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-stage-"));
+    try {
+        for (const d of dirs)
+            fs.mkdirSync(path.join(scratch, d), { recursive: true });
+        for (const { host, container } of staged) {
+            const dest = path.join(scratch, container);
+            if (fs.existsSync(host)) {
+                fs.mkdirSync(path.dirname(dest), { recursive: true });
+                fs.cpSync(host, dest, { recursive: true, dereference: false });
+            }
+            else {
+                fs.mkdirSync(path.dirname(dest), { recursive: true });
+            }
+        }
+        // `docker cp` lands files as root and scripts run as `agent`: these are
+        // scratch copies, so open them up for the script to write into.
+        openUp(scratch);
+        const top = fs.readdirSync(scratch);
+        const r = spawnSync("sh", ["-c", 'dir="$1"; cli="$2"; dest="$3"; shift 3; tar --no-xattrs -C "$dir" -cf - -- "$@" | "$cli" cp - "$dest"', "sh", scratch, cli, `${cid}:/`, ...top], { encoding: "utf8", timeout: 120_000, env: { ...process.env, COPYFILE_DISABLE: "1" } });
+        return r.status === 0 ? null : (r.stderr ?? "").slice(-300);
+    }
+    finally {
+        fs.rmSync(scratch, { recursive: true, force: true });
+    }
+}
+/**
+ * Copy back what the script created or changed under one staged path. Files
+ * whose bytes did not change are left alone, so an input keeps its mtime —
+ * freshness checks read it.
+ */
+function stageBack(cli, cid, s) {
+    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-stage-"));
+    try {
+        const out = path.join(scratch, "x");
+        const got = spawnSync(cli, ["cp", `${cid}:${s.container}`, out], { encoding: "utf8", timeout: 120_000 });
+        if (got.status !== 0 || !fs.existsSync(out))
+            return;
+        syncChanged(out, s.host);
+    }
+    finally {
+        fs.rmSync(scratch, { recursive: true, force: true });
+    }
+}
+/** Write `from` over `to` where the bytes differ; recurse into folders. */
+export function syncChanged(from, to) {
+    const st = fs.lstatSync(from);
+    if (st.isSymbolicLink())
+        return;
+    if (st.isDirectory()) {
+        fs.mkdirSync(to, { recursive: true });
+        for (const name of fs.readdirSync(from))
+            syncChanged(path.join(from, name), path.join(to, name));
+        return;
+    }
+    const next = fs.readFileSync(from);
+    if (fs.existsSync(to) && fs.statSync(to).isFile() && fs.readFileSync(to).equals(next))
+        return;
+    fs.mkdirSync(path.dirname(to), { recursive: true });
+    fs.writeFileSync(to, next);
+}
+/** Directories 0777, files writable by all (exec bits kept): a scratch tree only. */
+function openUp(dir) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const p = path.join(dir, entry.name);
+        if (entry.isSymbolicLink())
+            continue;
+        if (entry.isDirectory()) {
+            fs.chmodSync(p, 0o777);
+            openUp(p);
+        }
+        else {
+            fs.chmodSync(p, fs.statSync(p).mode | 0o666);
+        }
+    }
+}

package/dist/src/context-tools.d.ts

@@ -1,7 +1,7 @@
 import { createSdkMcpServer } from "@anthropic-ai/claude-agent-sdk";
 import type { RunRecord } from "./store.ts";
 export interface SearchRoot {
-    /** How the agent should name the place: "knowledge/", "../../memory/". */
+    /** How the agent should name the place: "knowledge/", "workspace/memory/". */
     label: string;
     /** The directory, absolute. */
     dir: string;

package/dist/src/evals.js

@@ -30,6 +30,7 @@
 // Deterministic checks run first and cost nothing. The judge only runs if
 // they pass — no point paying a model to grade output already known to be
 // wrong.
+import { sdkEnv } from "./step-exec.js";
 import fs from "node:fs";
 import path from "node:path";
 import { deployedCommit } from "./deploy.js";
@@ -365,6 +366,8 @@ async function judge(rubric, output, model, effort) {
             tools: [],
             allowedTools: [],
             settingSources: [],
+            strictMcpConfig: true,
+            env: sdkEnv(undefined),
             maxTurns: 1,
         },
     });

package/dist/src/host-env.js

@@ -19,6 +19,11 @@
 const EXACT = new Set([
     "PATH", "HOME", "TMPDIR", "TMP", "TEMP", "LANG", "LANGUAGE",
     "TZ", "TERM", "SHELL", "USER", "LOGNAME",
+    // Where Claude Code / the Agent SDK keeps its config and session
+    // transcripts — the same kind of thing as HOME (a path, not a secret), and
+    // without it an operator cannot keep them out of the host user's
+    // ~/.claude: the box's deploy tests set it to the job's temp (2026-10-02).
+    "CLAUDE_CONFIG_DIR",
     // The host's way to the network is the child's way to the network.
     "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "no_proxy",
     "SSL_CERT_FILE", "SSL_CERT_DIR",

package/dist/src/mail.js

@@ -125,7 +125,9 @@ export function readUnsubscribeToken(token, now = Date.now()) {
     if (!payload || !sig || extra !== undefined)
         return { error: "invalid token", status: 401 };
     const want = sign(payload);
-    if (sig.length !== want.length || !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(want))) {
+    // Only base64url reaches the compare: a multibyte character would make the
+    // byte buffers differ in length, and timingSafeEqual throws on that.
+    if (!/^[A-Za-z0-9_-]+$/.test(sig) || sig.length !== want.length || !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(want))) {
         return { error: "invalid token", status: 401 };
     }
     let raw;

package/dist/src/model-credential.d.ts

@@ -0,0 +1,14 @@
+export type ModelCredentialKind = "api-key" | "auth-token" | "claude-login" | "none";
+export interface ModelCredential {
+    kind: ModelCredentialKind;
+    /** What the run record and the CLI say: which credential, by its variable. */
+    label: string;
+    /** The variables the step's Claude Code is started with. */
+    env: Record<string, string>;
+}
+export declare function resolveModelCredential(source?: Record<string, string | undefined>): ModelCredential;
+/** The line a step's trail carries, and what goes wrong when there is none. */
+export declare function credentialLine(c: ModelCredential): {
+    type: "info" | "error";
+    text: string;
+};

package/dist/src/model-credential.js

@@ -0,0 +1,58 @@
+// Which Anthropic credential a step runs on, decided once and said on the
+// record — never whatever happens to be signed in on the machine.
+//
+// In order: an API key (ANTHROPIC_API_KEY), a bearer for a gateway
+// (ANTHROPIC_AUTH_TOKEN), then a Claude login token (CLAUDE_CODE_OAUTH_TOKEN,
+// made by `claude setup-token`). Before this, an in-process step was handed
+// none of them — the host allowlist drops credentials — so Claude Code fell
+// back to the machine's own claude.ai login whatever key was set: a key the
+// CLI insisted on was checked and then ignored.
+//
+// Note on terms: Anthropic does not allow third-party products built on the
+// Agent SDK to offer claude.ai login unless Anthropic has approved it. The
+// login token is accepted here because the account owner chose to support
+// it; offering it to customers needs that approval.
+//
+// What an agent's own shell sees: Claude Code keeps CLAUDE_CODE_OAUTH_TOKEN
+// out of its Bash by itself; an API key is visible there, as it is when you
+// run Claude Code with one in your shell. Its scrub switch
+// (CLAUDE_CODE_SUBPROCESS_ENV_SCRUB) is not used: it also strips the agent's
+// own declared secrets (RESEND_API_KEY, DATAFORSEO_PASSWORD) from Bash, and on
+// Linux it refuses to start without bubblewrap. Script tools and shell
+// `verify:` never see any of these: they start from the host allowlist.
+const set = (v) => typeof v === "string" && v.trim() !== "";
+export function resolveModelCredential(source = process.env) {
+    const base = set(source.ANTHROPIC_BASE_URL) ? { ANTHROPIC_BASE_URL: source.ANTHROPIC_BASE_URL } : {};
+    if (set(source.ANTHROPIC_API_KEY)) {
+        return {
+            kind: "api-key",
+            label: "API key (ANTHROPIC_API_KEY)",
+            env: { ...base, ANTHROPIC_API_KEY: source.ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN: "" },
+        };
+    }
+    if (set(source.ANTHROPIC_AUTH_TOKEN)) {
+        return {
+            kind: "auth-token",
+            label: `bearer token (ANTHROPIC_AUTH_TOKEN)${base.ANTHROPIC_BASE_URL ? ` to ${base.ANTHROPIC_BASE_URL}` : ""}`,
+            env: { ...base, ANTHROPIC_AUTH_TOKEN: source.ANTHROPIC_AUTH_TOKEN, ANTHROPIC_API_KEY: "", CLAUDE_CODE_OAUTH_TOKEN: "" },
+        };
+    }
+    if (set(source.CLAUDE_CODE_OAUTH_TOKEN)) {
+        return {
+            kind: "claude-login",
+            label: "Claude login token (CLAUDE_CODE_OAUTH_TOKEN)",
+            env: { ...base, CLAUDE_CODE_OAUTH_TOKEN: source.CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY: "" },
+        };
+    }
+    return { kind: "none", label: "none set", env: {} };
+}
+/** The line a step's trail carries, and what goes wrong when there is none. */
+export function credentialLine(c) {
+    if (c.kind !== "none")
+        return { type: "info", text: `model credential: ${c.label}` };
+    return {
+        type: "error",
+        text: "model credential: none set — Claude Code will fall back to whatever login this machine has, if any. " +
+            "Set ANTHROPIC_API_KEY, or CLAUDE_CODE_OAUTH_TOKEN from `claude setup-token`",
+    };
+}

package/dist/src/run-container.d.ts

@@ -271,7 +271,7 @@ export declare const RETRY_SH = "retry() { what=$1; shift; n=1; until \"$@\"; do
  *  The digest names the multi-arch index, so the one pin serves amd64 and
  *  arm64 alike. */
 export declare const NODE_BASE = "node:22-trixie-slim@sha256:b26b04c123d9ff8ab646ceb18b9d75a1173acf64b9a401094b906d27b29338d4";
-export declare const DOCKERFILE = "FROM node:22-trixie-slim@sha256:b26b04c123d9ff8ab646ceb18b9d75a1173acf64b9a401094b906d27b29338d4 AS base\nRUN apt-get update \\\n && apt-get install -y --no-install-recommends python3 python3-venv ca-certificates bash util-linux tar openssh-client sshpass git curl \\\n && rm -rf /var/lib/apt/lists/* \\\n && useradd -m -u 10001 agent\n# uv builds the declared python environments (runtime.ts): a fraction of\n# pip's time, and it can fetch a pinned python the image does not carry.\nCOPY --from=ghcr.io/astral-sh/uv:0.11.25 /uv /uvx /usr/local/bin/\nENV PLAYWRIGHT_BROWSERS_PATH=/opt/browser NODE_PATH=/usr/local/lib/node_modules\n\nFROM base AS slim\n# Fonts, because a step that draws text without a browser still needs them:\n# the full image gets 51 from Playwright's --with-deps, slim had none, so from\n# 2026-09-29 (when non-browsing steps moved to slim) every resvg/sharp diagram\n# rendered its labels as empty boxes \u2014 expert-witness-desk's validator failed\n# four passes on a post image that was \"three empty boxes\". DejaVu covers\n# Latin, Greek and Cyrillic in a few MB; fontconfig is how renderers find it.\n# DejaVu alone still drew emoji, Chinese, Japanese, Korean, Devanagari and\n# Thai as empty boxes (reproduced 2026-10-01 with resvg-js 2.6 and sharp\n# 0.34), so four more, the smallest set that drew all of them \u2014 8 MB:\n#   Symbola     emoji and symbols, as outlines. NOT Noto Color Emoji (10 MB):\n#               resvg draws nothing from its bitmap glyphs, so a resvg\n#               diagram kept its empty boxes.\n#   WenQuanYi Micro Hei   Chinese, Japanese kana and Korean Hangul, one file.\n#   Lohit Devanagari, Loma   Hindi and Thai.\n# Here, not in base, so the full image's browser layers stay cached.\nRUN apt-get update \\\n && apt-get install -y --no-install-recommends fonts-dejavu-core fontconfig fonts-symbola fonts-wqy-microhei fonts-lohit-deva fonts-tlwg-loma-otf \\\n && rm -rf /var/lib/apt/lists/* \\\n && fc-cache -f >/dev/null\n# The Playwright client only, the same pinned version as the browser pod's\n# server (the wire protocol is version-locked), so a tool that imports it\n# still loads; there is nothing here for it to launch.\n# npm's download cache is dropped in the same layer: it was 190 MB of every\n# image, read by nothing after the build.\nRUN npm install -g playwright@1.63.0 axe-core@4.13.0 >/dev/null && npm cache clean --force >/dev/null 2>&1\nWORKDIR /opt/runner\nCOPY foldrun-core.tgz driver.mjs entry.sh ./\nRUN npm init -y >/dev/null && npm install ./foldrun-core.tgz --omit=dev \\\n && npm cache clean --force >/dev/null 2>&1 \\\n && mkdir -p /workspace /library /opt/runner/job /home/agent/.foldrun/runner/.runtimes /opt/foldrun-runtimes/shared/.runtimes \\\n && chown -R agent:agent /workspace /library /opt/runner /home/agent/.foldrun /opt/foldrun-runtimes \\\n && chmod +x /opt/runner/entry.sh\nENTRYPOINT [\"/opt/runner/entry.sh\"]\n\nFROM base AS browsers\n# Real browsers, because directories and portals increasingly render with\n# JavaScript and a plain fetch sees only the empty shell. Chromium is the one the\n# browser tool drives by default; Firefox and WebKit (Safari's engine) are\n# there for an agent asked to see a page the way those render it. Installed\n# to a fixed path the agent user can read (the default cache would be\n# root's HOME). The browsers' own sandboxes are disabled at launch time \u2014 in\n# this platform the container/gVisor IS the sandbox, and the two fight.\n# Pinned exactly, not @1: web browse's numbered elements use ariaSnapshot's\n# \"ai\" mode (1.59+), and the per-account browser pod runs this same image, so\n# a floating version would move both under a working tool on any rebuild.\n# Raise it on purpose, with the gallery tests and one real call.\n# axe-core beside it is web browse's mode=a11y: one file the tool injects\n# into the page; without it the mode falls back to its own shorter checks.\n# Xvfb by name: the browser pod starts it at boot and web browse starts one\n# per call for headless: false. It used to arrive only as one of Playwright's\n# --with-deps packages, so a Playwright bump that dropped it would have\n# broken every windowed browser without a word. No xauth: nothing here runs\n# xvfb-run, and Xvfb started without -auth takes the local client as it is.\nRUN apt-get update \\\n && apt-get install -y --no-install-recommends xvfb \\\n && rm -rf /var/lib/apt/lists/*\n# Google Chrome and Chrome beta come from Google's apt repository, which\n# Playwright adds; each is tried ENGINE_DOWNLOAD_ATTEMPTS times. Only on\n# x86_64: Google ships no Linux Chrome for arm64, so there it is not tried.\nRUN npm install -g playwright@1.63.0 axe-core@4.13.0 >/dev/null \\\n && playwright install --with-deps chromium firefox webkit >/dev/null \\\n && retry() { what=$1; shift; n=1; until \"$@\"; do if [ \"$n\" -ge 3 ]; then echo \"runner image: $what - download failed $n times, giving up\" >&2; return 1; fi; echo \"runner image: $what - download failed (attempt $n of 3), retrying in $((n * 15))s\" >&2; sleep $((n * 15)); n=$((n + 1)); done; } \\\n && if [ \"$(uname -m)\" = x86_64 ]; then \\\n      retry chrome playwright install --with-deps chrome >/dev/null || echo \"runner image: chrome not installed - engine: chrome would fall back to chromium\" >&2; \\\n      retry chrome-beta playwright install --with-deps chrome-beta >/dev/null || echo \"runner image: chrome-beta not installed\" >&2; \\\n    else echo \"runner image: no Google Chrome for $(uname -m) - engine: chrome falls back to chromium\"; fi \\\n && chmod -R a+rX /opt/browser \\\n && npm cache clean --force >/dev/null 2>&1\n# Lightpanda (engine: lightpanda): a browser that runs the JavaScript and\n# never draws \u2014 a fraction of Chromium's memory for reading and filling\n# pages. Its own program, which web browse starts beside a call and drives\n# over the DevTools protocol; shipped unmodified (AGPL-3.0). Pinned by\n# checksum (GitHub's own asset digests, checked again here). 0.4.1 since the\n# move to Debian 13: 0.3.7 on wants glibc 2.38, and Debian 12's 2.36 held it\n# at 0.3.6. An arch without a build leaves the engine out, and the tool says\n# so when asked for it. Each download (with its checksum) is tried\n# ENGINE_DOWNLOAD_ATTEMPTS times before the engine is left out.\n# Raise it on purpose: the new release's two sha256s, then one\n# engine=lightpanda call on each arch.\nRUN arch=$(uname -m) \\\n && case \"$arch\" in \\\n      x86_64) sum=1d40801e72c0bc61b2cbd3f3562bcfc46de7b79e0568f33f686b64f2e587610a ;; \\\n      aarch64) sum=664775c7f5ab69cc3189954c7f9345e25c167cb4dace016173e629f9a5e82c42 ;; \\\n      *) sum= ;; \\\n    esac \\\n && mkdir -p /opt/browser/lightpanda \\\n && retry() { what=$1; shift; n=1; until \"$@\"; do if [ \"$n\" -ge 3 ]; then echo \"runner image: $what - download failed $n times, giving up\" >&2; return 1; fi; echo \"runner image: $what - download failed (attempt $n of 3), retrying in $((n * 15))s\" >&2; sleep $((n * 15)); n=$((n + 1)); done; } \\\n && fetch() { curl -fsSL -o /opt/browser/lightpanda/lightpanda \"https://github.com/lightpanda-io/browser/releases/download/0.4.1/lightpanda-$arch-linux\" \\\n      && echo \"$sum  /opt/browser/lightpanda/lightpanda\" | sha256sum -c - >/dev/null; } \\\n && if [ -n \"$sum\" ] && retry lightpanda fetch; then \\\n      chmod a+rx /opt/browser/lightpanda/lightpanda && /opt/browser/lightpanda/lightpanda version; \\\n    else rm -f /opt/browser/lightpanda/lightpanda; echo \"runner image: lightpanda not installed for $arch - engine: lightpanda says so when asked\" >&2; fi\n# Obscura (engine: obscura): a headless browser in Rust around V8 that does\n# draw \u2014 screenshots, a raster PDF, a screencast \u2014 light like Lightpanda.\n# Apache-2.0. The plain build, not -stealth: this platform does not help a\n# page not see automation. Two binaries, obscura and obscura-worker, which\n# must sit side by side. Pinned by checksum; glibc 2.35 is its floor, so\n# Debian 13 (2.41) runs it. As above, a download is tried\n# ENGINE_DOWNLOAD_ATTEMPTS times, then a failed one leaves the engine out.\nRUN arch=$(uname -m) \\\n && case \"$arch\" in \\\n      x86_64) sum=1534d1e6ddaf3d080ec4091eb41d0a4d8cc042a48b607d3c410fc13b482a9eec ;; \\\n      aarch64) sum=5ecf980bca3060236a7a86ec7ed83d943e6598ee87caa46d20325d90bc75f979 ;; \\\n      *) sum= ;; \\\n    esac \\\n && mkdir -p /opt/browser/obscura \\\n && retry() { what=$1; shift; n=1; until \"$@\"; do if [ \"$n\" -ge 3 ]; then echo \"runner image: $what - download failed $n times, giving up\" >&2; return 1; fi; echo \"runner image: $what - download failed (attempt $n of 3), retrying in $((n * 15))s\" >&2; sleep $((n * 15)); n=$((n + 1)); done; } \\\n && fetch() { curl -fsSL -o /tmp/obscura.tgz \"https://github.com/h4ckf0r0day/obscura/releases/download/v0.2.3/obscura-$arch-linux.tar.gz\" \\\n      && echo \"$sum  /tmp/obscura.tgz\" | sha256sum -c - >/dev/null; } \\\n && if [ -n \"$sum\" ] && retry obscura fetch \\\n      && tar -xzf /tmp/obscura.tgz -C /opt/browser/obscura obscura obscura-worker; then \\\n      chmod a+rx /opt/browser/obscura/obscura /opt/browser/obscura/obscura-worker && /opt/browser/obscura/obscura --version; \\\n    else rm -rf /opt/browser/obscura/*; echo \"runner image: obscura not installed for $arch - engine: obscura says so when asked\" >&2; fi \\\n && rm -f /tmp/obscura.tgz\n# What this image actually has, written down: /opt/browser/engines.json, one\n# entry per engine (its path and version, or null when the install above\n# left it out) plus Xvfb. Chromium's version is its own --version (dotted,\n# so FOLDRUN_RUNNER_ENGINES carries it: a pinned user_agent on engine\n# chromium is compared with it, not with Google Chrome's) then the build.\n# web browse reads it for its \"built without\" answer, and the deploy reads\n# it to report the engines beside the version.\n# On x86_64 a missing engine FAILS the build: every engine ships for that\n# arch, so a gap there is a failed download, and an image that quietly lacks\n# the Chrome or Lightpanda a desk names would fail those runs instead. A\n# failed build leaves the previous image running and says why. Elsewhere\n# (arm64 has no Google Chrome) the gap is recorded and the image ships.\nRUN node -e ' \\\n  const fs = require(\"fs\"), cp = require(\"child_process\"), pw = require(\"playwright\"); \\\n  const at = (p) => (p && fs.existsSync(p) ? p : null); \\\n  const ver = (bin, args) => { try { return cp.execFileSync(bin, args, { timeout: 30000, stdio: [\"ignore\", \"pipe\", \"ignore\"] }).toString().trim().split(\"\\n\")[0] || null; } catch { return null; } }; \\\n  const one = (p, v) => (p ? { path: p, version: v } : null); \\\n  const pwBuild = (p) => (p ? (p.match(/(chromium|firefox|webkit)-(\\d+)/) || [])[0] || null : null); \\\n  const lp = at(\"/opt/browser/lightpanda/lightpanda\"); \\\n  const cr = at(pw.chromium.executablePath()); \\\n  const ob = at(\"/opt/browser/obscura/obscura-worker\") && at(\"/opt/browser/obscura/obscura\"); \\\n  const engines = { \\\n    chromium: one(cr, cr && [ver(cr, [\"--version\"]), pwBuild(cr)].filter(Boolean).join(\" \")), \\\n    chrome: one(at(\"/opt/google/chrome/chrome\"), ver(\"/opt/google/chrome/chrome\", [\"--version\"])), \\\n    \"chrome-beta\": one(at(\"/opt/google/chrome-beta/chrome\"), ver(\"/opt/google/chrome-beta/chrome\", [\"--version\"])), \\\n    firefox: one(at(pw.firefox.executablePath()), pwBuild(pw.firefox.executablePath())), \\\n    webkit: one(at(pw.webkit.executablePath()), pwBuild(pw.webkit.executablePath())), \\\n    lightpanda: one(lp, lp && ver(lp, [\"version\"])), \\\n    obscura: one(ob, ob && ver(ob, [\"--version\"])), \\\n  }; \\\n  const xvfb = ver(\"sh\", [\"-c\", \"command -v Xvfb\"]); \\\n  const arch = cp.execFileSync(\"uname\", [\"-m\"]).toString().trim(); \\\n  const manifest = { arch, playwright: require(\"playwright/package.json\").version, engines, xvfb }; \\\n  fs.writeFileSync(\"/opt/browser/engines.json\", JSON.stringify(manifest, null, 2) + \"\\n\"); \\\n  console.log(JSON.stringify(manifest)); \\\n  const missing = [\"chromium\", \"chrome\", \"firefox\", \"webkit\", \"lightpanda\", \"obscura\"].filter((e) => !engines[e]).concat(xvfb ? [] : [\"Xvfb\"]); \\\n  if (missing.length && arch === \"x86_64\") { \\\n    console.error(\"runner image: MISSING ENGINES on x86_64: \" + missing.join(\", \")); \\\n    console.error(\"runner image: every engine ships for x86_64, so a missing one is a failed download (the retry lines above say which) - failing the build\"); \\\n    process.exit(1); \\\n  } \\\n  if (missing.length) console.error(\"runner image: built without \" + missing.join(\", \") + \" on \" + arch); \\\n ' \\\n && chmod a+r /opt/browser/engines.json\n\nFROM browsers AS full\nWORKDIR /opt/runner\nCOPY foldrun-core.tgz driver.mjs entry.sh ./\nRUN npm init -y >/dev/null && npm install ./foldrun-core.tgz --omit=dev \\\n && npm cache clean --force >/dev/null 2>&1 \\\n && mkdir -p /workspace /library /opt/runner/job /home/agent/.foldrun/runner/.runtimes /opt/foldrun-runtimes/shared/.runtimes \\\n && chown -R agent:agent /workspace /library /opt/runner /home/agent/.foldrun /opt/foldrun-runtimes \\\n && chmod +x /opt/runner/entry.sh\nENTRYPOINT [\"/opt/runner/entry.sh\"]\n";
+export declare const DOCKERFILE = "FROM node:22-trixie-slim@sha256:b26b04c123d9ff8ab646ceb18b9d75a1173acf64b9a401094b906d27b29338d4 AS base\nRUN apt-get update \\\n && apt-get install -y --no-install-recommends python3 python3-venv ca-certificates bash util-linux tar openssh-client sshpass git curl \\\n && rm -rf /var/lib/apt/lists/* \\\n && useradd -m -u 10001 agent\n# uv builds the declared python environments (runtime.ts): a fraction of\n# pip's time, and it can fetch a pinned python the image does not carry.\nCOPY --from=ghcr.io/astral-sh/uv:0.11.25 /uv /uvx /usr/local/bin/\nENV PLAYWRIGHT_BROWSERS_PATH=/opt/browser NODE_PATH=/usr/local/lib/node_modules\n\nFROM base AS core\nWORKDIR /opt/runner\nCOPY foldrun-core.tgz ./\nRUN npm init -y >/dev/null && npm install ./foldrun-core.tgz --omit=dev \\\n && npm cache clean --force >/dev/null 2>&1 \\\n && rm -f foldrun-core.tgz node_modules/@foldrun/core/README.md\n\nFROM base AS slim\n# Fonts, because a step that draws text without a browser still needs them:\n# the full image gets 51 from Playwright's --with-deps, slim had none, so from\n# 2026-09-29 (when non-browsing steps moved to slim) every resvg/sharp diagram\n# rendered its labels as empty boxes \u2014 expert-witness-desk's validator failed\n# four passes on a post image that was \"three empty boxes\". DejaVu covers\n# Latin, Greek and Cyrillic in a few MB; fontconfig is how renderers find it.\n# DejaVu alone still drew emoji, Chinese, Japanese, Korean, Devanagari and\n# Thai as empty boxes (reproduced 2026-10-01 with resvg-js 2.6 and sharp\n# 0.34), so four more, the smallest set that drew all of them \u2014 8 MB:\n#   Symbola     emoji and symbols, as outlines. NOT Noto Color Emoji (10 MB):\n#               resvg draws nothing from its bitmap glyphs, so a resvg\n#               diagram kept its empty boxes.\n#   WenQuanYi Micro Hei   Chinese, Japanese kana and Korean Hangul, one file.\n#   Lohit Devanagari, Loma   Hindi and Thai.\n# Here, not in base, so the full image's browser layers stay cached.\nRUN apt-get update \\\n && apt-get install -y --no-install-recommends fonts-dejavu-core fontconfig fonts-symbola fonts-wqy-microhei fonts-lohit-deva fonts-tlwg-loma-otf \\\n && rm -rf /var/lib/apt/lists/* \\\n && fc-cache -f >/dev/null\n# The Playwright client only, the same pinned version as the browser pod's\n# server (the wire protocol is version-locked), so a tool that imports it\n# still loads; there is nothing here for it to launch.\n# npm's download cache is dropped in the same layer: it was 190 MB of every\n# image, read by nothing after the build.\nRUN npm install -g playwright@1.63.0 axe-core@4.13.0 >/dev/null && npm cache clean --force >/dev/null 2>&1\nWORKDIR /opt/runner\nCOPY --from=core --chown=agent:agent /opt/runner/ ./\nCOPY --chown=agent:agent driver.mjs entry.sh ./\nRUN mkdir -p /workspace /library /opt/runner/job /home/agent/.foldrun/runner/.runtimes /opt/foldrun-runtimes/shared/.runtimes \\\n && chown agent:agent /opt/runner \\\n && chown -R agent:agent /workspace /library /opt/runner/job /home/agent/.foldrun /opt/foldrun-runtimes \\\n && chmod +x /opt/runner/entry.sh\nENTRYPOINT [\"/opt/runner/entry.sh\"]\n\nFROM base AS browsers\n# Real browsers, because directories and portals increasingly render with\n# JavaScript and a plain fetch sees only the empty shell. Chromium is the one the\n# browser tool drives by default; Firefox and WebKit (Safari's engine) are\n# there for an agent asked to see a page the way those render it. Installed\n# to a fixed path the agent user can read (the default cache would be\n# root's HOME). The browsers' own sandboxes are disabled at launch time \u2014 in\n# this platform the container/gVisor IS the sandbox, and the two fight.\n# Pinned exactly, not @1: web browse's numbered elements use ariaSnapshot's\n# \"ai\" mode (1.59+), and the per-account browser pod runs this same image, so\n# a floating version would move both under a working tool on any rebuild.\n# Raise it on purpose, with the gallery tests and one real call.\n# axe-core beside it is web browse's mode=a11y: one file the tool injects\n# into the page; without it the mode falls back to its own shorter checks.\n# Xvfb by name: the browser pod starts it at boot and web browse starts one\n# per call for headless: false. It used to arrive only as one of Playwright's\n# --with-deps packages, so a Playwright bump that dropped it would have\n# broken every windowed browser without a word. No xauth: nothing here runs\n# xvfb-run, and Xvfb started without -auth takes the local client as it is.\nRUN apt-get update \\\n && apt-get install -y --no-install-recommends xvfb \\\n && rm -rf /var/lib/apt/lists/*\n# Google Chrome and Chrome beta come from Google's apt repository, which\n# Playwright adds; each is tried ENGINE_DOWNLOAD_ATTEMPTS times. Only on\n# x86_64: Google ships no Linux Chrome for arm64, so there it is not tried.\nRUN npm install -g playwright@1.63.0 axe-core@4.13.0 >/dev/null \\\n && playwright install --with-deps chromium firefox webkit >/dev/null \\\n && retry() { what=$1; shift; n=1; until \"$@\"; do if [ \"$n\" -ge 3 ]; then echo \"runner image: $what - download failed $n times, giving up\" >&2; return 1; fi; echo \"runner image: $what - download failed (attempt $n of 3), retrying in $((n * 15))s\" >&2; sleep $((n * 15)); n=$((n + 1)); done; } \\\n && if [ \"$(uname -m)\" = x86_64 ]; then \\\n      retry chrome playwright install --with-deps chrome >/dev/null || echo \"runner image: chrome not installed - engine: chrome would fall back to chromium\" >&2; \\\n      retry chrome-beta playwright install --with-deps chrome-beta >/dev/null || echo \"runner image: chrome-beta not installed\" >&2; \\\n    else echo \"runner image: no Google Chrome for $(uname -m) - engine: chrome falls back to chromium\"; fi \\\n && chmod -R a+rX /opt/browser \\\n && npm cache clean --force >/dev/null 2>&1\n# Lightpanda (engine: lightpanda): a browser that runs the JavaScript and\n# never draws \u2014 a fraction of Chromium's memory for reading and filling\n# pages. Its own program, which web browse starts beside a call and drives\n# over the DevTools protocol; shipped unmodified (AGPL-3.0). Pinned by\n# checksum (GitHub's own asset digests, checked again here). 0.4.1 since the\n# move to Debian 13: 0.3.7 on wants glibc 2.38, and Debian 12's 2.36 held it\n# at 0.3.6. An arch without a build leaves the engine out, and the tool says\n# so when asked for it. Each download (with its checksum) is tried\n# ENGINE_DOWNLOAD_ATTEMPTS times before the engine is left out.\n# Raise it on purpose: the new release's two sha256s, then one\n# engine=lightpanda call on each arch.\nRUN arch=$(uname -m) \\\n && case \"$arch\" in \\\n      x86_64) sum=1d40801e72c0bc61b2cbd3f3562bcfc46de7b79e0568f33f686b64f2e587610a ;; \\\n      aarch64) sum=664775c7f5ab69cc3189954c7f9345e25c167cb4dace016173e629f9a5e82c42 ;; \\\n      *) sum= ;; \\\n    esac \\\n && mkdir -p /opt/browser/lightpanda \\\n && retry() { what=$1; shift; n=1; until \"$@\"; do if [ \"$n\" -ge 3 ]; then echo \"runner image: $what - download failed $n times, giving up\" >&2; return 1; fi; echo \"runner image: $what - download failed (attempt $n of 3), retrying in $((n * 15))s\" >&2; sleep $((n * 15)); n=$((n + 1)); done; } \\\n && fetch() { curl -fsSL -o /opt/browser/lightpanda/lightpanda \"https://github.com/lightpanda-io/browser/releases/download/0.4.1/lightpanda-$arch-linux\" \\\n      && echo \"$sum  /opt/browser/lightpanda/lightpanda\" | sha256sum -c - >/dev/null; } \\\n && if [ -n \"$sum\" ] && retry lightpanda fetch; then \\\n      chmod a+rx /opt/browser/lightpanda/lightpanda && /opt/browser/lightpanda/lightpanda version; \\\n    else rm -f /opt/browser/lightpanda/lightpanda; echo \"runner image: lightpanda not installed for $arch - engine: lightpanda says so when asked\" >&2; fi\n# Obscura (engine: obscura): a headless browser in Rust around V8 that does\n# draw \u2014 screenshots, a raster PDF, a screencast \u2014 light like Lightpanda.\n# Apache-2.0. The plain build, not -stealth: this platform does not help a\n# page not see automation. Two binaries, obscura and obscura-worker, which\n# must sit side by side. Pinned by checksum; glibc 2.35 is its floor, so\n# Debian 13 (2.41) runs it. As above, a download is tried\n# ENGINE_DOWNLOAD_ATTEMPTS times, then a failed one leaves the engine out.\nRUN arch=$(uname -m) \\\n && case \"$arch\" in \\\n      x86_64) sum=1534d1e6ddaf3d080ec4091eb41d0a4d8cc042a48b607d3c410fc13b482a9eec ;; \\\n      aarch64) sum=5ecf980bca3060236a7a86ec7ed83d943e6598ee87caa46d20325d90bc75f979 ;; \\\n      *) sum= ;; \\\n    esac \\\n && mkdir -p /opt/browser/obscura \\\n && retry() { what=$1; shift; n=1; until \"$@\"; do if [ \"$n\" -ge 3 ]; then echo \"runner image: $what - download failed $n times, giving up\" >&2; return 1; fi; echo \"runner image: $what - download failed (attempt $n of 3), retrying in $((n * 15))s\" >&2; sleep $((n * 15)); n=$((n + 1)); done; } \\\n && fetch() { curl -fsSL -o /tmp/obscura.tgz \"https://github.com/h4ckf0r0day/obscura/releases/download/v0.2.3/obscura-$arch-linux.tar.gz\" \\\n      && echo \"$sum  /tmp/obscura.tgz\" | sha256sum -c - >/dev/null; } \\\n && if [ -n \"$sum\" ] && retry obscura fetch \\\n      && tar -xzf /tmp/obscura.tgz -C /opt/browser/obscura obscura obscura-worker; then \\\n      chmod a+rx /opt/browser/obscura/obscura /opt/browser/obscura/obscura-worker && /opt/browser/obscura/obscura --version; \\\n    else rm -rf /opt/browser/obscura/*; echo \"runner image: obscura not installed for $arch - engine: obscura says so when asked\" >&2; fi \\\n && rm -f /tmp/obscura.tgz\n# What this image actually has, written down: /opt/browser/engines.json, one\n# entry per engine (its path and version, or null when the install above\n# left it out) plus Xvfb. Chromium's version is its own --version (dotted,\n# so FOLDRUN_RUNNER_ENGINES carries it: a pinned user_agent on engine\n# chromium is compared with it, not with Google Chrome's) then the build.\n# web browse reads it for its \"built without\" answer, and the deploy reads\n# it to report the engines beside the version.\n# On x86_64 a missing engine FAILS the build: every engine ships for that\n# arch, so a gap there is a failed download, and an image that quietly lacks\n# the Chrome or Lightpanda a desk names would fail those runs instead. A\n# failed build leaves the previous image running and says why. Elsewhere\n# (arm64 has no Google Chrome) the gap is recorded and the image ships.\nRUN node -e ' \\\n  const fs = require(\"fs\"), cp = require(\"child_process\"), pw = require(\"playwright\"); \\\n  const at = (p) => (p && fs.existsSync(p) ? p : null); \\\n  const ver = (bin, args) => { try { return cp.execFileSync(bin, args, { timeout: 30000, stdio: [\"ignore\", \"pipe\", \"ignore\"] }).toString().trim().split(\"\\n\")[0] || null; } catch { return null; } }; \\\n  const one = (p, v) => (p ? { path: p, version: v } : null); \\\n  const pwBuild = (p) => (p ? (p.match(/(chromium|firefox|webkit)-(\\d+)/) || [])[0] || null : null); \\\n  const lp = at(\"/opt/browser/lightpanda/lightpanda\"); \\\n  const cr = at(pw.chromium.executablePath()); \\\n  const ob = at(\"/opt/browser/obscura/obscura-worker\") && at(\"/opt/browser/obscura/obscura\"); \\\n  const engines = { \\\n    chromium: one(cr, cr && [ver(cr, [\"--version\"]), pwBuild(cr)].filter(Boolean).join(\" \")), \\\n    chrome: one(at(\"/opt/google/chrome/chrome\"), ver(\"/opt/google/chrome/chrome\", [\"--version\"])), \\\n    \"chrome-beta\": one(at(\"/opt/google/chrome-beta/chrome\"), ver(\"/opt/google/chrome-beta/chrome\", [\"--version\"])), \\\n    firefox: one(at(pw.firefox.executablePath()), pwBuild(pw.firefox.executablePath())), \\\n    webkit: one(at(pw.webkit.executablePath()), pwBuild(pw.webkit.executablePath())), \\\n    lightpanda: one(lp, lp && ver(lp, [\"version\"])), \\\n    obscura: one(ob, ob && ver(ob, [\"--version\"])), \\\n  }; \\\n  const xvfb = ver(\"sh\", [\"-c\", \"command -v Xvfb\"]); \\\n  const arch = cp.execFileSync(\"uname\", [\"-m\"]).toString().trim(); \\\n  const manifest = { arch, playwright: require(\"playwright/package.json\").version, engines, xvfb }; \\\n  fs.writeFileSync(\"/opt/browser/engines.json\", JSON.stringify(manifest, null, 2) + \"\\n\"); \\\n  console.log(JSON.stringify(manifest)); \\\n  const missing = [\"chromium\", \"chrome\", \"firefox\", \"webkit\", \"lightpanda\", \"obscura\"].filter((e) => !engines[e]).concat(xvfb ? [] : [\"Xvfb\"]); \\\n  if (missing.length && arch === \"x86_64\") { \\\n    console.error(\"runner image: MISSING ENGINES on x86_64: \" + missing.join(\", \")); \\\n    console.error(\"runner image: every engine ships for x86_64, so a missing one is a failed download (the retry lines above say which) - failing the build\"); \\\n    process.exit(1); \\\n  } \\\n  if (missing.length) console.error(\"runner image: built without \" + missing.join(\", \") + \" on \" + arch); \\\n ' \\\n && chmod a+r /opt/browser/engines.json\n\nFROM browsers AS full\nWORKDIR /opt/runner\nCOPY --from=core --chown=agent:agent /opt/runner/ ./\nCOPY --chown=agent:agent driver.mjs entry.sh ./\nRUN mkdir -p /workspace /library /opt/runner/job /home/agent/.foldrun/runner/.runtimes /opt/foldrun-runtimes/shared/.runtimes \\\n && chown agent:agent /opt/runner \\\n && chown -R agent:agent /workspace /library /opt/runner/job /home/agent/.foldrun /opt/foldrun-runtimes \\\n && chmod +x /opt/runner/entry.sh\nENTRYPOINT [\"/opt/runner/entry.sh\"]\n";
 /** Which build target of the runner image (see DOCKERFILE). */
 export type RunnerVariant = "full" | "slim";
 export declare function runnerImageTag(variant?: RunnerVariant): string;

package/dist/src/run-container.js

@@ -23,7 +23,7 @@ import path from "node:path";
 import crypto from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
 import { isPlatformPath } from "./store.js";
-import { divertedSummary, isDivertedPath } from "./test-mode.js";
+import { divertedSummary, isDivertedPath, overlayTestWrites } from "./test-mode.js";
 import { isFileValue, fileContent } from "./secrets.js";
 import { safeTenantSegment } from "./runtime.js";
 import { isOperatorEvent } from "./operator.js";
@@ -489,7 +489,7 @@ try {
     // through the account's pod, and named the file the web tool logs its
     // reconnects to. A lost pod stops the step; what it wrote decides what
     // the runner does next (browser-pod.ts).
-    ...(env.FOLDRUN_BROWSER_POD_EVENTS ? { browserPod: { events: env.FOLDRUN_BROWSER_POD_EVENTS, methods: api.methods ?? {}, paidWeb: paidWebActions(env) } } : {}),
+    ...(env.FOLDRUN_BROWSER_POD_EVENTS ? { browserPod: { events: env.FOLDRUN_BROWSER_POD_EVENTS, methods: api.methods ?? {}, paidWeb: paidWebActions(env), ...(env.FOLDRUN_BROWSER_INIT ? { browseInit: env.FOLDRUN_BROWSER_INIT } : {}) } } : {}),
     // The container is the boundary; the SDK's own bash sandbox here would
     // only block declared network use (SSH, curl) for no added safety.
     sandboxBash: false,
@@ -518,17 +518,29 @@ try {
   process.exit(0);
 }
 `;
+// Core itself is installed in a stage of its own (CORE_STAGE) and only the
+// result is copied in: the tarball and the package README — which explains
+// foldrun to a person reading the repo, and which no step reads — stay in
+// that stage and never become a layer of the image. Owner rule, 2026-10-02:
+// foldrun's own docs live in git, not in containers.
+const CORE_STAGE = `FROM base AS core
+WORKDIR /opt/runner
+COPY foldrun-core.tgz ./
+RUN npm init -y >/dev/null && npm install ./foldrun-core.tgz --omit=dev \\
+ && npm cache clean --force >/dev/null 2>&1 \\
+ && rm -f foldrun-core.tgz node_modules/@foldrun/core/README.md
+`;
 // docker cp writes root-owned files, so the entrypoint starts as root for
 // exactly two commands — chown the copied-in trees, drop to the agent user —
 // and the run flags grant only the three capabilities those two commands
 // need. By the time any model-directed code executes, the process is uid
 // 10001 with no capabilities at all.
 const CORE_INSTALL = `WORKDIR /opt/runner
-COPY foldrun-core.tgz driver.mjs entry.sh ./
-RUN npm init -y >/dev/null && npm install ./foldrun-core.tgz --omit=dev \\
- && npm cache clean --force >/dev/null 2>&1 \\
- && mkdir -p /workspace /library /opt/runner/job ${RUNTIME_CACHE} ${SHARED_RUNTIMES} \\
- && chown -R agent:agent /workspace /library /opt/runner /home/agent/.foldrun /opt/foldrun-runtimes \\
+COPY --from=core --chown=agent:agent /opt/runner/ ./
+COPY --chown=agent:agent driver.mjs entry.sh ./
+RUN mkdir -p /workspace /library /opt/runner/job ${RUNTIME_CACHE} ${SHARED_RUNTIMES} \\
+ && chown agent:agent /opt/runner \\
+ && chown -R agent:agent /workspace /library /opt/runner/job /home/agent/.foldrun /opt/foldrun-runtimes \\
  && chmod +x /opt/runner/entry.sh
 ENTRYPOINT ["/opt/runner/entry.sh"]
 `;
@@ -590,6 +602,7 @@ RUN apt-get update \\
 COPY --from=ghcr.io/astral-sh/uv:${UV_VERSION} /uv /uvx /usr/local/bin/
 ENV PLAYWRIGHT_BROWSERS_PATH=/opt/browser NODE_PATH=/usr/local/lib/node_modules
 
+${CORE_STAGE}
 FROM base AS slim
 # Fonts, because a step that draws text without a browser still needs them:
 # the full image gets 51 from Playwright's --with-deps, slim had none, so from
@@ -1100,6 +1113,13 @@ export async function runStepInContainer(args) {
             preserveTimestamps: true,
             filter: (src) => !isPlatformPath(path.relative(args.workspaceRoot, src)),
         });
+        // A test run: what its earlier steps wrote, over the real files (the
+        // copy is the baseline too, so only this step's own writes come back).
+        if (args.divert) {
+            const laid = overlayTestWrites(wsIn, args.divert.to);
+            if (laid.length)
+                args.emit("info", `test: this step sees ${laid.length} file${laid.length === 1 ? "" : "s"} earlier steps of this run wrote`);
+        }
         const libIn = path.join(staging, "library");
         if (args.galleryRoot && fs.existsSync(args.galleryRoot))
             fs.cpSync(args.galleryRoot, libIn, { recursive: true });