@foldrun/core 0.5.0 → 0.7.0

package/README.md

@@ -208,16 +208,19 @@ To *run* an agent you need one of:
 
 - **`ANTHROPIC_API_KEY`** — an API key from
   [console.anthropic.com](https://console.anthropic.com).
+- **`CLAUDE_CODE_OAUTH_TOKEN`** — a Claude login token, from
+  `claude setup-token`. Used when no API key is set.
 - **Your own provider.** An agent that names a `provider:` needs no
   Anthropic key: 29 endpoints are known by name, including `ollama`,
   `lmstudio` and `vllm`, so a local model is a complete answer. Anything
   not in that list works by spelling out `base_url:`, `format:` and
   `auth:`. See [providers](https://docs.foldrun.io/providers).
 
-A **Claude Code or claude.ai subscription login is not one of them**, and
-the CLI will not look for one. Anthropic does not permit products built on
-its Agent SDK to run on consumer subscriptions, so using that login here
-would put you outside their terms — an API key is the supported path.
+The first one set is used, and every step records which. The login Claude
+Code keeps on the machine is never picked up by itself. Anthropic does not
+allow products built on its Agent SDK to offer claude.ai login unless
+Anthropic has approved them, so check that the terms cover your use before
+you rely on a login token.
 
 ## Status
 

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export * from "./src/layout.ts";
 export * from "./src/paths.ts";
 export * from "./src/store.ts";
+export * from "./src/model-credential.ts";
 export * from "./src/starter.ts";
 export * from "./src/runner.ts";
 export * from "./src/okf.ts";
@@ -21,6 +22,8 @@ export * from "./src/linkable.ts";
 export * from "./src/refs.ts";
 export * from "./src/tool-names.ts";
 export * from "./src/history.ts";
+export * from "./src/zip.ts";
+export * from "./src/package.ts";
 export * from "./src/gitrepo.ts";
 export * from "./src/storage.ts";
 export * from "./src/secrets.ts";
@@ -30,6 +33,7 @@ export * from "./src/notify.ts";
 export * from "./src/webhook.ts";
 export * from "./src/approvals.ts";
 export * from "./src/deploy.ts";
+export * from "./src/agent-import.ts";
 export * from "./src/account.ts";
 export * from "./src/tar.ts";
 export * from "./src/git.ts";

package/dist/index.js

@@ -12,6 +12,7 @@
 export * from "./src/layout.js";
 export * from "./src/paths.js";
 export * from "./src/store.js";
+export * from "./src/model-credential.js";
 export * from "./src/starter.js";
 export * from "./src/runner.js";
 export * from "./src/okf.js";
@@ -32,6 +33,8 @@ export * from "./src/linkable.js";
 export * from "./src/refs.js";
 export * from "./src/tool-names.js";
 export * from "./src/history.js";
+export * from "./src/zip.js";
+export * from "./src/package.js";
 export * from "./src/gitrepo.js";
 export * from "./src/storage.js";
 export * from "./src/secrets.js";
@@ -41,6 +44,7 @@ export * from "./src/notify.js";
 export * from "./src/webhook.js";
 export * from "./src/approvals.js";
 export * from "./src/deploy.js";
+export * from "./src/agent-import.js";
 export * from "./src/account.js";
 export * from "./src/tar.js";
 export * from "./src/git.js";

package/dist/src/agent-import.d.ts

@@ -0,0 +1,21 @@
+export interface AgentImportResult {
+    /** The name the agent has in the target workspace. */
+    name: string;
+    /** Workspace-relative paths written. */
+    files: string[];
+    /** What the copy refers to that the target workspace does not have. The
+     *  import still happens: a missing secret is set in a minute, and refusing
+     *  would make the person copy the file by hand instead. */
+    warnings: string[];
+}
+/** An error the API layer turns into a status rather than a 500. */
+export declare class AgentImportError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+/** The files `importAgent` would copy, without writing anything. */
+export declare function agentSourceFiles(tenant: string, from: string, agent: string): string[];
+export declare function importAgent(tenant: string, from: string, agent: string, to: string, opts?: {
+    as?: string;
+    by?: string;
+}): AgentImportResult;

package/dist/src/agent-import.js

@@ -0,0 +1,116 @@
+// Bring an agent you already have into another workspace of the same account.
+//
+// A new workspace starts blank (blankWorkspaceFiles), and the agents worth
+// having in it are usually ones already written and tuned elsewhere — a
+// researcher from one desk, a reviewer from another. Copying them by hand
+// meant opening each file, and missing the skills and scripts that live in
+// the agent's own folder. This copies the folder: what the agent IS, never
+// what it has accumulated.
+//
+// Copied: agents/<name>/agent.md and everything authored beside it — its own
+// skills/, scripts/, knowledge/. Not copied: memory/ (what it learned in the
+// other workspace's runs), outputs/, state/, the step's workspace link, and
+// the SDK's .claude session files. A fresh copy starts with no lessons that
+// were about somebody else's desk.
+import fs from "node:fs";
+import path from "node:path";
+import matter from "gray-matter";
+import { assertSafeName, listWorkspaceFiles, readWorkspaceFile, writeWorkspaceFile, workspaceDir, workspaceTools, listWorkspaces, } from "./store.js";
+import { libraryDir, libraryTools } from "./library.js";
+import { isRuntimeTool, toolEntryName } from "./tool-names.js";
+import { discoverSkills } from "./runner.js";
+import { listSecrets } from "./secrets.js";
+/** An error the API layer turns into a status rather than a 500. */
+export class AgentImportError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+/** Accumulated or generated, not authored — never carried to another workspace. */
+const NOT_COPIED = /^agents\/[^/]+\/(memory|outputs|state|workspace|\.claude)(\/|$)|^agents\/[^/]+\/\.claude\.json$/;
+/** The files `importAgent` would copy, without writing anything. */
+export function agentSourceFiles(tenant, from, agent) {
+    const prefix = `agents/${agent}/`;
+    return listWorkspaceFiles(tenant, from).filter((p) => p.startsWith(prefix) && !NOT_COPIED.test(p));
+}
+const list = (v) => Array.isArray(v) ? v.map((x) => toolEntryName(x)).filter(Boolean) : typeof v === "string" && v.trim() ? [v.trim()] : [];
+export function importAgent(tenant, from, agent, to, opts = {}) {
+    assertSafeName(from, "workspace");
+    assertSafeName(to, "workspace");
+    assertSafeName(agent, "agent");
+    const name = opts.as?.trim() || agent;
+    assertSafeName(name, "agent");
+    const known = new Set(listWorkspaces(tenant).map((w) => w.name));
+    if (!known.has(from))
+        throw new AgentImportError(`no workspace called "${from}" in this account`, 404);
+    if (!known.has(to))
+        throw new AgentImportError(`no workspace called "${to}" in this account`, 404);
+    if (from === to && name === agent) {
+        throw new AgentImportError(`${agent} is already in ${to} — give the copy another name with "as"`, 409);
+    }
+    const files = agentSourceFiles(tenant, from, agent);
+    if (!files.includes(`agents/${agent}/agent.md`)) {
+        throw new AgentImportError(`no agent called "${agent}" in ${from}`, 404);
+    }
+    if (fs.existsSync(path.join(workspaceDir(tenant, to), "agents", name))) {
+        throw new AgentImportError(`${to} already has an agent called "${name}" — import it under another name with "as"`, 409);
+    }
+    const written = [];
+    const message = `import agents/${agent} from ${from}${name !== agent ? ` as ${name}` : ""}`;
+    let front = {};
+    for (const src of files) {
+        let content = readWorkspaceFile(tenant, from, src);
+        const rel = src.slice(`agents/${agent}/`.length);
+        if (rel === "agent.md") {
+            front = matter(content).data;
+            // The folder is the name flows address; a `name:` that disagrees with
+            // it is the first thing check would complain about.
+            if (name !== agent)
+                content = content.replace(/^(---\r?\n(?:[\s\S]*?\r?\n)?)name:[^\n]*$/m, `$1name: ${name}`);
+        }
+        const dest = `agents/${name}/${rel}`;
+        writeWorkspaceFile(tenant, to, dest, content, { ...(opts.by ? { by: opts.by } : {}), message });
+        written.push(dest);
+    }
+    return { name, files: written, warnings: missingFor(tenant, to, name, front) };
+}
+/** What the imported agent names that the target workspace cannot provide. */
+function missingFor(tenant, to, name, front) {
+    const out = [];
+    const ws = workspaceDir(tenant, to);
+    const tools = { ...libraryTools(tenant), ...workspaceTools(tenant, to) };
+    const noTool = list(front.tools).filter((t) => !isRuntimeTool(t) && !tools[t]);
+    if (noTool.length)
+        out.push(`tools not in ${to} or the account library: ${noTool.join(", ")} — import or add them under tools/`);
+    const skills = new Set();
+    for (const [base, sub] of [
+        [path.join(ws, "agents", name), "skills"],
+        [ws, "skills"],
+        [ws, ".agents/skills"],
+        [libraryDir(tenant), "skills"],
+    ]) {
+        for (const s of discoverSkills(base, sub))
+            skills.add(s.name);
+    }
+    const noSkill = list(front.skills).filter((s) => !skills.has(s));
+    if (noSkill.length)
+        out.push(`skills not in ${to} or the account library: ${noSkill.join(", ")}`);
+    const scripts = list(front.scripts).filter((s) => !fs.existsSync(path.join(ws, "agents", name, "scripts", s)) &&
+        !fs.existsSync(path.join(ws, "scripts", s)) &&
+        !fs.existsSync(path.join(libraryDir(tenant), "scripts", s)));
+    if (scripts.length)
+        out.push(`scripts not in ${to}: ${scripts.join(", ")} — copy them into scripts/`);
+    let have;
+    try {
+        have = new Set(listSecrets(tenant, to).map((s) => s.name));
+    }
+    catch {
+        have = new Set();
+    }
+    const noSecret = list(front.secrets).filter((s) => !have.has(s));
+    if (noSecret.length)
+        out.push(`secrets not set for ${to}: ${noSecret.join(", ")} — add them with \`foldrun secrets set\` or Settings → Secrets`);
+    return out;
+}

package/dist/src/api-tools.js

@@ -240,7 +240,8 @@ function genericTool(api, env, bucket, log) {
         `Allowed methods: ${api.methods.join(", ")}. Provide only the path after the base URL. ` +
         `Authentication is added automatically — never ask the user for credentials.` +
         typed +
-        rateSentence(api), {
+        rateSentence(api) +
+        (api.guide ? `\n\nHow to use it (from its tool.md):\n${api.guide}` : ""), {
         method: z.enum(api.methods).describe("HTTP method"),
         path: z.string().describe("Path appended to the base URL, e.g. /customers/123/campaigns"),
         query: z.record(z.string(), z.string()).optional().describe("Query parameters"),
@@ -291,6 +292,14 @@ resolved) {
                 `so no tool is exposed. Report it as blocked; do not reach this API another way.`);
             continue;
         }
+        // A base still holding `${FOLDRUN_API_URL}` was not filled: this install
+        // has no public address configured (a laptop, usually). Say so rather
+        // than hand the model a URL that cannot resolve.
+        if (/\$\{[A-Z_]+\}/.test(api.base)) {
+            promptLines.push(`- **${api.name}** — unavailable this run: its base \`${api.base}\` names a variable this ` +
+                `install does not set (FOLDRUN_API_URL or FOLDRUN_PUBLIC_URL). Report it as blocked.`);
+            continue;
+        }
         const typedNames = [];
         for (const op of ops) {
             tools.push(typedTool(api, op, env, bucket, log));
@@ -311,7 +320,10 @@ resolved) {
             promptLines.push(`- **${api.name}** — ${api.description} Base URL \`${api.base}\`. ` +
                 `${ops.length} typed tool${ops.length === 1 ? "" : "s"}` +
                 (withGeneric ? `, plus \`call_${api.name}\` for anything they do not cover` : "") +
-                `. Credentials are injected for you.${rateLine}`, ...listed, ...more);
+                `. Credentials are injected for you.${rateLine}`, ...listed, ...more, 
+            // Typed-only (an `operations:` allowlist) has no generic tool whose
+            // description could carry the guide, so it rides here.
+            ...(!withGeneric && api.guide ? [`  How to use it (from its tool.md):\n${api.guide}`] : []));
         }
         else {
             promptLines.push(`- **${api.name}** — call with the \`call_${api.name}\` tool. ${api.description} ` +

package/dist/src/approvals.d.ts

@@ -135,8 +135,15 @@ export declare function expireStaleGate(tenant: string, workspace: string, run:
  *
  * Only steps waiting on an event are released: a run that is also asking a
  * person a question keeps asking.
+ *
+ * `by` names who delivered it when that is known — a signed-in person or a
+ * key through the dashboard's approve route — and `step` releases one
+ * waiting step rather than all of them.
  */
-export declare function deliverEvent(tenant: string, workspace: string, runId: string, payload: string): Promise<{
+export declare function deliverEvent(tenant: string, workspace: string, runId: string, payload: string, opts?: {
+    by?: string;
+    step?: number;
+}): Promise<{
     run: RunRecord;
     steps: number[];
 }>;

package/dist/src/approvals.js

@@ -271,22 +271,27 @@ export async function expireStaleGate(tenant, workspace, run, now = Date.now())
  *
  * Only steps waiting on an event are released: a run that is also asking a
  * person a question keeps asking.
+ *
+ * `by` names who delivered it when that is known — a signed-in person or a
+ * key through the dashboard's approve route — and `step` releases one
+ * waiting step rather than all of them.
  */
-export async function deliverEvent(tenant, workspace, runId, payload) {
+export async function deliverEvent(tenant, workspace, runId, payload, opts = {}) {
     const run = readRun(tenant, workspace, runId);
     if (!run)
         throw new ApprovalError("run not found", 404);
     const waiting = run.steps
         .map((s, i) => ({ s, i }))
-        .filter(({ s }) => s.status === "awaiting-approval" && s.waitFor === "event");
-    if (waiting.length === 0)
-        throw new ApprovalError("this run is not waiting for an event", 409);
+        .filter(({ s, i }) => s.status === "awaiting-approval" && s.waitFor === "event" && (opts.step === undefined || opts.step === i));
+    if (waiting.length === 0) {
+        throw new ApprovalError(opts.step === undefined ? "this run is not waiting for an event" : `step ${opts.step} is not waiting for an event`, 409);
+    }
     for (const { s } of waiting)
         s.eventPayload = payload.slice(0, 20_000);
     writeRun(tenant, workspace, run);
     let decided = [];
     for (const { i } of waiting) {
-        const out = await decideApproval(tenant, workspace, runId, { decision: "approve", step: i, by: "by an external event" });
+        const out = await decideApproval(tenant, workspace, runId, { decision: "approve", step: i, by: opts.by ?? "by an external event" });
         decided = decided.concat(out.steps);
     }
     return { run: readRun(tenant, workspace, runId) ?? run, steps: decided };

package/dist/src/browser-pod.d.ts

@@ -30,8 +30,27 @@ export interface ClassifyContext {
     /** Web actions a paid provider answers this step — from the env's
      *  FOLDRUN_WEB_<ACTION>_VIA. */
     paidWeb?: Record<string, string>;
+    /** Page scripts the agent's web.browse block runs in every page — the
+     *  env's FOLDRUN_BROWSER_INIT. They make every browse call a write. */
+    browseInit?: string;
 }
-/** The browse actions a call asked for, nested `if` branches included. */
+/**
+ * The browse actions a call asked for, nested `if` branches included.
+ *
+ * Read the way the web tool reads them (platform gallery.ts, browse.mjs
+ * checkSteps): `actions` is an array of steps, a step's action is one of its
+ * OWN keys (the first the tool knows), and the only steps inside a step are
+ * an `if`'s `then` and `else`. Every own key of a step is returned — the
+ * caller keeps the ones it cares about, and a step holding a write key beside
+ * a read key counts as the write. What sits inside an option's value — an
+ * extract's `fields` (column names), a mock's `json` body, a webmcp `input` —
+ * is data, not an action: `{"fields": {"type": "td.kind"}}` is no typing.
+ *
+ * A shape the tool would refuse (an object where the array belongs, a step
+ * that is not an object, `then` that is not a list) is walked key by key at
+ * every depth, as before; nesting past MAX_DEPTH is unreadable, so a write
+ * buried deep is never taken for a read.
+ */
 export declare function browseActionNames(actions: unknown): string[];
 /** What a browse call's arguments would write, or null when it only reads. */
 export declare function browseWrites(input: Record<string, unknown>): string | null;

package/dist/src/browser-pod.js

@@ -45,8 +45,9 @@ export const BROWSE_WRITE_ACTIONS = [
     "select", "check", "uncheck", "upload", "dialog", "login", "eval", "webmcp", "solve",
 ];
 /** Call arguments of web action=browse that are writes whatever the actions:
- *  page script, a paid captcha solver, a confirmation of a credential step. */
-const BROWSE_WRITE_ARGS = ["js", "captcha", "captcha_solver", "confirm"];
+ *  page script (js=, or init= scripts run in every page), a paid captcha
+ *  solver, a confirmation of a credential step. */
+const BROWSE_WRITE_ARGS = ["js", "init", "captcha", "captcha_solver", "confirm"];
 /** Web actions that only read — when foldrun's own answers them. A paid
  *  provider answering one (FOLDRUN_WEB_<ACTION>_VIA) makes it a write: doing
  *  it twice is paying twice. `monitor` keeps state, so it always writes. */
@@ -57,32 +58,78 @@ const READ_BUILTINS = new Set(["Read", "Glob", "Grep", "WebSearch", "WebFetch",
  *  answer; a delegation's own calls come through on their own. */
 const READ_SERVERS = new Set(["foldrun_search", "foldrun_history", "foldrun_desks", "foldrun_agents"]);
 const DELEGATE = new Set(["Agent", "Task"]);
-/** The browse actions a call asked for, nested `if` branches included. */
+/**
+ * The browse actions a call asked for, nested `if` branches included.
+ *
+ * Read the way the web tool reads them (platform gallery.ts, browse.mjs
+ * checkSteps): `actions` is an array of steps, a step's action is one of its
+ * OWN keys (the first the tool knows), and the only steps inside a step are
+ * an `if`'s `then` and `else`. Every own key of a step is returned — the
+ * caller keeps the ones it cares about, and a step holding a write key beside
+ * a read key counts as the write. What sits inside an option's value — an
+ * extract's `fields` (column names), a mock's `json` body, a webmcp `input` —
+ * is data, not an action: `{"fields": {"type": "td.kind"}}` is no typing.
+ *
+ * A shape the tool would refuse (an object where the array belongs, a step
+ * that is not an object, `then` that is not a list) is walked key by key at
+ * every depth, as before; nesting past MAX_DEPTH is unreadable, so a write
+ * buried deep is never taken for a read.
+ */
 export function browseActionNames(actions) {
+    const UNREADABLE = "(unreadable actions)";
+    const MAX_DEPTH = 32;
     let steps = actions;
     if (typeof steps === "string") {
         try {
             steps = JSON.parse(steps);
         }
         catch {
-            return ["(unreadable actions)"];
+            return [UNREADABLE];
         }
     }
     const out = [];
-    const walk = (v, depth) => {
-        if (depth > 8 || v === null || typeof v !== "object")
+    // Unknown shapes: every key anywhere is a candidate action.
+    const walkAny = (v, depth) => {
+        if (v === null || typeof v !== "object")
+            return;
+        if (depth > MAX_DEPTH) {
+            out.push(UNREADABLE);
             return;
+        }
         if (Array.isArray(v)) {
             for (const x of v)
-                walk(x, depth + 1);
+                walkAny(x, depth + 1);
             return;
         }
         for (const [k, x] of Object.entries(v)) {
             out.push(k);
-            walk(x, depth + 1);
+            walkAny(x, depth + 1);
+        }
+    };
+    const walkSteps = (v, depth) => {
+        if (v === null || v === undefined)
+            return;
+        if (depth > MAX_DEPTH) {
+            out.push(UNREADABLE);
+            return;
+        }
+        if (!Array.isArray(v)) {
+            walkAny(v, depth);
+            return;
+        }
+        for (const step of v) {
+            if (step === null || typeof step !== "object" || Array.isArray(step)) {
+                walkAny(step, depth + 1);
+                continue;
+            }
+            for (const [k, x] of Object.entries(step)) {
+                out.push(k);
+                if (k === "then" || k === "else")
+                    walkSteps(x, depth + 1);
+            }
         }
     };
-    walk(steps, 0);
+    walkSteps(steps, 0);
     return out;
 }
 /** What a browse call's arguments would write, or null when it only reads. */
@@ -135,6 +182,8 @@ export function classifyCall(tool, input, ctx = {}) {
             const w = browseWrites(args);
             if (w)
                 return write(w);
+            if (ctx.browseInit)
+                return write(`browse init scripts (${ctx.browseInit})`);
         }
         return { write: false };
     }

package/dist/src/completions.js

@@ -36,6 +36,7 @@ const TOOL_GROUPS = [
     { label: "code", hint: "Bash — runs anything in the sandbox" },
     { label: "web", hint: "search, fetch, browse, crawl, map, extract, answer, monitor — providers under web:" },
     { label: "ask", hint: "ask_person — ask the person running the desk mid-step, and wait for the answer" },
+    { label: "install", hint: "install apt, pip or npm packages mid-step — every agent has it; disallowedTools: [install] removes it" },
 ];
 const SDK_TOOL_NAMES = [
     { label: "Read", hint: "exact SDK name" },

package/dist/src/confine.d.ts

@@ -36,6 +36,7 @@ export declare function isWithin(root: string, abs: string): boolean;
 export declare function expandVirtual(raw: string, roots: Roots): {
     abs: string;
     readOnly: boolean;
+    prefix: string;
 } | null;
 export declare function checkPaths(toolName: string, input: Record<string, unknown>, roots: Roots): ConfineVerdict;
 export declare function checkBash(command: string): ConfineVerdict;

package/dist/src/confine.js

@@ -176,11 +176,22 @@ export function expandVirtual(raw, roots) {
     const candidate = rel !== null && !rel.startsWith("..") && !path.isAbsolute(rel) ? rel : raw;
     for (const v of VIRTUAL) {
         if (candidate.startsWith(v.prefix)) {
-            return { abs: path.resolve(v.root(roots), candidate.slice(v.prefix.length)), readOnly: v.readOnly };
+            return { abs: path.resolve(v.root(roots), candidate.slice(v.prefix.length)), readOnly: v.readOnly, prefix: v.prefix };
         }
     }
     return null;
 }
+/** Whether `<agentDir>/workspace` is the step's link to the workspace root
+ *  (linkWorkspace), so a `workspace/…` path opens the right file as written. */
+function linkedWorkspace(roots) {
+    const link = path.join(roots.agentDir, "workspace");
+    try {
+        return fs.lstatSync(link).isSymbolicLink() && real(link) === real(path.resolve(roots.workspaceRoot));
+    }
+    catch {
+        return false;
+    }
+}
 export function checkPaths(toolName, input, roots) {
     const workspace = real(path.resolve(roots.workspaceRoot));
     const library = real(path.resolve(roots.libraryRoot));
@@ -264,9 +275,16 @@ export function checkPaths(toolName, input, roots) {
             };
         }
         // Hand the real path back to the tool, so the virtual prefix the prompt
-        // advertises is one the agent can actually open.
-        if (virtual)
+        // advertises is one the agent can actually open — unless the step's
+        // `workspace` link already opens it. Then the path is left as written,
+        // because the SDK remembers what was Read under the path the tool ran
+        // with but checks an Edit against the one the model wrote, before this
+        // hook sees it: Read workspace/x (rewritten) then Edit workspace/x was
+        // refused "File has not been read yet" on every try, and blog-desk's
+        // fact-checker spent a pass on it (run-muuhguk3-vhrg, 2026-10-05).
+        if (virtual && !(virtual.prefix === "workspace/" && linkedWorkspace(roots))) {
             rewritten = { ...(rewritten ?? input), [key]: abs };
+        }
     }
     // Glob searches from `path` (the cwd when absent) and its PATTERN never
     // climbs: `../../storage/draft/*.md` answered "No files found" with the
@@ -350,6 +368,16 @@ const PROTECTED_BASH = [
             "instead.",
     },
 ];
+/**
+ * A web address, which names a place on a server rather than in the workspace.
+ *
+ * The protected-path patterns match a bare `runs/`, so an agent calling the
+ * platform's own API — `curl https://…/api/workspaces/x/runs/<id>` — was told
+ * it was reading the run journal. The weekly retros read their week through
+ * that API and were refused on 9 Oct 2026. Only http(s): a `file://` URL is a
+ * path, and stays checked.
+ */
+const WEB_URL = /\bhttps?:\/\/[^\s'"`)]+/gi;
 export function checkBash(command) {
     for (const re of BASH_ESCAPES) {
         if (re.test(command)) {
@@ -366,10 +394,11 @@ export function checkBash(command) {
         if (!segment.trim())
             continue;
         const writes = WRITES_TO_A_FILE.test(segment);
+        const paths = segment.replace(WEB_URL, " ");
         for (const rule of PROTECTED_BASH) {
             if (rule.writeOnly && !writes)
                 continue;
-            if (rule.re.test(segment))
+            if (rule.re.test(paths))
                 return { ok: false, reason: `Bash was denied: ${rule.reason}` };
         }
     }

package/dist/src/container.d.ts

@@ -15,6 +15,13 @@ export interface ContainerRunOptions {
     agentDir: string;
     /** Extra read-only mounts: host path → container path. */
     readOnly?: Record<string, string>;
+    /** Workspace paths a script was handed as `workspace/…`: copied in at
+     *  `container` before it runs, and what it created or changed under them
+     *  copied back to `host` after — the host's workspace link, as a copy. */
+    staged?: {
+        host: string;
+        container: string;
+    }[];
     image: string;
     argv: string[];
     env: Record<string, string>;
@@ -28,3 +35,5 @@ export declare function runInContainer(opts: ContainerRunOptions): Promise<{
     code: number | null;
     out: string;
 }>;
+/** Write `from` over `to` where the bytes differ; recurse into folders. */
+export declare function syncChanged(from: string, to: string): void;