@foldrun/core 1.1.1 → 1.1.3

package/dist/src/tool-loop.d.ts

@@ -1,3 +1,4 @@
+import { type Options } from "@anthropic-ai/claude-agent-sdk";
 /** One string argument: what it means, whether it may be left out, how long it may be. */
 export interface LoopArg {
     description?: string;
@@ -42,4 +43,21 @@ export interface LoopOptions {
 }
 /** The Agent SDK's name for one of our tools. */
 export declare const loopToolName: (name: string) => string;
+/** What a session was started with that we did not give it: any tool or MCP server not ours. */
+export declare function foreignTools(init: {
+    tools: string[];
+    mcp_servers: {
+        name: string;
+    }[];
+}, ours: Set<string>): string[];
+/**
+ * The query's options, and the throwaway directory they run in (the caller
+ * removes it). Apart from runToolLoop so a test can start a session with
+ * exactly these and read what it was given.
+ */
+export declare function loopSession(o: LoopOptions, abort: AbortController): {
+    options: Options;
+    ours: Set<string>;
+    scratch: string;
+};
 export declare function runToolLoop(o: LoopOptions): Promise<LoopResult>;

package/dist/src/tool-loop.js

@@ -29,7 +29,16 @@ function schemaOf(args) {
         return [name, a.optional ? s.optional() : s];
     }));
 }
-export async function runToolLoop(o) {
+/** What a session was started with that we did not give it: any tool or MCP server not ours. */
+export function foreignTools(init, ours) {
+    return [...init.tools.filter((t) => !ours.has(t)), ...init.mcp_servers.map((m) => m.name).filter((n) => n !== SERVER)];
+}
+/**
+ * The query's options, and the throwaway directory they run in (the caller
+ * removes it). Apart from runToolLoop so a test can start a session with
+ * exactly these and read what it was given.
+ */
+export function loopSession(o, abort) {
     const server = createSdkMcpServer({
         name: SERVER,
         version: "1.0.0",
@@ -44,9 +53,75 @@ export async function runToolLoop(o) {
         })),
     });
     // Homeless on purpose: there are no file tools, and a throwaway cwd means
-    // even a confused call has no tree to touch.
+    // even a confused call has no tree to touch. Its own home too: the CLI
+    // reads ~/.claude.json and auto memory whatever settingSources says, so
+    // one reply must never find another's.
     const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-loop-"));
+    const home = path.join(scratch, "home");
+    const work = path.join(scratch, "work");
+    fs.mkdirSync(home);
+    fs.mkdirSync(work);
+    const ours = new Set(o.tools.map((t) => loopToolName(t.name)));
+    const options = {
+        model: o.model,
+        systemPrompt: o.system,
+        // No built-in tool at all (no Task, so no sub-agents either) — only
+        // ours, each pre-approved; anything else is refused unasked.
+        tools: [],
+        mcpServers: { [SERVER]: server },
+        strictMcpConfig: true,
+        allowedTools: [...ours],
+        permissionMode: "dontAsk",
+        settingSources: [],
+        persistSession: false,
+        maxTurns: o.maxTurns,
+        maxBudgetUsd: o.maxBudgetUsd,
+        includePartialMessages: true,
+        cwd: work,
+        abortController: abort,
+        // tools: [] is what keeps the built-ins out, and the SDK does not
+        // document it; a hook runs before every other permission step, so
+        // anything not ours is refused even if a later SDK lets it back in.
+        hooks: {
+            PreToolUse: [
+                {
+                    hooks: [
+                        async (input) => {
+                            const name = "tool_name" in input ? String(input.tool_name) : "";
+                            if (ours.has(name))
+                                return {};
+                            return {
+                                hookSpecificOutput: {
+                                    hookEventName: "PreToolUse",
+                                    permissionDecision: "deny",
+                                    permissionDecisionReason: `${name} is not one of this assistant's tools`,
+                                },
+                            };
+                        },
+                    ],
+                },
+            ],
+        },
+        env: {
+            ...hostSafeEnv(),
+            ...o.env,
+            HOME: home,
+            CLAUDE_CONFIG_DIR: path.join(home, ".claude"),
+            CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1",
+            ENABLE_CLAUDEAI_MCP_SERVERS: "false",
+            // Telemetry, update checks, feature flags: none of it is the reply, and
+            // where the network allows only the model API it would hang on a
+            // blocked host.
+            CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+            CLAUDE_CODE_MAX_OUTPUT_TOKENS: String(o.maxOutputTokens),
+        },
+    };
+    return { options, ours, scratch };
+}
+export async function runToolLoop(o) {
     const abort = new AbortController();
+    const { options, ours, scratch } = loopSession(o, abort);
+    let refused = null;
     let killed = false;
     const watchdog = setTimeout(() => {
         killed = true;
@@ -58,30 +133,20 @@ export async function runToolLoop(o) {
     let usage = null;
     let stopped = null;
     try {
-        const q = query({
-            prompt: o.prompt,
-            options: {
-                model: o.model,
-                systemPrompt: o.system,
-                // No built-in tool at all (no Task, so no sub-agents either) — only
-                // ours, each pre-approved; anything else is refused unasked.
-                tools: [],
-                mcpServers: { [SERVER]: server },
-                strictMcpConfig: true,
-                allowedTools: o.tools.map((t) => loopToolName(t.name)),
-                permissionMode: "dontAsk",
-                settingSources: [],
-                persistSession: false,
-                maxTurns: o.maxTurns,
-                maxBudgetUsd: o.maxBudgetUsd,
-                includePartialMessages: true,
-                cwd: scratch,
-                abortController: abort,
-                env: { ...hostSafeEnv(), ...o.env, CLAUDE_CODE_MAX_OUTPUT_TOKENS: String(o.maxOutputTokens) },
-            },
-        });
+        const q = query({ prompt: o.prompt, options });
         let turn = "";
         for await (const message of q) {
+            // Fail closed: a session that starts with any tool or MCP server we did
+            // not give it never reaches the model.
+            if (message.type === "system" && message.subtype === "init") {
+                const extra = foreignTools(message, ours);
+                if (extra.length) {
+                    refused = `the model session started with tools it must not have: ${extra.join(", ")}`;
+                    abort.abort();
+                    break;
+                }
+                continue;
+            }
             if (message.type === "stream_event") {
                 const e = message.event;
                 if (e.type === "message_start")
@@ -127,6 +192,8 @@ export async function runToolLoop(o) {
         clearTimeout(watchdog);
         fs.rmSync(scratch, { recursive: true, force: true });
     }
+    if (refused)
+        throw new Error(refused);
     if (killed)
         stopped = `ran past ${o.wallSeconds}s`;
     return { text, costUsd, usage, stopped };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldrun/core",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "Agents are just folders. The format, the runner, the checks.",
   "license": "Apache-2.0",
   "type": "module",

package/src/tool-loop.ts

@@ -15,7 +15,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { z } from "zod";
-import { query, createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
+import { query, createSdkMcpServer, tool, type Options } from "@anthropic-ai/claude-agent-sdk";
 import { hostSafeEnv } from "./host-env.ts";
 
 /** One string argument: what it means, whether it may be left out, how long it may be. */
@@ -81,7 +81,17 @@ function schemaOf(args: Record<string, LoopArg>): z.ZodRawShape {
   );
 }
 
-export async function runToolLoop(o: LoopOptions): Promise<LoopResult> {
+/** What a session was started with that we did not give it: any tool or MCP server not ours. */
+export function foreignTools(init: { tools: string[]; mcp_servers: { name: string }[] }, ours: Set<string>): string[] {
+  return [...init.tools.filter((t) => !ours.has(t)), ...init.mcp_servers.map((m) => m.name).filter((n) => n !== SERVER)];
+}
+
+/**
+ * The query's options, and the throwaway directory they run in (the caller
+ * removes it). Apart from runToolLoop so a test can start a session with
+ * exactly these and read what it was given.
+ */
+export function loopSession(o: LoopOptions, abort: AbortController): { options: Options; ours: Set<string>; scratch: string } {
   const server = createSdkMcpServer({
     name: SERVER,
     version: "1.0.0",
@@ -97,9 +107,75 @@ export async function runToolLoop(o: LoopOptions): Promise<LoopResult> {
     ),
   });
   // Homeless on purpose: there are no file tools, and a throwaway cwd means
-  // even a confused call has no tree to touch.
+  // even a confused call has no tree to touch. Its own home too: the CLI
+  // reads ~/.claude.json and auto memory whatever settingSources says, so
+  // one reply must never find another's.
   const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-loop-"));
+  const home = path.join(scratch, "home");
+  const work = path.join(scratch, "work");
+  fs.mkdirSync(home);
+  fs.mkdirSync(work);
+  const ours = new Set(o.tools.map((t) => loopToolName(t.name)));
+  const options: Options = {
+    model: o.model,
+    systemPrompt: o.system,
+    // No built-in tool at all (no Task, so no sub-agents either) — only
+    // ours, each pre-approved; anything else is refused unasked.
+    tools: [],
+    mcpServers: { [SERVER]: server },
+    strictMcpConfig: true,
+    allowedTools: [...ours],
+    permissionMode: "dontAsk",
+    settingSources: [],
+    persistSession: false,
+    maxTurns: o.maxTurns,
+    maxBudgetUsd: o.maxBudgetUsd,
+    includePartialMessages: true,
+    cwd: work,
+    abortController: abort,
+    // tools: [] is what keeps the built-ins out, and the SDK does not
+    // document it; a hook runs before every other permission step, so
+    // anything not ours is refused even if a later SDK lets it back in.
+    hooks: {
+      PreToolUse: [
+        {
+          hooks: [
+            async (input) => {
+              const name = "tool_name" in input ? String(input.tool_name) : "";
+              if (ours.has(name)) return {};
+              return {
+                hookSpecificOutput: {
+                  hookEventName: "PreToolUse" as const,
+                  permissionDecision: "deny" as const,
+                  permissionDecisionReason: `${name} is not one of this assistant's tools`,
+                },
+              };
+            },
+          ],
+        },
+      ],
+    },
+    env: {
+      ...hostSafeEnv(),
+      ...o.env,
+      HOME: home,
+      CLAUDE_CONFIG_DIR: path.join(home, ".claude"),
+      CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1",
+      ENABLE_CLAUDEAI_MCP_SERVERS: "false",
+      // Telemetry, update checks, feature flags: none of it is the reply, and
+      // where the network allows only the model API it would hang on a
+      // blocked host.
+      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+      CLAUDE_CODE_MAX_OUTPUT_TOKENS: String(o.maxOutputTokens),
+    },
+  };
+  return { options, ours, scratch };
+}
+
+export async function runToolLoop(o: LoopOptions): Promise<LoopResult> {
   const abort = new AbortController();
+  const { options, ours, scratch } = loopSession(o, abort);
+  let refused: string | null = null;
   let killed = false;
   const watchdog = setTimeout(() => {
     killed = true;
@@ -112,30 +188,20 @@ export async function runToolLoop(o: LoopOptions): Promise<LoopResult> {
   let usage: LoopUsage | null = null;
   let stopped: string | null = null;
   try {
-    const q = query({
-      prompt: o.prompt,
-      options: {
-        model: o.model,
-        systemPrompt: o.system,
-        // No built-in tool at all (no Task, so no sub-agents either) — only
-        // ours, each pre-approved; anything else is refused unasked.
-        tools: [],
-        mcpServers: { [SERVER]: server },
-        strictMcpConfig: true,
-        allowedTools: o.tools.map((t) => loopToolName(t.name)),
-        permissionMode: "dontAsk",
-        settingSources: [],
-        persistSession: false,
-        maxTurns: o.maxTurns,
-        maxBudgetUsd: o.maxBudgetUsd,
-        includePartialMessages: true,
-        cwd: scratch,
-        abortController: abort,
-        env: { ...hostSafeEnv(), ...o.env, CLAUDE_CODE_MAX_OUTPUT_TOKENS: String(o.maxOutputTokens) },
-      },
-    });
+    const q = query({ prompt: o.prompt, options });
     let turn = "";
     for await (const message of q) {
+      // Fail closed: a session that starts with any tool or MCP server we did
+      // not give it never reaches the model.
+      if (message.type === "system" && message.subtype === "init") {
+        const extra = foreignTools(message, ours);
+        if (extra.length) {
+          refused = `the model session started with tools it must not have: ${extra.join(", ")}`;
+          abort.abort();
+          break;
+        }
+        continue;
+      }
       if (message.type === "stream_event") {
         const e = message.event;
         if (e.type === "message_start") turn = "";
@@ -171,6 +237,7 @@ export async function runToolLoop(o: LoopOptions): Promise<LoopResult> {
     clearTimeout(watchdog);
     fs.rmSync(scratch, { recursive: true, force: true });
   }
+  if (refused) throw new Error(refused);
   if (killed) stopped = `ran past ${o.wallSeconds}s`;
   return { text, costUsd, usage, stopped };
 }