@foldrun/core 0.7.0 → 1.1.0

package/src/store.ts

@@ -49,7 +49,8 @@ import { refNames } from "./refs.ts";
 import { parseBudget, budgetProblem } from "./budget.ts";
 import { timezoneProblem } from "./clock.ts";
 import { parseStepLimits, readLimits } from "./limits.ts";
-import { webProblems, webWarnings, runnerEngines } from "./providers.ts";
+import { networkProblems, resolveNetwork, type NetworkPolicy } from "./network.ts";
+import { webProblems, webWarnings, runnerEngines, webConfig } from "./providers.ts";
 import { actionProblems } from "./web-actions.ts";
 import { languageProblem } from "./language.ts";
 import { localeProblems } from "./locale.ts";
@@ -84,6 +85,7 @@ export const WORKSPACE_DIRS = [
   "knowledge",
   "tools",
   "scripts",
+  "hooks",
   "state",
 ] as const;
 
@@ -994,6 +996,15 @@ export interface AgentInfo {
   /** What is wrong with the `limits:` block's shape; key-vs-grant problems
    *  need the tool lists, and `check` adds them (limits.ts limitKeyProblems). */
   limitProblems: string[];
+  /** What cannot be read in `network:` (network.ts) — a level that is not
+   *  one, a site with a scheme or a path. */
+  networkProblems: string[];
+  /** The sites this agent's steps may reach, resolved the way a run
+   *  resolves them — its `network:`, the workspace's, the account's, and
+   *  the default (open when it may fetch or browse the web, else trusted).
+   *  `implied` here is its `apis:` hosts; a run also adds its MCP servers',
+   *  its web providers' and its bound secrets' sites. */
+  network: NetworkPolicy & { readsWeb: boolean };
   /** Tools this agent declares inline rather than in `tools:` — `apis:`,
    *  `scripts:` and `mcpServers:` names — which a limit may also name. */
   inlineTools: string[];
@@ -1535,6 +1546,16 @@ function inlineToolNames(data: Record<string, unknown>): string[] {
 export function listAgents(tenant: string, workspace: string): AgentInfo[] {
   const dir = path.join(workspaceDir(tenant, workspace), "agents");
   if (!fs.existsSync(dir)) return [];
+  // The two levels above every agent, for the network: cascade.
+  const frontOf = (file: string): Record<string, unknown> => {
+    try {
+      return readFrontmatter(file);
+    } catch {
+      return {}; // no AGENTS.md at that level, or one that does not parse
+    }
+  };
+  const accountFront = frontOf(path.join(accountDir(tenant), "AGENTS.md"));
+  const workspaceFront = frontOf(path.join(workspaceDir(tenant, workspace), "AGENTS.md"));
   return fs
     .readdirSync(dir)
     .filter((n) => fs.existsSync(path.join(dir, n, "agent.md")))
@@ -1542,7 +1563,20 @@ export function listAgents(tenant: string, workspace: string): AgentInfo[] {
     .map((name) => {
       const { data } = matter(fs.readFileSync(path.join(dir, name, "agent.md"), "utf8"));
       const tools = refNames(data.tools);
+      const actions = webConfig(data, { ...accountFront, ...workspaceFront }).actions;
+      const readsWeb = tools.includes("web") && (!actions || actions.some((a) => a === "fetch" || a === "browse"));
+      const network = {
+        ...resolveNetwork({
+          account: accountFront.network,
+          workspace: workspaceFront.network,
+          agent: data.network,
+          readsWeb,
+          implied: parseApis(data.apis).map((a) => { try { return new URL(a.base).host; } catch { return ""; } }),
+        }),
+        readsWeb,
+      };
       return {
+        network,
         name,
         description: data.description ?? "",
         model: data.model ?? "default",
@@ -1566,6 +1600,7 @@ export function listAgents(tenant: string, workspace: string): AgentInfo[] {
         webWarnings: webWarnings(data, { chrome: runnerEngines()?.chrome, chromium: runnerEngines()?.chromium }),
         scheduleProblem: agentScheduleProblem(data),
         ...(() => { const l = readLimits(data.limits); return { limits: l.limits, limitProblems: l.problems }; })(),
+        networkProblems: networkProblems(data.network),
         inlineTools: inlineToolNames(data),
       };
     });
@@ -3024,6 +3059,9 @@ export interface RunEvent {
    *  detail), `output: json`, a schema. What the runner reads to decline a
    *  retry of an outward step whose tools already ran. */
   check?: boolean;
+  /** Set on the line a hook wrote — a deny, a rewrite, context, a failure
+   *  (hooks.ts). The run page and the Hooks page read these. */
+  hook?: { hook: string; event: string; did: string; tool?: string; reason?: string; ms: number };
 }
 
 /** A question an agent asked a person while its step ran (tools: [ask]). */

package/src/tool-loop.ts

@@ -0,0 +1,176 @@
+// A model with tools that live in this process, and nothing else.
+//
+// What the platform's assistant needs (and what the eval judge and the flow
+// draft are a toolless special case of): one Agent SDK query whose ONLY
+// tools are the ones the caller passes — no built-in tool, no file system,
+// no shell, no sub-agent, no MCP server the machine happens to have — run in
+// a throwaway directory, inside a turn, dollar and wall-clock ceiling.
+//
+// The tools run here, in the caller's process, so whatever they read they
+// read with the caller's own scoping; the model only ever sees what a tool
+// returns. That is why this needs no sandbox pod: nothing the model asks for
+// is executed as code.
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { z } from "zod";
+import { query, createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
+import { hostSafeEnv } from "./host-env.ts";
+
+/** One string argument: what it means, whether it may be left out, how long it may be. */
+export interface LoopArg {
+  description?: string;
+  optional?: boolean;
+  max?: number;
+}
+
+export interface LoopTool {
+  name: string;
+  description: string;
+  args: Record<string, LoopArg>;
+  /** The answer the model reads. A throw becomes an error result, not a crash. */
+  run: (args: Record<string, string | undefined>) => Promise<string> | string;
+}
+
+export interface LoopUsage {
+  /** Everything sent, cache reads and writes included. */
+  inputTokens: number;
+  outputTokens: number;
+  costUsd: number;
+}
+
+export interface LoopResult {
+  /** The last turn's text — the answer, not the thinking aloud between tool calls. */
+  text: string;
+  /** What the SDK reports the query cost; 0 when it never reported (killed). */
+  costUsd: number;
+  usage: LoopUsage | null;
+  /** Why it ended, when it did not end well: max turns, budget, wall clock. */
+  stopped: string | null;
+}
+
+export interface LoopOptions {
+  system: string;
+  prompt: string;
+  tools: LoopTool[];
+  model: string;
+  /** The model credential and anything else the SDK process needs. */
+  env: Record<string, string | undefined>;
+  maxTurns: number;
+  maxBudgetUsd: number;
+  maxOutputTokens: number;
+  wallSeconds: number;
+  /** The reply as it is written, for a live view. */
+  onText?: (delta: string) => void;
+}
+
+const SERVER = "foldrun_tools";
+
+/** The Agent SDK's name for one of our tools. */
+export const loopToolName = (name: string) => `mcp__${SERVER}__${name}`;
+
+function schemaOf(args: Record<string, LoopArg>): z.ZodRawShape {
+  return Object.fromEntries(
+    Object.entries(args).map(([name, a]) => {
+      let s = z.string().min(a.optional ? 0 : 1);
+      if (a.max) s = s.max(a.max);
+      if (a.description) s = s.describe(a.description);
+      return [name, a.optional ? s.optional() : s];
+    }),
+  );
+}
+
+export async function runToolLoop(o: LoopOptions): Promise<LoopResult> {
+  const server = createSdkMcpServer({
+    name: SERVER,
+    version: "1.0.0",
+    tools: o.tools.map((t) =>
+      tool(t.name, t.description, schemaOf(t.args), async (args: Record<string, unknown>) => {
+        try {
+          const plain = Object.fromEntries(Object.entries(args).map(([k, v]) => [k, v === undefined ? undefined : String(v)]));
+          return { content: [{ type: "text" as const, text: await t.run(plain) }] };
+        } catch (err) {
+          return { content: [{ type: "text" as const, text: `error: ${err instanceof Error ? err.message : String(err)}` }], isError: true };
+        }
+      }),
+    ),
+  });
+  // Homeless on purpose: there are no file tools, and a throwaway cwd means
+  // even a confused call has no tree to touch.
+  const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-loop-"));
+  const abort = new AbortController();
+  let killed = false;
+  const watchdog = setTimeout(() => {
+    killed = true;
+    abort.abort();
+  }, o.wallSeconds * 1000);
+  watchdog.unref?.();
+
+  let text = "";
+  let costUsd = 0;
+  let usage: LoopUsage | null = null;
+  let stopped: string | null = null;
+  try {
+    const q = query({
+      prompt: o.prompt,
+      options: {
+        model: o.model,
+        systemPrompt: o.system,
+        // No built-in tool at all (no Task, so no sub-agents either) — only
+        // ours, each pre-approved; anything else is refused unasked.
+        tools: [],
+        mcpServers: { [SERVER]: server },
+        strictMcpConfig: true,
+        allowedTools: o.tools.map((t) => loopToolName(t.name)),
+        permissionMode: "dontAsk",
+        settingSources: [],
+        persistSession: false,
+        maxTurns: o.maxTurns,
+        maxBudgetUsd: o.maxBudgetUsd,
+        includePartialMessages: true,
+        cwd: scratch,
+        abortController: abort,
+        env: { ...hostSafeEnv(), ...o.env, CLAUDE_CODE_MAX_OUTPUT_TOKENS: String(o.maxOutputTokens) },
+      },
+    });
+    let turn = "";
+    for await (const message of q) {
+      if (message.type === "stream_event") {
+        const e = message.event;
+        if (e.type === "message_start") turn = "";
+        if (e.type === "content_block_delta" && e.delta.type === "text_delta") {
+          turn += e.delta.text;
+          o.onText?.(e.delta.text);
+        }
+      } else if (message.type === "assistant") {
+        const said = message.message.content
+          .filter((b) => b.type === "text")
+          .map((b) => (b as { text: string }).text)
+          .join("");
+        if (said.trim()) text = said;
+      } else if (message.type === "result") {
+        costUsd = message.total_cost_usd ?? 0;
+        const models = Object.values(message.modelUsage ?? {});
+        usage = {
+          inputTokens: models.reduce((n, m) => n + (m.inputTokens ?? 0) + (m.cacheReadInputTokens ?? 0) + (m.cacheCreationInputTokens ?? 0), 0),
+          outputTokens: models.reduce((n, m) => n + (m.outputTokens ?? 0), 0),
+          costUsd,
+        };
+        if (message.subtype === "success") {
+          if (message.result?.trim()) text = message.result;
+        } else {
+          stopped = message.subtype;
+          if (!text) text = turn;
+        }
+      }
+    }
+  } catch (err) {
+    if (!killed) throw err;
+  } finally {
+    clearTimeout(watchdog);
+    fs.rmSync(scratch, { recursive: true, force: true });
+  }
+  if (killed) stopped = `ran past ${o.wallSeconds}s`;
+  return { text, costUsd, usage, stopped };
+}