@foldrun/core 1.0.0 → 1.1.1

package/src/runner.ts

@@ -81,7 +81,8 @@ import {
   runCost,
 } from "./store.ts";
 import { loadCatalog, checkModel, clampEffort, catalogCost, findModel, type Catalog } from "./catalog.ts";
-import { resolveSecrets, getSecret, materializeSecrets } from "./secrets.ts";
+import { resolveSecrets, getSecret, materializeSecrets, secretSites } from "./secrets.ts";
+import { resolveNetwork, networkLine, proxyEnv, EGRESS_CA_ENV } from "./network.ts";
 import { materializeFileSecrets, cleanupFileSecrets } from "./secret-files.ts";
 import { buildApiTools, secretsUsedByApi } from "./api-tools.ts";
 import { attachOperations, prefetchOpenApi } from "./openapi.ts";
@@ -109,6 +110,30 @@ export { localDate } from "./clock.ts";
 // An MCP tool definition becomes an SDK server config. ${SECRET} placeholders
 // in env and headers resolve server-side, so a credential reaches the server
 // process without ever entering the model's context.
+/** Remote MCP servers with each bound secret's value put back as its
+ *  `${NAME}`, granted to that server's host — the sandbox then holds the
+ *  name and the proxy fills it, as for an http tool. */
+function unbindMcpHeaders(
+  servers: Record<string, McpServerConfig>,
+  bound: string[],
+  values: Record<string, string>,
+  grant: EgressGrant,
+): Record<string, McpServerConfig> {
+  const known = Object.fromEntries(bound.filter((n) => n in values).map((n) => [n, values[n]]));
+  const out: Record<string, McpServerConfig> = {};
+  for (const [name, server] of Object.entries(servers)) {
+    if (server.type !== "http" || !server.headers) {
+      out[name] = server;
+      continue;
+    }
+    const host = hostOf(server.url);
+    out[name] = host
+      ? { ...server, headers: Object.fromEntries(Object.entries(server.headers).map(([k, v]) => [k, unsubstitute(v, known, host, grant)])) }
+      : server;
+  }
+  return out;
+}
+
 function mcpConfig(spec: McpSpec, tenant: string, workspace: string): McpServerConfig {
   const fill = (values: Record<string, string>) => {
     const out: Record<string, string> = {};
@@ -2420,7 +2445,45 @@ async function runStep(
           }
         }
       }
+      // `network:` — which sites the sandbox may reach (network.ts). Resolved
+      // before the lease, because the proxy holds the list per request. A
+      // step that may fetch or browse the open web defaults to open; every
+      // other to the trusted list plus what it declares.
+      const workspaceName = path.basename(workspaceRootOf(agentDir));
+      const readsWeb = scriptSpecs.some((sc) => sc.name === "web") && (!web.actions || web.actions.some((a) => a === "fetch" || a === "browse"));
+      // Secrets bound to sites in the vault: filled by the proxy for those
+      // sites alone, never put in the sandbox (egress.ts).
+      const boundSites = secretSites(tenant, Object.keys(liveSecrets), workspaceName);
+      const network = resolveNetwork({
+        account: readAgentsMd(accountDir(tenant))?.data?.network,
+        workspace: readAgentsMd(workspaceRootOf(agentDir))?.data?.network,
+        agent: front.network,
+        readsWeb,
+        implied: [
+          ...apiSpecs.map((a) => hostOf(a.base)).filter((h): h is string => !!h),
+          ...Object.values(mcpServers).map((m) => ("url" in m && typeof m.url === "string" ? hostOf(m.url) : null)).filter((h): h is string => !!h),
+          ...Object.values(grant.secrets).flatMap((g) => g.hosts),
+          ...Object.values(boundSites).flat(),
+        ],
+      });
+      grant.network = { level: network.level, hosts: network.hosts };
       const lease = await platform.egress.lease({ tenant, runId: runId ?? "adhoc", grant, test: testRun, ...(stepIndex !== undefined && stepIndex >= 0 ? { step: stepIndex } : {}) });
+      // The forward door: every program in the sandbox sends through the
+      // proxy, which holds the site list and fills bound secrets. A proxy
+      // without the door (an older platform) leaves programs going direct.
+      // A step that may browse gets no proxy variables: the browser in it
+      // reads HTTPS_PROXY too, and Chromium cannot send credentials written
+      // into a proxy URL — every page failed ERR_INVALID_AUTH_CREDENTIALS
+      // (14 Oct 2026, the reel posters). Such a step is open by default,
+      // and its bound secrets materialise as they did before the door.
+      const browses = scriptSpecs.some((sc) => sc.name === "web") && (!web.actions || web.actions.includes("browse"));
+      const forward = lease?.proxy && !browses ? lease : null;
+      push("info", networkLine(network, forward ? forward.enforce === true : null));
+      const bound = forward ? Object.keys(boundSites).filter((name) => name in liveSecrets) : [];
+      for (const name of bound) {
+        for (const site of boundSites[name]) addGrant(grant, name, liveSecrets[name], site);
+        (grant.healthKeys ??= {})[name] = healthKey(name, secretScopes[name] === "workspace" ? "workspace" : "account", workspaceName);
+      }
       // Which secrets must still be real inside the sandbox: a script tool
       // reads them from its environment, and unless it says `secrets:
       // proxied` it needs the value, not the name. bash is a script by
@@ -2432,22 +2495,27 @@ async function runStep(
         ...(scriptSpecs.some((sc) => sc.name === "web") && (!web.actions || web.actions.includes("browse")) ? ["web (browse)"] : []),
         ...(allowed.includes("Bash") ? ["bash"] : []),
       ];
-      const materialise = !lease || materialisers.length > 0;
       const declared = Object.keys(liveSecrets);
+      // A bound secret is never materialised, whatever the step grants.
+      const unbound = declared.filter((name) => !bound.includes(name));
+      const materialise = (!lease || materialisers.length > 0) && unbound.length > 0;
       if (lease) {
+        const boundNote = bound.length ? `${bound.join(", ")} bound to sites — filled by the egress proxy, never in the sandbox` : "";
         push(
           "info",
           declared.length
             ? materialise
-              ? `secrets: ${declared.join(", ")} materialised in the sandbox for ${materialisers.join(", ")}; api tools and the model key go through the egress proxy`
-              : `secrets: ${declared.join(", ")} proxied — nothing in the sandbox but the names`
+              ? `secrets: ${unbound.join(", ")} materialised in the sandbox for ${materialisers.join(", ")}${boundNote ? `; ${boundNote}` : ""}; api tools and the model key go through the egress proxy`
+              : `secrets: ${declared.join(", ")} proxied — nothing in the sandbox but the names${boundNote ? ` (${boundNote})` : ""}`
             : "secrets: none declared; the model key goes through the egress proxy",
         );
       }
       // Sandbox env for the declared secrets: the value, or its own name as
       // a placeholder that the proxy fills on the way out.
       const placeholders = Object.fromEntries(declared.map((name) => [name, `\${${name}}`]));
-      let sandboxSecrets: Record<string, string> = materialise ? liveSecrets : placeholders;
+      let sandboxSecrets: Record<string, string> = materialise
+        ? { ...liveSecrets, ...Object.fromEntries(bound.map((name) => [name, placeholders[name]])) }
+        : placeholders;
       // A test run hands the sandbox no send-capable value. The env var is
       // still there, reading TEST_MODE_WITHHELD, so a script that never
       // checked FOLDRUN_TEST_MODE fails at the provider's door with an auth
@@ -2455,11 +2523,13 @@ async function runStep(
       // has a declared sender (everything withheld) or a declared reader
       // (nothing withheld); see test-mode.ts for the order.
       if (testRun && materialise) {
-        const held = withholdSecrets(liveSecrets, {
+        const held = withholdSecrets(Object.fromEntries(unbound.map((name) => [name, liveSecrets[name]])), {
           outward: scriptSpecs.some((sc) => sc.outward),
           allow: scriptSpecs.some((sc) => sc.testMode === "allow"),
         });
-        sandboxSecrets = held.env;
+        // Bound secrets stay placeholders: the proxy, which holds the test
+        // policy, is the only party that ever fills them.
+        sandboxSecrets = { ...held.env, ...Object.fromEntries(bound.map((name) => [name, placeholders[name]])) };
         for (const name of held.withheld) {
           push("info", `test: ${name} withheld from the sandbox — TEST_MODE_WITHHELD`, { effect: { kind: "withheld", summary: `${name} withheld from the sandbox` } });
         }
@@ -2517,7 +2587,9 @@ async function runStep(
           systemPrompt,
           allowed,
           mcpNames: consultNames,
-          mcpServers,
+          // A remote MCP server's headers had their secrets filled host-side;
+          // a bound one goes back to its ${NAME} for the proxy to fill.
+          mcpServers: bound.length ? unbindMcpHeaders(mcpServers, bound, liveSecrets, grant) : mcpServers,
           apis: substitutedApis,
           scripts: scriptSpecs,
           // The merged spec, not `front.runtime` — see the plan's `runtime`
@@ -2561,6 +2633,14 @@ async function runStep(
             // after and carries the agent's chosen endpoint + token.
             ...proxied(Object.keys(providerEnv).length === 0 ? modelEnv : providerEnv, keyName),
             ...(lease ? { [EGRESS_ENV]: lease.url } : {}),
+            // Every program's HTTP(S) through the proxy's forward door, and
+            // the CA it signs bound sites with, for the sandbox to trust.
+            ...(forward ? proxyEnv(forward.proxy!) : {}),
+            // Only a step with a bound secret has a site the proxy
+            // intercepts, so only that step's TLS clients are pointed at a
+            // bundle with the egress CA in it; every other step's are as
+            // they always were.
+            ...(forward?.ca && bound.length ? { [EGRESS_CA_ENV]: Buffer.from(forward.ca).toString("base64") } : {}),
             ...clockEnv,
             // Who is running: the in-process path stamps scripts with these
             // host-side, but a container rebuilds its tools from its own
@@ -2578,6 +2658,9 @@ async function runStep(
         // Stamps the sandbox, so stopping this run can destroy it.
         runId,
         size,
+        // The pod's network, for the executor's own wall (the k8s tier's
+        // network policy): a filtered pod reaches the proxy and DNS only.
+        network: { level: network.level, enforced: forward?.enforce === true },
         // A test run's state/ and storage/ changes come out under the run.
         divert: testRun && runId ? divertFor(runId) : undefined,
         test: testRun,
@@ -4558,9 +4641,12 @@ function driveRunInner(
         // Not after a stop: the failure a stop leaves behind is not one a
         // rescuer should take over. The merge in save() surfaces the flag.
         save();
-        for (const step of freshGroup) {
-          if (run.stopRequested) break;
-          if (step.status !== "failed" || !step.onFail) continue;
+        // One rescue of one failed step. Also used when an evaluator loop
+        // runs out of cycles below, which used to fail the run without ever
+        // reaching the step's on-fail (medium-desk's claim-trimmer was
+        // written for exactly that case and could never run).
+        const rescueStep = async (step: StepRecord): Promise<void> => {
+          if (!step.onFail) return;
           const rescuerDir = path.join(pDir, "agents", step.onFail);
           if (!fs.existsSync(path.join(rescuerDir, "agent.md"))) {
             step.events.push({
@@ -4568,7 +4654,7 @@ function driveRunInner(
               type: "error",
               text: `on-fail: "${step.onFail}" is not an agent in this workspace — no rescue`,
             });
-            continue;
+            return;
           }
           step.events.push({
             t: new Date().toISOString(),
@@ -4576,11 +4662,22 @@ function driveRunInner(
             text: `failed — handing to [[${step.onFail}]] (on-fail)`,
           });
           const failure = (step.result ?? step.events.filter((e) => e.type === "error").map((e) => e.text).join("\n")).slice(0, 4000);
+          // A gated step's approval travels with it: the rescuer acts inside
+          // the same answer the failed agent had, and must be told what it
+          // was. Fixers used to dig it out of the run record, and stop when
+          // they could not (15 Oct 2026).
+          const approved = step.approvedAt
+            ? `\nA person approved this step before it ran${step.approvalNote ? " — their answer is below" : ", with no note: a plain yes"}. Act within that approval and nothing wider.`
+            : "";
+          const owesMarker = step.until ? `\nThe step's loop ended without its marker: your reply must end with a line saying ${step.until}.` : "";
           const rescue: StepRecord = {
             agent: step.onFail,
             instruction:
               `${step.instruction}\n\n<rescue>\nYou are taking this step over: [[${step.agent}]] attempted it and failed. ` +
-              `Its failure, for whatever it is worth:\n${failure}\n</rescue>`,
+              `Its failure, for whatever it is worth:\n${failure}${approved}${owesMarker}\n</rescue>`,
+            ...(step.ask ? { ask: step.ask } : {}),
+            ...(step.approvedAt ? { approvedAt: step.approvedAt } : {}),
+            ...(step.approvalNote ? { approvalNote: step.approvalNote } : {}),
             group: step.group,
             optional: false,
             model: step.model,
@@ -4626,6 +4723,11 @@ function driveRunInner(
             });
           }
           save();
+        };
+        for (const step of freshGroup) {
+          if (run.stopRequested) break;
+          if (step.status !== "failed" || !step.onFail) continue;
+          await rescueStep(step);
         }
 
         // A step carried into a re-run failed in the run it came from, not
@@ -4726,7 +4828,21 @@ function driveRunInner(
             text: `loop exhausted: after ${looper.loop} cycle${looper.loop === 1 ? "" : "s"} the result still does not say "${looper.until}"`,
           });
           save();
-          if (!looper.optional) {
+          if (looper.onFail && !run.stopRequested) {
+            await rescueStep(looper);
+            // The rescuer owes what the loop owed: its marker.
+            // rescueStep mutates the status; widen past TS's "failed" narrowing.
+            if ((looper.status as string) === "completed" && !saysUntilMarker(looper.result ?? null, looper.until)) {
+              looper.status = "failed";
+              looper.events.push({
+                t: new Date().toISOString(),
+                type: "error",
+                text: `on-fail: [[${looper.onFail}]]'s result does not say "${looper.until}" either`,
+              });
+              save();
+            }
+          }
+          if ((looper.status as string) === "failed" && !looper.optional) {
             run.status = "failed";
             break;
           }

package/src/secrets.ts

@@ -42,6 +42,7 @@ const tenantKey = (tenant: string) => platform.tenantKey(tenant);
 import crypto from "node:crypto";
 import { assertSafeName } from "./store.ts";
 import { trimSlashes } from "./paths.ts";
+import { SITE } from "./network.ts";
 
 const keyFile = () => path.join(dataRoot(), ".secret-key");
 
@@ -99,6 +100,11 @@ interface StoredSecret {
    *  record written before per-account keys existed is encrypted with — so an
    *  old vault stays readable without a migration having to run first. */
   k?: "tenant";
+  /** The sites this secret is bound to (network.ts SITE shape). A bound
+   *  secret never enters a sandbox: the egress proxy fills its `${NAME}` for
+   *  these sites alone. Metadata, not a value, so it is stored in the clear
+   *  beside the ciphertext and survives the value being set again. */
+  sites?: string[];
 }
 
 type SecretsFile = Record<string, StoredSecret>;
@@ -195,15 +201,67 @@ export function setSecret(
   if (value.length > 8192) throw new Error("secret too long");
   const sealed = encryptValue(tenant, value);
   mutateVaultFile(secretsFile(tenant, workspace), (all) => {
+    // A new value keeps the sites the old one was bound to: binding is a
+    // property of the credential's use, not of its current value, and a
+    // rotation that silently unbound it would put the new value in pods.
+    const sites = all[name]?.sites;
     all[name] = {
       ...sealed,
       updatedAt: new Date().toISOString(),
       ...(kind ? { kind } : {}),
+      ...(sites?.length ? { sites } : {}),
     };
     return all;
   });
 }
 
+/**
+ * Bind a secret to sites, or unbind it (an empty list). The secret must
+ * exist in that scope. Sites are `api.example.com` or `*.example.com` — no
+ * scheme, path or port. Returns the list as stored.
+ */
+export function setSecretSites(tenant: string, name: string, sites: string[], workspace?: string): string[] {
+  const clean = [...new Set(sites.map((x) => x.trim().toLowerCase()).filter(Boolean))];
+  for (const site of clean) {
+    if (!SITE.test(site)) throw new Error(`"${site}" is not a site — a domain like api.example.com or *.example.com, no scheme, path or port`);
+  }
+  let found = false;
+  mutateVaultFile(secretsFile(tenant, workspace), (all) => {
+    const rec = all[name];
+    if (!rec) return null;
+    found = true;
+    // A file, an ssh key or an @api header set is not a value that travels
+    // in a header — it is unpacked inside the sandbox, so there is nothing
+    // for the proxy to fill.
+    if (clean.length && (rec.kind === "file" || rec.kind === "ssh" || rec.kind === "api")) {
+      throw new Error(`${name} is a ${rec.kind} secret, unpacked inside the sandbox — only a value sent in a request can be bound to sites`);
+    }
+    if (clean.length) rec.sites = clean;
+    else delete rec.sites;
+    return all;
+  });
+  if (!found) throw new Error(`no secret ${name}${workspace ? ` in workspace ${workspace}` : " in the account"}`);
+  return clean;
+}
+
+/**
+ * The sites each named secret is bound to, nearest scope first — the same
+ * record getSecret would read the value from. A name with no binding (or
+ * no secret) is absent from the answer.
+ */
+export function secretSites(tenant: string, names: string[], workspace?: string): Record<string, string[]> {
+  const out: Record<string, string[]> = {};
+  const own = workspace ? read(tenant, workspace) : {};
+  const source = workspace ? platform.previewSourceOf(tenant, workspace) : null;
+  const inherited = source ? read(tenant, source) : {};
+  const account = read(tenant);
+  for (const name of names) {
+    const rec = own[name] ?? inherited[name] ?? account[name];
+    if (rec?.sites?.length) out[name] = [...rec.sites];
+  }
+  return out;
+}
+
 /**
  * Which key writes this account's records.
  *
@@ -321,6 +379,9 @@ export interface SecretEntry {
   /** How this credential works: auto-refreshing oauth2, a signed service
    *  account, a file/ssh/api materialised into runs — absent for static values. */
   kind?: SecretKind;
+  /** The sites it is bound to — the proxy fills it for these and no other,
+   *  and it never enters a sandbox. Absent when unbound. */
+  sites?: string[];
 }
 
 // Metadata only — never values. Without a workspace this lists the account
@@ -332,6 +393,7 @@ export function listSecrets(tenant: string, workspace?: string): SecretEntry[] {
     updatedAt: rec.updatedAt,
     scope: "account" as const,
     ...(rec.kind ? { kind: rec.kind } : {}),
+    ...(rec.sites?.length ? { sites: [...rec.sites] } : {}),
   }));
   if (!workspace) return account.sort((a, b) => a.name.localeCompare(b.name));
 
@@ -341,6 +403,7 @@ export function listSecrets(tenant: string, workspace?: string): SecretEntry[] {
     scope: "workspace" as const,
     shadowed: account.some((a) => a.name === name),
     ...(rec.kind ? { kind: rec.kind } : {}),
+    ...(rec.sites?.length ? { sites: [...rec.sites] } : {}),
   }));
   const ownNames = new Set(own.map((s) => s.name));
   return [...own, ...account.filter((a) => !ownNames.has(a.name))].sort((a, b) =>
@@ -913,7 +976,12 @@ export function rewrapTenantSecrets(tenant: string): { moved: number; unreadable
       if (plain.size === 0 || unreadableHere.length) return null;
       const next: SecretsFile = { ...all };
       for (const [name, value] of plain) {
-        next[name] = { ...encryptValue(tenant, value), updatedAt: all[name].updatedAt, ...(all[name].kind ? { kind: all[name].kind } : {}) };
+        next[name] = {
+          ...encryptValue(tenant, value),
+          updatedAt: all[name].updatedAt,
+          ...(all[name].kind ? { kind: all[name].kind } : {}),
+          ...(all[name].sites?.length ? { sites: all[name].sites } : {}),
+        };
       }
       moved += plain.size;
       return next;

package/src/starter.ts

@@ -311,7 +311,11 @@ memory an agent wrote that your push does not mention. Those belong to the platf
 reverted what an agent learned would make every run a little dumber.
 
 Secrets never go in these files. \`foldrun secrets\` puts them in the vault, and
-agents reference them by name.
+agents reference them by name. Bind one to the sites it is for
+(\`foldrun secrets sites NAME api.example.com\`) and it never enters a sandbox:
+the egress proxy fills \`\${NAME}\` in requests to those sites alone. Which sites
+a sandbox may reach at all is \`network:\` — open for an agent that reads the web,
+the trusted list plus what it declares for every other (\`foldrun agent network\`).
 
 ## Talking to a deployed workspace
 
@@ -357,6 +361,7 @@ All of it, \`/api/workspaces/<workspace>\` unless noted:
 | \`/export\` · \`/import\` | GET · POST | the workspace, a flow (\`?kind=flow&name=\`) or an agent as a .zip; take one in (\`?dryRun=1\` first, \`?overwrite=1\` to replace) |
 | \`/restore\` | POST | the workspace's source back to a point in its history — \`dryRun\` first, then \`confirm\` |
 | \`/vocabulary\` | GET | what this workspace's documents may say |
+| \`/assistant\` | POST | ask the assistant, or have it write agents, flows, tools and skills — from the docs only; proposals come back, nothing is written |
 
 Account-level, outside \`/workspaces\`: \`/api/secrets\`, \`/api/keys\`, \`/api/schedule\`,
 \`/api/approvals\`, \`/api/usage\`, \`/api/library/<kind>\`, \`/api/team\`, \`/api/billing\`,
@@ -464,6 +469,7 @@ agents: [writer]            # colleagues this one may consult (an answer, no too
 subagents: [researcher]     # colleagues it may delegate a job to (own context, own tools ≤ its own)
 secrets: [CRM_TOKEN]        # keys the agent uses itself; a tool's own come with the tool
 limits: {web.search: 40, crm: 20, calls: 300}  # per step; a call past a limit is refused, never run
+network: [api.example.com]  # sites its sandbox may reach, added to the trusted list; open | trusted | none
 timezone: Australia/Sydney  # the calendar it works to — IANA name or UTC+10
 provider: {}                # BYOK for this agent; account-wide: \`foldrun account model set\`
 permissionMode: plan        # plan first, act once approved

package/src/store.ts

@@ -49,7 +49,8 @@ import { refNames } from "./refs.ts";
 import { parseBudget, budgetProblem } from "./budget.ts";
 import { timezoneProblem } from "./clock.ts";
 import { parseStepLimits, readLimits } from "./limits.ts";
-import { webProblems, webWarnings, runnerEngines } from "./providers.ts";
+import { networkProblems, resolveNetwork, type NetworkPolicy } from "./network.ts";
+import { webProblems, webWarnings, runnerEngines, webConfig } from "./providers.ts";
 import { actionProblems } from "./web-actions.ts";
 import { languageProblem } from "./language.ts";
 import { localeProblems } from "./locale.ts";
@@ -995,6 +996,15 @@ export interface AgentInfo {
   /** What is wrong with the `limits:` block's shape; key-vs-grant problems
    *  need the tool lists, and `check` adds them (limits.ts limitKeyProblems). */
   limitProblems: string[];
+  /** What cannot be read in `network:` (network.ts) — a level that is not
+   *  one, a site with a scheme or a path. */
+  networkProblems: string[];
+  /** The sites this agent's steps may reach, resolved the way a run
+   *  resolves them — its `network:`, the workspace's, the account's, and
+   *  the default (open when it may fetch or browse the web, else trusted).
+   *  `implied` here is its `apis:` hosts; a run also adds its MCP servers',
+   *  its web providers' and its bound secrets' sites. */
+  network: NetworkPolicy & { readsWeb: boolean };
   /** Tools this agent declares inline rather than in `tools:` — `apis:`,
    *  `scripts:` and `mcpServers:` names — which a limit may also name. */
   inlineTools: string[];
@@ -1536,6 +1546,16 @@ function inlineToolNames(data: Record<string, unknown>): string[] {
 export function listAgents(tenant: string, workspace: string): AgentInfo[] {
   const dir = path.join(workspaceDir(tenant, workspace), "agents");
   if (!fs.existsSync(dir)) return [];
+  // The two levels above every agent, for the network: cascade.
+  const frontOf = (file: string): Record<string, unknown> => {
+    try {
+      return readFrontmatter(file);
+    } catch {
+      return {}; // no AGENTS.md at that level, or one that does not parse
+    }
+  };
+  const accountFront = frontOf(path.join(accountDir(tenant), "AGENTS.md"));
+  const workspaceFront = frontOf(path.join(workspaceDir(tenant, workspace), "AGENTS.md"));
   return fs
     .readdirSync(dir)
     .filter((n) => fs.existsSync(path.join(dir, n, "agent.md")))
@@ -1543,7 +1563,20 @@ export function listAgents(tenant: string, workspace: string): AgentInfo[] {
     .map((name) => {
       const { data } = matter(fs.readFileSync(path.join(dir, name, "agent.md"), "utf8"));
       const tools = refNames(data.tools);
+      const actions = webConfig(data, { ...accountFront, ...workspaceFront }).actions;
+      const readsWeb = tools.includes("web") && (!actions || actions.some((a) => a === "fetch" || a === "browse"));
+      const network = {
+        ...resolveNetwork({
+          account: accountFront.network,
+          workspace: workspaceFront.network,
+          agent: data.network,
+          readsWeb,
+          implied: parseApis(data.apis).map((a) => { try { return new URL(a.base).host; } catch { return ""; } }),
+        }),
+        readsWeb,
+      };
       return {
+        network,
         name,
         description: data.description ?? "",
         model: data.model ?? "default",
@@ -1567,6 +1600,7 @@ export function listAgents(tenant: string, workspace: string): AgentInfo[] {
         webWarnings: webWarnings(data, { chrome: runnerEngines()?.chrome, chromium: runnerEngines()?.chromium }),
         scheduleProblem: agentScheduleProblem(data),
         ...(() => { const l = readLimits(data.limits); return { limits: l.limits, limitProblems: l.problems }; })(),
+        networkProblems: networkProblems(data.network),
         inlineTools: inlineToolNames(data),
       };
     });

package/src/tool-loop.ts

@@ -0,0 +1,176 @@
+// A model with tools that live in this process, and nothing else.
+//
+// What the platform's assistant needs (and what the eval judge and the flow
+// draft are a toolless special case of): one Agent SDK query whose ONLY
+// tools are the ones the caller passes — no built-in tool, no file system,
+// no shell, no sub-agent, no MCP server the machine happens to have — run in
+// a throwaway directory, inside a turn, dollar and wall-clock ceiling.
+//
+// The tools run here, in the caller's process, so whatever they read they
+// read with the caller's own scoping; the model only ever sees what a tool
+// returns. That is why this needs no sandbox pod: nothing the model asks for
+// is executed as code.
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { z } from "zod";
+import { query, createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
+import { hostSafeEnv } from "./host-env.ts";
+
+/** One string argument: what it means, whether it may be left out, how long it may be. */
+export interface LoopArg {
+  description?: string;
+  optional?: boolean;
+  max?: number;
+}
+
+export interface LoopTool {
+  name: string;
+  description: string;
+  args: Record<string, LoopArg>;
+  /** The answer the model reads. A throw becomes an error result, not a crash. */
+  run: (args: Record<string, string | undefined>) => Promise<string> | string;
+}
+
+export interface LoopUsage {
+  /** Everything sent, cache reads and writes included. */
+  inputTokens: number;
+  outputTokens: number;
+  costUsd: number;
+}
+
+export interface LoopResult {
+  /** The last turn's text — the answer, not the thinking aloud between tool calls. */
+  text: string;
+  /** What the SDK reports the query cost; 0 when it never reported (killed). */
+  costUsd: number;
+  usage: LoopUsage | null;
+  /** Why it ended, when it did not end well: max turns, budget, wall clock. */
+  stopped: string | null;
+}
+
+export interface LoopOptions {
+  system: string;
+  prompt: string;
+  tools: LoopTool[];
+  model: string;
+  /** The model credential and anything else the SDK process needs. */
+  env: Record<string, string | undefined>;
+  maxTurns: number;
+  maxBudgetUsd: number;
+  maxOutputTokens: number;
+  wallSeconds: number;
+  /** The reply as it is written, for a live view. */
+  onText?: (delta: string) => void;
+}
+
+const SERVER = "foldrun_tools";
+
+/** The Agent SDK's name for one of our tools. */
+export const loopToolName = (name: string) => `mcp__${SERVER}__${name}`;
+
+function schemaOf(args: Record<string, LoopArg>): z.ZodRawShape {
+  return Object.fromEntries(
+    Object.entries(args).map(([name, a]) => {
+      let s = z.string().min(a.optional ? 0 : 1);
+      if (a.max) s = s.max(a.max);
+      if (a.description) s = s.describe(a.description);
+      return [name, a.optional ? s.optional() : s];
+    }),
+  );
+}
+
+export async function runToolLoop(o: LoopOptions): Promise<LoopResult> {
+  const server = createSdkMcpServer({
+    name: SERVER,
+    version: "1.0.0",
+    tools: o.tools.map((t) =>
+      tool(t.name, t.description, schemaOf(t.args), async (args: Record<string, unknown>) => {
+        try {
+          const plain = Object.fromEntries(Object.entries(args).map(([k, v]) => [k, v === undefined ? undefined : String(v)]));
+          return { content: [{ type: "text" as const, text: await t.run(plain) }] };
+        } catch (err) {
+          return { content: [{ type: "text" as const, text: `error: ${err instanceof Error ? err.message : String(err)}` }], isError: true };
+        }
+      }),
+    ),
+  });
+  // Homeless on purpose: there are no file tools, and a throwaway cwd means
+  // even a confused call has no tree to touch.
+  const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-loop-"));
+  const abort = new AbortController();
+  let killed = false;
+  const watchdog = setTimeout(() => {
+    killed = true;
+    abort.abort();
+  }, o.wallSeconds * 1000);
+  watchdog.unref?.();
+
+  let text = "";
+  let costUsd = 0;
+  let usage: LoopUsage | null = null;
+  let stopped: string | null = null;
+  try {
+    const q = query({
+      prompt: o.prompt,
+      options: {
+        model: o.model,
+        systemPrompt: o.system,
+        // No built-in tool at all (no Task, so no sub-agents either) — only
+        // ours, each pre-approved; anything else is refused unasked.
+        tools: [],
+        mcpServers: { [SERVER]: server },
+        strictMcpConfig: true,
+        allowedTools: o.tools.map((t) => loopToolName(t.name)),
+        permissionMode: "dontAsk",
+        settingSources: [],
+        persistSession: false,
+        maxTurns: o.maxTurns,
+        maxBudgetUsd: o.maxBudgetUsd,
+        includePartialMessages: true,
+        cwd: scratch,
+        abortController: abort,
+        env: { ...hostSafeEnv(), ...o.env, CLAUDE_CODE_MAX_OUTPUT_TOKENS: String(o.maxOutputTokens) },
+      },
+    });
+    let turn = "";
+    for await (const message of q) {
+      if (message.type === "stream_event") {
+        const e = message.event;
+        if (e.type === "message_start") turn = "";
+        if (e.type === "content_block_delta" && e.delta.type === "text_delta") {
+          turn += e.delta.text;
+          o.onText?.(e.delta.text);
+        }
+      } else if (message.type === "assistant") {
+        const said = message.message.content
+          .filter((b) => b.type === "text")
+          .map((b) => (b as { text: string }).text)
+          .join("");
+        if (said.trim()) text = said;
+      } else if (message.type === "result") {
+        costUsd = message.total_cost_usd ?? 0;
+        const models = Object.values(message.modelUsage ?? {});
+        usage = {
+          inputTokens: models.reduce((n, m) => n + (m.inputTokens ?? 0) + (m.cacheReadInputTokens ?? 0) + (m.cacheCreationInputTokens ?? 0), 0),
+          outputTokens: models.reduce((n, m) => n + (m.outputTokens ?? 0), 0),
+          costUsd,
+        };
+        if (message.subtype === "success") {
+          if (message.result?.trim()) text = message.result;
+        } else {
+          stopped = message.subtype;
+          if (!text) text = turn;
+        }
+      }
+    }
+  } catch (err) {
+    if (!killed) throw err;
+  } finally {
+    clearTimeout(watchdog);
+    fs.rmSync(scratch, { recursive: true, force: true });
+  }
+  if (killed) stopped = `ran past ${o.wallSeconds}s`;
+  return { text, costUsd, usage, stopped };
+}