@foldrun/core 0.5.0 → 0.6.0

package/dist/src/runner.d.ts

@@ -1,6 +1,7 @@
 import { type SubagentSpec } from "./subagents.ts";
 import { type FlowStep, type RunRecord, type StepRecord } from "./store.ts";
 import { type Catalog } from "./catalog.ts";
+import { type ScriptSpec } from "./script-tools.ts";
 import { type RuntimeSpec } from "./runtime.ts";
 import { type LanguageChoice } from "./language.ts";
 import { type RegionChoice } from "./locale.ts";
@@ -408,3 +409,37 @@ export declare function waitForRun(tenant: string, workspace: string, runId: str
  * nothing is what makes `?wait=true` useful rather than merely blocking.
  */
 export declare function runResult(run: RunRecord): string | null;
+/**
+ * What a Docker-run script sees of the workspace and the account: their
+ * scripts/ and their tools/, read-only. A folder tool's code lives in its
+ * tools/<name>/ folder, not in scripts/ — without those two mounts every
+ * folder tool (the hello template's wordcount among them) was handed a host
+ * path the container did not have, and failed on every call. A gallery tool
+ * nobody installed runs from the gallery's own shelf, so that is mounted too
+ * when there is one. A folder that does not exist is skipped by the copy.
+ */
+export declare function scriptMounts(agentDir: string, tenant: string): Record<string, string>;
+/**
+ * The skills an agent can see, nearest first, each with the path the agent
+ * is told to read it at. Own skills, then the workspace's, then the
+ * workspace's `.agents/skills/` (the cross-client convention, scanned after
+ * the native location so a foldrun-native skill wins a name clash), then the
+ * account library. The nearest definition of a name wins.
+ *
+ * The workspace's are written `workspace/skills/…`, the one spelling for the
+ * workspace root, which the file tools expand themselves. `../../skills/…`
+ * left the model to resolve it against a path it had to guess, and on the
+ * hello template it climbed one level too far and was refused.
+ */
+export declare function skillsInScope(agentDir: string, tenant: string): DiscoveredSkill[];
+/**
+ * The interpreters a set of scripts needs, read from what they are: the
+ * extension of `run:` (or of inline code), or an explicit `interpreter:`.
+ * Docker's script image is built from the runtime spec, and the base one is
+ * Python only, so a JavaScript tool that declared no `runtime:` (the demo's
+ * inline crm-upload, any folder tool's run.mjs) failed with no node to run
+ * it. Python is named too whenever a .py script is present, because asking
+ * for node alone builds on node:22-slim, which has no python3. Null when
+ * nothing beyond the default is needed.
+ */
+export declare function scriptLanguages(scripts: ScriptSpec[]): RuntimeSpec | null;

package/dist/src/runner.js

@@ -12,12 +12,13 @@ import { browserPodLine, podLossDecision, RERAN_ON_FULL } from "./browser-pod.js
 import { eventUrl } from "./webhook.js";
 import { runStepInContainer, sizeLimits, killRunSandboxes } from "./run-container.js";
 import { hostSafeEnv } from "./host-env.js";
+import { resolveModelCredential, credentialLine } from "./model-credential.js";
 import { validateSchema, describeSchemaErrors, looksLikeSchema } from "./json-schema.js";
 import { EGRESS_ENV, MODEL_KEY_NAME, addGrant, hostOf, placeholderNames, proxyModelEnv, unsubstitute } from "./egress.js";
 import { explainRefusal, isRefusalStatus, refusalFromLine, supplyNote } from "./refusal.js";
 import { platform } from "./platform.js";
 import { healthKey } from "./secret-health.js";
-import { TEST_WRITES_DIR, restoreDivertedDirs, snapshotDivertedDirs, testHeadline, testModeEnv, withholdSecrets } from "./test-mode.js";
+import { TEST_WRITES_DIR, overlayTestWrites, restoreDivertedDirs, snapshotDivertedDirs, testHeadline, testModeEnv, withholdSecrets } from "./test-mode.js";
 /** Does this process run steps in a sandbox — the container core ships, or
  *  one the platform registered (a pod)? */
 const isolatedRun = () => {
@@ -657,8 +658,7 @@ grantsOnly = false) {
         `\`${workspace}\` workspace. Every path in this prompt is relative to it — ` +
         `\`outputs/\` is yours, and \`workspace/\` is the workspace root, in every tool ` +
         `and in the shell: the shared file store is \`workspace/storage/\`, what runs ` +
-        `carry forward is \`workspace/state/\`. (\`../../\` reaches the same root and ` +
-        `still works, so a path like \`../../knowledge/\` below is \`workspace/knowledge/\`.) ` +
+        `carry forward is \`workspace/state/\`, its knowledge \`workspace/knowledge/\`. ` +
         `Absolute paths are outside the workspace and will be refused.\n\n` +
         // A flow's whole point is that a later step works on what an earlier one
         // produced, and each agent writes to its own outputs/. A run showed what
@@ -707,25 +707,7 @@ grantsOnly = false) {
     // skills for a few tokens each.
     // Own skills, then the workspace's, then the workspace library — nearest
     // definition of a name wins, so a team default can be overridden locally.
-    const skills = [];
-    const seenSkills = new Set();
-    const addSkills = (dir, prefix, subdir = "skills") => {
-        for (const skill of discoverSkills(dir, subdir)) {
-            if (seenSkills.has(skill.name))
-                continue;
-            seenSkills.add(skill.name);
-            skills.push({ ...skill, path: `${prefix}${skill.path}`, dir: skill.dir ? `${prefix}${skill.dir}` : null });
-        }
-    };
-    const workspaceRoot = path.join(agentDir, "..", "..");
-    addSkills(agentDir, "");
-    addSkills(workspaceRoot, "../../"); // the workspace's skills/
-    // The cross-client convention: skills any skills-compatible tool installs
-    // under .agents/skills/ are visible here too, and vice versa. Scanned after
-    // the native location so a foldrun-native skill wins a name clash, but both
-    // are discovered. project scope only — foldrun workspaces are self-contained.
-    addSkills(workspaceRoot, "../../", ".agents/skills");
-    addSkills(path.join(libraryDir(tenant)), "../../../../library/"); // the account library
+    const skills = skillsInScope(agentDir, tenant);
     // A skill with `when:` only loads when the run carries a matching tag —
     // so an agent with 119 skills costs 119 lines of context only when every
     // one is genuinely relevant.
@@ -804,7 +786,7 @@ grantsOnly = false) {
         return out.sort();
     };
     const own = listDir(path.join(agentDir, "scripts"), "scripts/");
-    const shared = listDir(path.join(agentDir, "..", "..", "scripts"), "../../scripts/");
+    const shared = listDir(path.join(agentDir, "..", "..", "scripts"), "workspace/scripts/");
     // The library's path depends on where this run executes: isolated runs see
     // it at /library, host runs at its real location. Printing the host path
     // into a container's prompt handed the model files it could never open.
@@ -1110,17 +1092,18 @@ grantsOnly = false) {
     let exec = null;
     let runtime = { interpreters: {}, env: {}, log: [], error: null };
     if (executor === "docker" && !grantsOnly) {
-        const image = ensureImage(runtimeSpec);
+        // The script image also carries what the scripts' own languages need: a
+        // .mjs tool with no runtime: block still needs node in its container.
+        // Here only — the run container and the host have node already, and a
+        // spec there sets off the runtime build for nothing.
+        const image = ensureImage(mergeRuntimes(runtimeSpec, scriptLanguages(scriptSpecs)));
         runtimeLog.push(...image.log);
         runtimeError = image.error;
         if (!image.error) {
             exec = {
                 executor: "docker",
                 image: image.tag,
-                mounts: {
-                    [path.resolve(agentDir, "..", "..", "scripts")]: "/workspace-scripts",
-                    [libraryDir(tenant, "scripts")]: "/library-scripts",
-                },
+                mounts: scriptMounts(agentDir, tenant),
                 // Only agents that granted something reaching out — an `apis:` entry
                 // or one of their own tools — get egress.
                 network: parseApis(front.apis).length > 0 || ownToolNames(front).length > 0,
@@ -1367,8 +1350,8 @@ grantsOnly = false) {
         ? [
             { label: "knowledge/", dir: path.join(agentDir, "knowledge") },
             { label: "memory/", dir: path.join(agentDir, "memory") },
-            { label: "../../knowledge/", dir: path.join(wsRoot, "knowledge") },
-            { label: "../../memory/", dir: path.join(wsRoot, "memory") },
+            { label: "workspace/knowledge/", dir: path.join(wsRoot, "knowledge") },
+            { label: "workspace/memory/", dir: path.join(wsRoot, "memory") },
             { label: "workspace/state/", dir: path.join(wsRoot, "state") },
             { label: `workspace/${STORAGE_DIR}/`, dir: path.join(wsRoot, STORAGE_DIR) },
             { label: "outputs/", dir: path.join(agentDir, "outputs") },
@@ -1791,6 +1774,16 @@ stepIndex) {
             push("error", problem);
         if (providerLabel)
             push("info", `provider: ${providerLabel}`);
+        // Which credential the model is called with, on the record: an agent
+        // that names a provider uses its own; otherwise the platform's (in a
+        // run container) or this process's — never a login that just happens
+        // to be on the machine (model-credential.ts).
+        const credential = providerLabel ? null : resolveModelCredential(isolatedRun() ? platformModelEnv() : process.env);
+        step.credential = credential ? credential.label : `provider: ${providerLabel}`;
+        if (credential) {
+            const line = credentialLine(credential);
+            push(line.type, line.text);
+        }
         for (const w of providerWarnings)
             push("error", w);
         // A level that wrote a language nobody can read was skipped, not obeyed.
@@ -2420,9 +2413,13 @@ stepIndex) {
                     };
                     const again = { ...lastArgs, input: { ...lastArgs.input, image: "full" }, resume: null };
                     await lease?.commit();
-                    outcome = await runTracked(again);
-                    step.image = outcome.image ?? { variant: "full", why: "re-run after the browser pod was lost" };
+                    // Before the call, not after: a re-run that throws (the full
+                    // sandbox never started) is still the full go on the record — its
+                    // failed row read "slim" when this was set only on success.
+                    step.image = { variant: "full", why: "re-run after the browser pod was lost" };
                     step.browserPod = { ...first.browserPod, fallback: RERAN_ON_FULL };
+                    outcome = await runTracked(again);
+                    step.image = outcome.image ?? step.image;
                 }
                 else {
                     push("error", decision.message);
@@ -2499,7 +2496,11 @@ stepIndex) {
                 push("info", `test: ${name} withheld from scripts — TEST_MODE_WITHHELD`, { effect: { kind: "withheld", summary: `${name} withheld from scripts` } });
             }
             const stepSecrets = held.env;
-            const consultTools = buildConsultTools(consults, { ...hostSafeEnv(), ...stepSecrets, ...providerEnv }, (type, text) => push(type, text));
+            // The model credential for this machine's Claude Code — the agent's
+            // own provider when it names one. The host allowlist drops it, so
+            // without this every in-process step ran on the machine's login.
+            const localModelEnv = Object.keys(providerEnv).length ? providerEnv : resolveModelCredential().env;
+            const consultTools = buildConsultTools(consults, { ...hostSafeEnv(), ...stepSecrets, ...localModelEnv }, (type, text) => push(type, text));
             // On this machine nobody can write in and there is no proxy: the
             // question goes to the terminal when there is one, else unanswered.
             const askTools = ask ? buildAskTool({ channel: null, timeoutSec: ask.timeoutSec, emit: push, local: terminalAsk }) : null;
@@ -2566,6 +2567,9 @@ stepIndex) {
             // under the run and the originals come back.
             const attemptThrough = async (modelEnv, spec) => {
                 const before = testRun ? snapshotDivertedDirs(workspaceRoot) : null;
+                // What earlier steps of this test run wrote, laid over the real files
+                // for this attempt; restoreDivertedDirs puts the originals back.
+                const handed = before && runId && overlayTestWrites(workspaceRoot, divertFor(runId).to).length ? snapshotDivertedDirs(workspaceRoot) : before;
                 const t = spec ? await startTranslator(spec) : null;
                 try {
                     return await attemptInProcess(t ? { ...modelEnv, ...t.env } : modelEnv);
@@ -2578,12 +2582,12 @@ stepIndex) {
                     }
                     if (before && runId) {
                         const d = divertFor(runId);
-                        restoreDivertedDirs(workspaceRoot, before, d.to, d.note);
+                        restoreDivertedDirs(workspaceRoot, before, d.to, d.note, handed ?? before);
                     }
                 }
             };
             let credentialUsed = platformModelCredential();
-            let outcome = await attemptThrough(providerEnv, translator);
+            let outcome = await attemptThrough(localModelEnv, translator);
             // Same rule as the isolated path: a credential that rotated under the
             // step is waited out and retried before anything else is considered.
             if (outcome.status === "failed" && isAuthRefusal(lastRefusal)) {
@@ -2593,7 +2597,7 @@ stepIndex) {
                     push("info", "the credential rotated under this step; retrying on the new one");
                     credentialUsed = rotated;
                     lastRefusal = "";
-                    outcome = await attemptThrough(providerEnv, translator);
+                    outcome = await attemptThrough(localModelEnv, translator);
                 }
                 else {
                     push("info", "the credential did not change — this is the key itself, not a rotation");
@@ -2606,7 +2610,7 @@ stepIndex) {
                 push("info", `provider busy (${lastRefusal.slice(0, 60)}) — waiting ${(wait / 1000).toFixed(1)}s, attempt ${n} of ${OVERLOAD_RETRIES}`);
                 await sleep(wait);
                 lastRefusal = "";
-                outcome = await attemptThrough(providerEnv, translator);
+                outcome = await attemptThrough(localModelEnv, translator);
             }
             // Same rule as the isolated path: one retry, on a refusal, on the
             // declared or platform second supply.
@@ -4550,3 +4554,86 @@ export function runResult(run) {
     }
     return null;
 }
+/**
+ * What a Docker-run script sees of the workspace and the account: their
+ * scripts/ and their tools/, read-only. A folder tool's code lives in its
+ * tools/<name>/ folder, not in scripts/ — without those two mounts every
+ * folder tool (the hello template's wordcount among them) was handed a host
+ * path the container did not have, and failed on every call. A gallery tool
+ * nobody installed runs from the gallery's own shelf, so that is mounted too
+ * when there is one. A folder that does not exist is skipped by the copy.
+ */
+export function scriptMounts(agentDir, tenant) {
+    const workspaceRoot = path.resolve(agentDir, "..", "..");
+    const mounts = {
+        [path.join(workspaceRoot, "scripts")]: "/workspace-scripts",
+        [path.join(workspaceRoot, "tools")]: "/workspace-tools",
+        [libraryDir(tenant, "scripts")]: "/library-scripts",
+        [libraryDir(tenant, "tools")]: "/library-tools",
+    };
+    const gallery = platform.galleryDir();
+    if (gallery)
+        mounts[path.join(gallery, "tools")] = "/gallery-tools";
+    return mounts;
+}
+/**
+ * The skills an agent can see, nearest first, each with the path the agent
+ * is told to read it at. Own skills, then the workspace's, then the
+ * workspace's `.agents/skills/` (the cross-client convention, scanned after
+ * the native location so a foldrun-native skill wins a name clash), then the
+ * account library. The nearest definition of a name wins.
+ *
+ * The workspace's are written `workspace/skills/…`, the one spelling for the
+ * workspace root, which the file tools expand themselves. `../../skills/…`
+ * left the model to resolve it against a path it had to guess, and on the
+ * hello template it climbed one level too far and was refused.
+ */
+export function skillsInScope(agentDir, tenant) {
+    const skills = [];
+    const seen = new Set();
+    const add = (dir, prefix, subdir = "skills") => {
+        for (const skill of discoverSkills(dir, subdir)) {
+            if (seen.has(skill.name))
+                continue;
+            seen.add(skill.name);
+            skills.push({ ...skill, path: `${prefix}${skill.path}`, dir: skill.dir ? `${prefix}${skill.dir}` : null });
+        }
+    };
+    const workspaceRoot = path.join(agentDir, "..", "..");
+    add(agentDir, "");
+    add(workspaceRoot, "workspace/");
+    add(workspaceRoot, "workspace/", ".agents/skills");
+    // The account library keeps its relative path: `account/` is expanded by
+    // the file tools only, and a skill's bundled scripts are run from the shell.
+    add(path.join(libraryDir(tenant)), "../../../../library/");
+    return skills;
+}
+/**
+ * The interpreters a set of scripts needs, read from what they are: the
+ * extension of `run:` (or of inline code), or an explicit `interpreter:`.
+ * Docker's script image is built from the runtime spec, and the base one is
+ * Python only, so a JavaScript tool that declared no `runtime:` (the demo's
+ * inline crm-upload, any folder tool's run.mjs) failed with no node to run
+ * it. Python is named too whenever a .py script is present, because asking
+ * for node alone builds on node:22-slim, which has no python3. Null when
+ * nothing beyond the default is needed.
+ */
+export function scriptLanguages(scripts) {
+    const kind = (sc) => {
+        const via = (sc.interpreter ?? "").split(/[\\/]/).pop() ?? "";
+        if (/^node/.test(via))
+            return "node";
+        if (/^python/.test(via))
+            return "python";
+        const ext = (sc.run ? path.extname(sc.run) : sc.codeExt ?? "").toLowerCase();
+        if ([".js", ".mjs", ".cjs", ".ts"].includes(ext))
+            return "node";
+        if (ext === ".py")
+            return "python";
+        return null;
+    };
+    const kinds = new Set(scripts.map(kind));
+    if (!kinds.has("node"))
+        return null;
+    return { node: true, ...(kinds.has("python") ? { python: true } : {}), packages: [], npm: [] };
+}

package/dist/src/script-tools.d.ts

@@ -45,6 +45,20 @@ export declare function runScript(cwd: string, spec: ScriptSpec, values: Record<
     code: number | null;
     out: string;
 }>;
+/**
+ * A host path as the script's container sees it: under the agent's own
+ * directory it is /workspace, under a mounted folder it is that mount, and
+ * anything else (an argument that only looks like a path) is left alone.
+ * Containment, not a text prefix: `<ws>/scripts-old/x.py` is not under
+ * `<ws>/scripts`. The longest mount wins, so a nested one is not shadowed.
+ */
+export declare function containerPath(p: string, agentDir: string, mounts: Record<string, string>): string;
+/** Where a `workspace/…` script argument is staged in a script container,
+ *  or null when it is not one (or climbs out of the workspace). */
+export declare function stageWorkspaceArg(arg: string, workspaceRoot: string): {
+    host: string;
+    container: string;
+} | null;
 export interface ExecutionContext {
     /** "docker" nests each script in its own container; "sandbox" spawns it
      *  directly inside the isolation the step already has. */

package/dist/src/script-tools.js

@@ -183,14 +183,18 @@ export function runScript(cwd, spec, values, env, libraryScripts, interpreters,
         // Container path: same command, executed inside an isolated container
         // with only the agent's directory (plus declared shared dirs) mounted.
         if (exec && exec.executor === "docker") {
+            // `workspace/…` is the workspace root on the host (the step's link)
+            // and in a run container; here there is no link, so each such
+            // argument is staged: copied in, pointed at, and copied back after.
+            const workspaceRoot = path.resolve(cwd, "..", "..");
+            const staged = [];
             const inContainer = (p) => {
-                if (p.startsWith(path.resolve(cwd)))
-                    return p.replace(path.resolve(cwd), "/workspace");
-                for (const [host, mount] of Object.entries(exec.mounts)) {
-                    if (p.startsWith(host))
-                        return p.replace(host, mount);
-                }
-                return p;
+                const w = stageWorkspaceArg(p, workspaceRoot);
+                if (!w)
+                    return containerPath(p, cwd, exec.mounts);
+                if (!staged.some((s) => s.host === w.host))
+                    staged.push(w);
+                return w.container;
             };
             const argv = [
                 // The interpreter inside the image, not the host's venv path.
@@ -203,6 +207,7 @@ export function runScript(cwd, spec, values, env, libraryScripts, interpreters,
             runInContainer({
                 agentDir: path.resolve(cwd),
                 readOnly: exec.mounts,
+                staged,
                 image: exec.image,
                 argv,
                 env,
@@ -238,6 +243,41 @@ export function runScript(cwd, spec, values, env, libraryScripts, interpreters,
         }));
     });
 }
+/**
+ * A host path as the script's container sees it: under the agent's own
+ * directory it is /workspace, under a mounted folder it is that mount, and
+ * anything else (an argument that only looks like a path) is left alone.
+ * Containment, not a text prefix: `<ws>/scripts-old/x.py` is not under
+ * `<ws>/scripts`. The longest mount wins, so a nested one is not shadowed.
+ */
+export function containerPath(p, agentDir, mounts) {
+    if (!path.isAbsolute(p))
+        return p;
+    const under = (root) => {
+        const rel = path.relative(root, p);
+        return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel)) ? rel : null;
+    };
+    const own = under(path.resolve(agentDir));
+    if (own !== null)
+        return path.posix.join("/workspace", own.split(path.sep).join("/"));
+    const hit = Object.entries(mounts)
+        .map(([host, mount]) => ({ mount, rel: under(path.resolve(host)), len: host.length }))
+        .filter((m) => m.rel !== null)
+        .sort((a, b) => b.len - a.len)[0];
+    return hit ? path.posix.join(hit.mount, hit.rel.split(path.sep).join("/")) : p;
+}
+/** Where a `workspace/…` script argument is staged in a script container,
+ *  or null when it is not one (or climbs out of the workspace). */
+export function stageWorkspaceArg(arg, workspaceRoot) {
+    if (arg !== "workspace" && !arg.startsWith("workspace/"))
+        return null;
+    const rel = arg.slice("workspace".length).replace(/^\/+/, "");
+    const host = path.resolve(workspaceRoot, rel);
+    const within = path.relative(workspaceRoot, host);
+    if (within.startsWith("..") || path.isAbsolute(within))
+        return null;
+    return { host, container: path.posix.join("/workspace-root", within.split(path.sep).join("/")) };
+}
 // `run:` accepts:
 //   scripts/x.py              this agent's own script
 //   workspace/tools/<t>/x.py  a folder tool's own code, in this workspace

package/dist/src/step-exec.d.ts

@@ -249,3 +249,14 @@ export declare function checkVerify(agentDir: string, verify: string, ctx: {
      *  person asked the run to stop. */
     signal?: AbortSignal;
 }): Promise<VerifyVerdict>;
+/**
+ * The environment an Agent SDK session starts with: the step's, minus the
+ * connectors of whoever is signed in to claude.ai on this machine. Claude
+ * Code loads an account's claude.ai MCP servers (Docs, Drive, …) unless told
+ * not to, and `settingSources: []` does not reach them — they come with the
+ * login, not from a settings file. A local `foldrun run` handed every agent
+ * the person's own connectors: the hello template's agents reported that
+ * "the only tools I have are the Claude Docs ones". `strictMcpConfig` keeps
+ * the rest of the on-disk MCP configuration out; this keeps the account's.
+ */
+export declare function sdkEnv(base: Record<string, string | undefined> | undefined, extra?: Record<string, string>): Record<string, string | undefined>;

package/dist/src/step-exec.js

@@ -213,8 +213,10 @@ async function executeStepInner(opts, runQuery) {
             // With sub-agents, the SDK would also offer its built-in ones
             // (general-purpose has every tool the session has). Only the declared
             // ones may run; the guard in the hook below refuses the rest as well.
-            env: subagents ? { ...(opts.env ?? process.env), CLAUDE_AGENT_SDK_DISABLE_BUILTIN_AGENTS: "1" } : opts.env,
+            env: sdkEnv(opts.env, subagents ? { CLAUDE_AGENT_SDK_DISABLE_BUILTIN_AGENTS: "1" } : {}),
             mcpServers: opts.mcpServers,
+            // Only the servers foldrun passes. See sdkEnv for the claude.ai half.
+            strictMcpConfig: true,
             // canUseTool is only asked when the SDK wants permission, and it never
             // asks for a read inside the cwd — so `Read workspace/storage/x` went
             // to `<agentDir>/workspace/storage/x` unchecked and unrewritten. On
@@ -827,7 +829,8 @@ async function judgeReply(rubric, output, env, signal) {
                 systemPrompt: "You grade text against a stated requirement. Be strict and literal.",
                 tools: [],
                 settingSources: [],
-                env,
+                env: sdkEnv(env),
+                strictMcpConfig: true,
                 maxTurns: 1,
                 abortController,
             },
@@ -898,3 +901,16 @@ function runVerify(agentDir, command, env, data, signal) {
         child.on("close", (code) => resolve({ code, out }));
     });
 }
+/**
+ * The environment an Agent SDK session starts with: the step's, minus the
+ * connectors of whoever is signed in to claude.ai on this machine. Claude
+ * Code loads an account's claude.ai MCP servers (Docs, Drive, …) unless told
+ * not to, and `settingSources: []` does not reach them — they come with the
+ * login, not from a settings file. A local `foldrun run` handed every agent
+ * the person's own connectors: the hello template's agents reported that
+ * "the only tools I have are the Claude Docs ones". `strictMcpConfig` keeps
+ * the rest of the on-disk MCP configuration out; this keeps the account's.
+ */
+export function sdkEnv(base, extra = {}) {
+    return { ...(base ?? process.env), ...extra, ENABLE_CLAUDEAI_MCP_SERVERS: "false" };
+}

package/dist/src/store.d.ts

@@ -992,6 +992,10 @@ export interface StepRecord {
         why?: string;
         pod?: boolean;
     } | null;
+    /** Which model credential the step ran on, by its variable — "API key
+     *  (ANTHROPIC_API_KEY)", "Claude login token (CLAUDE_CODE_OAUTH_TOKEN)",
+     *  "provider: …" — or "none set" (model-credential.ts). */
+    credential?: string;
     /** Slim browsing through the account's pod (browser-pod.ts): reconnect
      *  tries and how many got through; when the pod was lost, why and what
      *  the step had written by then; and what happened — `fallback` (the

package/dist/src/store.js

@@ -483,7 +483,7 @@ export function buildMemoryIndex(dir, prefix = "") {
 // Workspace-scoped shared assets: skills/, memory/, tools/ sit beside agents/
 // and are available to every agent in that workspace.
 export function workspaceMemoryIndex(tenant, workspace) {
-    return buildMemoryIndex(path.join(workspaceDir(tenant, workspace), "memory"), "../../memory/");
+    return buildMemoryIndex(path.join(workspaceDir(tenant, workspace), "memory"), "workspace/memory/");
 }
 // Knowledge is what you *gave* an agent — stable reference material an agent
 // reads and never rewrites. Memory is what it *learned* and authors itself.
@@ -493,7 +493,7 @@ export function knowledgeIndex(dir, prefix = "") {
     return buildMemoryIndex(dir, prefix);
 }
 export function workspaceKnowledgeIndex(tenant, workspace) {
-    return knowledgeIndex(path.join(workspaceDir(tenant, workspace), "knowledge"), "../../knowledge/");
+    return knowledgeIndex(path.join(workspaceDir(tenant, workspace), "knowledge"), "workspace/knowledge/");
 }
 // One noun for capability. A tools/<name>.md file declares either an HTTP
 // endpoint or a script — `type:` says which, and it's inferred when omitted

package/dist/src/subagents.js

@@ -71,7 +71,7 @@ export function subagentPrompt(o) {
         `# Where you are\n\n` +
             `You are ${o.name}, a sub-agent started by ${o.parent} to do one job and report back. ` +
             `You work in ${o.parent}'s directory, \`agents/${o.parent}/\` in the \`${o.workspace}\` workspace: ` +
-            `\`../../\` is the workspace root, its knowledge is at \`../../knowledge/\`, and absolute paths are refused. ` +
+            `\`workspace/\` is the workspace root, its knowledge is at \`workspace/knowledge/\`, and absolute paths are refused. ` +
             `You have only the tools listed for you. When the job is done, reply with what you found or made — ` +
             `your reply is all ${o.parent} sees of your work, so put the facts and file paths in it.`,
         ...(o.shared?.trim() ? [o.shared.trim()] : []),

package/dist/src/test-mode.d.ts

@@ -103,8 +103,23 @@ export declare function divertedSummary(rel: string, was: Buffer | null, next: B
 export declare function snapshotDivertedDirs(wsRoot: string): Map<string, Buffer>;
 /** Undo a step's writes to the diverted directories, keeping each changed
  *  or new file under `to` by its workspace-relative path. Deletions are
- *  undone too — the original is put back. Returns what was set aside. */
-export declare function restoreDivertedDirs(wsRoot: string, before: Map<string, Buffer>, to: string, note: (rel: string, summary: string) => void): string[];
+ *  undone too — the original is put back. `handed` is what the step was
+ *  given when that was more than the workspace (the run's earlier test
+ *  writes, laid over it): only what the step changed from THAT is its
+ *  write. Returns what was set aside. */
+export declare function restoreDivertedDirs(wsRoot: string, before: Map<string, Buffer>, to: string, note: (rel: string, summary: string) => void, handed?: Map<string, Buffer>): string[];
+/**
+ * A test run's later steps see what its earlier steps wrote. Those writes
+ * are kept under runs/<id>/test-writes/, never on the workspace, so each
+ * step's copy of the workspace gets them laid over it — otherwise a step
+ * reads the real files, and a flow that hands work on through storage/
+ * tests something no live run does: on 2026-10-03 a strata-desk test run's
+ * compiler wrote today's PASS report, and the mailer was handed the
+ * morning's FAIL one and refused. Times are kept, so a verify that asks
+ * whether a file is fresh answers for the step that wrote it. Returns the
+ * workspace-relative paths laid over.
+ */
+export declare function overlayTestWrites(wsCopy: string, from: string): string[];
 /** `[test] ` in front of a headline, once. */
 export declare function testHeadline(summary: string): string;
 /** The env every test-run sandbox gets, beside its secrets. */

package/dist/src/test-mode.js

@@ -18,7 +18,9 @@
 //     a test run; the env var says TEST_MODE_WITHHELD instead, so a script
 //     that forgot to check fails at the provider with an auth error
 //   - the write-back: state/ and storage/ go INTO the sandbox as usual and
-//     come out into runs/<id>/test-writes/ instead of the real directories
+//     come out into runs/<id>/test-writes/ instead of the real directories;
+//     the next step's copy has those writes laid over it (overlayTestWrites),
+//     so the run reads its own work and the workspace never sees it
 //
 // Nothing here weakens a live run: every function is a no-op unless the run
 // says `test: true`.
@@ -247,21 +249,27 @@ export function snapshotDivertedDirs(wsRoot) {
 }
 /** Undo a step's writes to the diverted directories, keeping each changed
  *  or new file under `to` by its workspace-relative path. Deletions are
- *  undone too — the original is put back. Returns what was set aside. */
-export function restoreDivertedDirs(wsRoot, before, to, note) {
+ *  undone too — the original is put back. `handed` is what the step was
+ *  given when that was more than the workspace (the run's earlier test
+ *  writes, laid over it): only what the step changed from THAT is its
+ *  write. Returns what was set aside. */
+export function restoreDivertedDirs(wsRoot, before, to, note, handed = before) {
     const now = snapshotDivertedDirs(wsRoot);
     const aside = [];
     for (const [rel, next] of now) {
-        const was = before.get(rel) ?? null;
-        if (was && was.equals(next))
-            continue;
-        const dest = path.join(to, rel);
-        fs.mkdirSync(path.dirname(dest), { recursive: true });
-        fs.writeFileSync(dest, next);
-        aside.push(rel);
-        note(rel, divertedSummary(rel, was, next));
-        if (was)
-            fs.writeFileSync(path.join(wsRoot, rel), was);
+        const given = handed.get(rel) ?? null;
+        if (!(given && given.equals(next))) {
+            const dest = path.join(to, rel);
+            fs.mkdirSync(path.dirname(dest), { recursive: true });
+            fs.writeFileSync(dest, next);
+            aside.push(rel);
+            note(rel, divertedSummary(rel, before.get(rel) ?? null, next));
+        }
+        const orig = before.get(rel);
+        if (orig) {
+            if (!orig.equals(next))
+                fs.writeFileSync(path.join(wsRoot, rel), orig);
+        }
         else
             fs.rmSync(path.join(wsRoot, rel), { force: true });
     }
@@ -275,6 +283,38 @@ export function restoreDivertedDirs(wsRoot, before, to, note) {
     }
     return aside;
 }
+/**
+ * A test run's later steps see what its earlier steps wrote. Those writes
+ * are kept under runs/<id>/test-writes/, never on the workspace, so each
+ * step's copy of the workspace gets them laid over it — otherwise a step
+ * reads the real files, and a flow that hands work on through storage/
+ * tests something no live run does: on 2026-10-03 a strata-desk test run's
+ * compiler wrote today's PASS report, and the mailer was handed the
+ * morning's FAIL one and refused. Times are kept, so a verify that asks
+ * whether a file is fresh answers for the step that wrote it. Returns the
+ * workspace-relative paths laid over.
+ */
+export function overlayTestWrites(wsCopy, from) {
+    const laid = [];
+    for (const dir of TEST_DIVERTED_DIRS) {
+        const root = path.join(from, dir);
+        if (!fs.existsSync(root))
+            continue;
+        for (const entry of fs.readdirSync(root, { recursive: true, withFileTypes: true })) {
+            if (!entry.isFile())
+                continue;
+            const abs = path.join(entry.parentPath, entry.name);
+            const rel = path.relative(from, abs).replaceAll("\\", "/");
+            const dest = path.join(wsCopy, rel);
+            fs.mkdirSync(path.dirname(dest), { recursive: true });
+            fs.copyFileSync(abs, dest);
+            const st = fs.statSync(abs);
+            fs.utimesSync(dest, st.atime, st.mtime);
+            laid.push(rel);
+        }
+    }
+    return laid;
+}
 /** `[test] ` in front of a headline, once. */
 export function testHeadline(summary) {
     return summary.startsWith("[test]") ? summary : `[test] ${summary}`;

package/index.ts

@@ -13,6 +13,7 @@
 export * from "./src/layout.ts";
 export * from "./src/paths.ts";
 export * from "./src/store.ts";
+export * from "./src/model-credential.ts";
 export * from "./src/starter.ts";
 export * from "./src/runner.ts";
 export * from "./src/okf.ts";