@foldrun/core 0.5.0 → 0.7.0

package/src/provider-health.ts

@@ -18,6 +18,7 @@
 // It reads the same provider block a run reads, resolved the same way, so a
 // pass here means a run would reach the same place with the same key.
 
+import { accountModelBlock } from "./model-credential.ts";
 import fs from "node:fs";
 import path from "node:path";
 import matter from "gray-matter";
@@ -236,6 +237,8 @@ export function providersInUse(tenant: string): ProviderInUse[] {
   };
 
   add(frontmatterOf(path.join(accountDir(tenant), "AGENTS.md")).provider, null, "account");
+  // The account's own key from Settings → Model, which needs no block.
+  add(accountModelBlock((name) => getSecret(tenant, name)?.value ?? null), null, "account (Settings → Model)");
   for (const ws of safeList(() => listWorkspaces(tenant))) {
     const dir = workspaceDir(tenant, ws.name);
     add(frontmatterOf(path.join(dir, "AGENTS.md")).provider, ws.name, ws.name);

package/src/run-container.ts

@@ -25,10 +25,10 @@ import crypto from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
 import type { McpServerConfig } from "@anthropic-ai/claude-agent-sdk";
 import { isPlatformPath, type ApiSpec, type Effort } from "./store.ts";
-import { divertedSummary, isDivertedPath } from "./test-mode.ts";
+import { divertedSummary, isDivertedPath, overlayTestWrites } from "./test-mode.ts";
 import type { EventExtra } from "./step-exec.ts";
 import { isFileValue, fileContent } from "./secrets.ts";
-import { safeTenantSegment, type RuntimeSpec } from "./runtime.ts";
+import { safeTenantSegment, systemInstallSh, SYSTEM_FROM_INPUT_SH, INSTALL_SOCKET, type RuntimeSpec } from "./runtime.ts";
 import type { ScriptSpec } from "./script-tools.ts";
 import type { ConsultSpec } from "./agent-tools.ts";
 import type { SubagentSpec } from "./subagents.ts";
@@ -293,18 +293,37 @@ export function mergeAppends(was: Buffer | string | null, host: Buffer, next: Bu
   let common = 0;
   const max = Math.min(h.length, n.length);
   while (common < max && h.charCodeAt(common) === n.charCodeAt(common)) common++;
-  for (let end = common; end >= 0; end--) {
-    if (end > 0 && h[end - 1] !== "\n") continue;
-    const prefix = h.slice(0, end);
-    const matches =
-      typeof was === "string" ? sha(Buffer.from(prefix, "utf8")) === was : Buffer.from(prefix, "utf8").equals(was);
-    if (!matches) continue;
-    const hostAdded = h.slice(end);
-    const stepAdded = n.slice(end);
-    const joined = hostAdded && !hostAdded.endsWith("\n") ? hostAdded + "\n" : hostAdded;
-    return Buffer.from(prefix + joined + stepAdded, "utf8");
+  // One pass over the shared prefix. Rebuilding and hashing the prefix at
+  // every line boundary, from the longest down, was quadratic: on 6 Oct 2026
+  // a conflicted file of a few MB held the worker's event loop for minutes,
+  // the liveness probe killed it every 4.5 minutes, and every step on the box
+  // lost its model connection.
+  let end = -1;
+  if (typeof was === "string") {
+    const run = crypto.createHash("sha256");
+    if (run.copy().digest("hex") === was) end = 0;
+    let from = 0;
+    for (let nl = h.indexOf("\n"); nl !== -1 && nl < common; nl = h.indexOf("\n", nl + 1)) {
+      run.update(h.slice(from, nl + 1), "utf8");
+      from = nl + 1;
+      if (run.copy().digest("hex") === was) end = from;
+    }
+  } else {
+    // The base's bytes are known, so it can only end at their length.
+    const base = was.toString("utf8");
+    if (
+      base.length <= common &&
+      (base.length === 0 || base.endsWith("\n")) &&
+      h.startsWith(base) &&
+      Buffer.from(base, "utf8").equals(was)
+    )
+      end = base.length;
   }
-  return null;
+  if (end < 0) return null;
+  const hostAdded = h.slice(end);
+  const stepAdded = n.slice(end);
+  const joined = hostAdded && !hostAdded.endsWith("\n") ? hostAdded + "\n" : hostAdded;
+  return Buffer.from(h.slice(0, end) + joined + stepAdded, "utf8");
 }
 
 export function applyContainerChanges(
@@ -408,6 +427,13 @@ export function applyContainerChanges(
  */
 export const RUNTIME_CACHE = "/home/agent/.foldrun/runner/.runtimes";
 
+/** Starts the install helper as root, in the background, before the drop to
+ *  the agent user: the root half of the `install` tool (install-helper.ts).
+ *  The agent reaches it only through the socket; it installs only validated
+ *  Debian package names, and dies with the container. */
+export const INSTALL_HELPER_SH = `FOLDRUN_INSTALL_SOCKET=${INSTALL_SOCKET}; export FOLDRUN_INSTALL_SOCKET
+node /opt/runner/node_modules/@foldrun/core/dist/src/install-helper.js "$FOLDRUN_INSTALL_SOCKET" ${RUNTIME_CACHE} >/dev/null 2>&1 &`;
+
 /**
  * Where the platform's shared runtime layer is mounted, read-only, in a run
  * pod — and read-write, one entry at a time, in the pod that builds an entry
@@ -548,6 +574,25 @@ try {
   // meet the packages its runtime declared, not the image's bare python.
   Object.assign(env, runtime.env);
 
+  // install: what the agent finds it needs mid-step. apt goes through the
+  // root start-up's helper (install-helper.ts); pip and npm land in a
+  // directory of this container's own, on the paths from the first turn.
+  const { buildInstallTool, INSTALL_TOOL } = await import("@foldrun/core/install-tool");
+  const { stepInstallEnv, INSTALL_SOCKET } = await import("@foldrun/core/runtime");
+  const installDir = "/home/agent/.foldrun/step";
+  const installing = (input.allowed ?? []).includes(INSTALL_TOOL);
+  if (installing) Object.assign(env, stepInstallEnv(installDir, env));
+  const install = installing
+    ? buildInstallTool({
+        dir: installDir,
+        socket: env.FOLDRUN_INSTALL_SOCKET || INSTALL_SOCKET,
+        cacheRoot: "${RUNTIME_CACHE}",
+        python: env.VIRTUAL_ENV ? env.VIRTUAL_ENV + "/bin/python" : "python3",
+        env,
+        emit,
+      })
+    : { server: null };
+
   // API and script tools, rebuilt in here from their specs. Secrets were
   // substituted into API headers before the input crossed the boundary, so
   // buildApiTools gets an already-resolved environment. verify: gets the
@@ -598,6 +643,7 @@ try {
       ...(history.server ? { foldrun_history: history.server } : {}),
       ...(desks.server ? { foldrun_desks: desks.server } : {}),
       ...(ask.server ? { foldrun_ask: ask.server } : {}),
+      ...(install.server ? { foldrun_install: install.server } : {}),
       ...input.mcpServers,
     },
     ...(inbox ? { inbox } : {}),
@@ -617,7 +663,7 @@ try {
     // through the account's pod, and named the file the web tool logs its
     // reconnects to. A lost pod stops the step; what it wrote decides what
     // the runner does next (browser-pod.ts).
-    ...(env.FOLDRUN_BROWSER_POD_EVENTS ? { browserPod: { events: env.FOLDRUN_BROWSER_POD_EVENTS, methods: api.methods ?? {}, paidWeb: paidWebActions(env) } } : {}),
+    ...(env.FOLDRUN_BROWSER_POD_EVENTS ? { browserPod: { events: env.FOLDRUN_BROWSER_POD_EVENTS, methods: api.methods ?? {}, paidWeb: paidWebActions(env), ...(env.FOLDRUN_BROWSER_INIT ? { browseInit: env.FOLDRUN_BROWSER_INIT } : {}) } } : {}),
     // The container is the boundary; the SDK's own bash sandbox here would
     // only block declared network use (SSH, curl) for no added safety.
     sandboxBash: false,
@@ -647,17 +693,30 @@ try {
 }
 `;
 
+// Core itself is installed in a stage of its own (CORE_STAGE) and only the
+// result is copied in: the tarball and the package README — which explains
+// foldrun to a person reading the repo, and which no step reads — stay in
+// that stage and never become a layer of the image. Owner rule, 2026-10-02:
+// foldrun's own docs live in git, not in containers.
+const CORE_STAGE = `FROM base AS core
+WORKDIR /opt/runner
+COPY foldrun-core.tgz ./
+RUN npm init -y >/dev/null && npm install ./foldrun-core.tgz --omit=dev \\
+ && npm cache clean --force >/dev/null 2>&1 \\
+ && rm -f foldrun-core.tgz node_modules/@foldrun/core/README.md
+`;
+
 // docker cp writes root-owned files, so the entrypoint starts as root for
 // exactly two commands — chown the copied-in trees, drop to the agent user —
 // and the run flags grant only the three capabilities those two commands
 // need. By the time any model-directed code executes, the process is uid
 // 10001 with no capabilities at all.
 const CORE_INSTALL = `WORKDIR /opt/runner
-COPY foldrun-core.tgz driver.mjs entry.sh ./
-RUN npm init -y >/dev/null && npm install ./foldrun-core.tgz --omit=dev \\
- && npm cache clean --force >/dev/null 2>&1 \\
- && mkdir -p /workspace /library /opt/runner/job ${RUNTIME_CACHE} ${SHARED_RUNTIMES} \\
- && chown -R agent:agent /workspace /library /opt/runner /home/agent/.foldrun /opt/foldrun-runtimes \\
+COPY --from=core --chown=agent:agent /opt/runner/ ./
+COPY --chown=agent:agent driver.mjs entry.sh ./
+RUN mkdir -p /workspace /library /opt/runner/job ${RUNTIME_CACHE} ${SHARED_RUNTIMES} \\
+ && chown agent:agent /opt/runner \\
+ && chown -R agent:agent /workspace /library /opt/runner/job /home/agent/.foldrun /opt/foldrun-runtimes \\
  && chmod +x /opt/runner/entry.sh
 ENTRYPOINT ["/opt/runner/entry.sh"]
 `;
@@ -724,6 +783,7 @@ RUN apt-get update \\
 COPY --from=ghcr.io/astral-sh/uv:${UV_VERSION} /uv /uvx /usr/local/bin/
 ENV PLAYWRIGHT_BROWSERS_PATH=/opt/browser NODE_PATH=/usr/local/lib/node_modules
 
+${CORE_STAGE}
 FROM base AS slim
 # Fonts, because a step that draws text without a browser still needs them:
 # the full image gets 51 from Playwright's --with-deps, slim had none, so from
@@ -879,7 +939,14 @@ RUN node -e ' \\
 FROM browsers AS full
 ${CORE_INSTALL}`;
 
+// runtime: system: — apt as root, before the drop (runtime.ts systemInstallSh).
+// set -e is off around it: a failed install is reported by the driver, which
+// reads the status file and fails the step with apt's own words.
 const ENTRY = `#!/bin/sh
+set +e
+${SYSTEM_FROM_INPUT_SH}
+${systemInstallSh(RUNTIME_CACHE)}
+${INSTALL_HELPER_SH}
 set -e
 chown -R agent:agent /workspace /library /opt/runner/job
 # The runtime cache, when one is mounted. NOT recursive: a warm cache is tens
@@ -1299,6 +1366,12 @@ export async function runStepInContainer(args: RunInContainerArgs): Promise<Cont
       preserveTimestamps: true,
       filter: (src) => !isPlatformPath(path.relative(args.workspaceRoot, src)),
     });
+    // A test run: what its earlier steps wrote, over the real files (the
+    // copy is the baseline too, so only this step's own writes come back).
+    if (args.divert) {
+      const laid = overlayTestWrites(wsIn, args.divert.to);
+      if (laid.length) args.emit("info", `test: this step sees ${laid.length} file${laid.length === 1 ? "" : "s"} earlier steps of this run wrote`);
+    }
     const libIn = path.join(staging, "library");
     if (args.galleryRoot && fs.existsSync(args.galleryRoot)) fs.cpSync(args.galleryRoot, libIn, { recursive: true });
     if (fs.existsSync(args.libraryRoot)) fs.cpSync(args.libraryRoot, libIn, { recursive: true });