@foldrun/core 1.1.3 → 1.2.0

package/dist/src/starter.js

@@ -248,6 +248,14 @@ foldrun deploy --url <server> --token $FOLDRUN_TOKEN
 \`check\` is cheap and catches a broken flow before a schedule fires it at 3am.
 Run it after edits, the way you would run a typecheck.
 
+It is also the security scanner: a key written into a file, hidden text in
+knowledge or skills, an agent that reads the web while holding a secret and
+an open way out, \`curl | sh\`, an MCP server at no fixed version. Every
+finding names its rule (\`secret/hardcoded\`). \`foldrun check --security\`
+fails on any of them; \`<!-- foldrun-ignore <rule>: <reason> -->\` on the line
+before accepts one; \`--write-baseline\` accepts what is there today, and
+\`--format sarif\` feeds GitHub code scanning (\`foldrun docs checks\`).
+
 A deploy that would delete files this folder no longer has lists them and
 stops: with no terminal it is refused. Tell the person what it would delete; add \`--yes\`
 only when they asked for exactly that deletion.
@@ -345,6 +353,7 @@ All of it, \`/api/workspaces/<workspace>\` unless noted:
 | \`/export\` · \`/import\` | GET · POST | the workspace, a flow (\`?kind=flow&name=\`) or an agent as a .zip; take one in (\`?dryRun=1\` first, \`?overwrite=1\` to replace) |
 | \`/restore\` | POST | the workspace's source back to a point in its history — \`dryRun\` first, then \`confirm\` |
 | \`/vocabulary\` | GET | what this workspace's documents may say |
+| \`/check\` | GET | what \`foldrun check\` says about the deployed copy, as findings with rule ids (\`?security=1\`) |
 | \`/assistant\` | POST | ask the assistant, or have it write agents, flows, tools and skills — from the docs only; proposals come back, nothing is written |
 
 Account-level, outside \`/workspaces\`: \`/api/secrets\`, \`/api/keys\`, \`/api/schedule\`,

package/index.ts

@@ -1,11 +1,11 @@
-// @foldrun/core — the open-source runtime.
+// @foldrun/core — the runtime.
 //
 // Everything needed to read a workspace of markdown files and run the agents
 // in it. No server, no database, no account: point it at a folder.
 //
 // The hosted platform imports these same modules. That is deliberate — if the
-// open version were a reduced copy it would rot, and self-hosting would feel
-// like a downgrade instead of a choice. What the platform adds — a queue and
+// local version were a reduced copy it would rot, and running on a laptop
+// would behave differently from running hosted. What the platform adds — a queue and
 // its worker, metering and billing, pods on a cluster, per-account keys in a
 // database, previews, share links, tenancy — lives in its own private package
 // and plugs in through platform.ts. Nothing here imports it.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@foldrun/core",
-  "version": "1.1.3",
+  "version": "1.2.0",
   "description": "Agents are just folders. The format, the runner, the checks.",
-  "license": "Apache-2.0",
+  "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "exports": {
     ".": {
@@ -30,7 +30,8 @@
       "./network",
       "./providers",
       "./subagents",
-      "./tool-names"
+      "./tool-names",
+      "./scan"
     ]
   },
   "main": "./dist/index.js",
@@ -67,9 +68,6 @@
     "url": "git+https://github.com/foldrun-io/foldrun-core.git"
   },
   "homepage": "https://foldrun.io",
-  "bugs": {
-    "url": "https://github.com/foldrun-io/foldrun-core/issues"
-  },
   "keywords": [
     "agents",
     "llm",

package/src/deploy.ts

@@ -46,6 +46,7 @@ import { languageProblem } from "./language.ts";
 import { localeProblems } from "./locale.ts";
 import { repoDir } from "./gitrepo.ts";
 import { entriesNoFollow } from "./paths.ts";
+import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles, type ScanFinding, type ScanOptions } from "./scan.ts";
 
 /** Directories a deploy never reads out of a source tree. */
 const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results"]);
@@ -228,7 +229,44 @@ export function unopenedFrontmatter(raw: string): string | null {
   return "the frontmatter has no opening `---`, so none of it is read: the agent runs with no tools and the default model. Add `---` as the first line.";
 }
 
+/**
+ * What a deploy says but does not refuse: the structural warnings below, and
+ * the scanner's findings about what should not be in the files at all — a
+ * credential written in, text a reviewer cannot see. The scanner's design
+ * advice (an agent that could leak, an unpinned package) is for `foldrun
+ * check` and the Checks page, not for every deploy's output.
+ */
 export function deployWarnings(files: DeployFile[]): DeployIssue[] {
+  const scanned = scanFiles(files, { only: ["secret", "content"] })
+    .filter((f) => f.level !== "info")
+    .map((f) => ({ where: `${f.file}${f.line ? `:${f.line}` : ""}`, message: `${f.message} [${f.rule}]` }));
+  return [...structuralWarnings(files), ...scanned];
+}
+
+/**
+ * Everything the platform can say about a workspace's files, as findings
+ * with rule ids: what a deploy refuses (errors), what it warns about, and the
+ * whole scanner. The Checks page and `GET …/check` answer with this; `foldrun
+ * check` asks more (it resolves every library and the platform's), so treat
+ * this as the server's view of the same rules, not a second set.
+ */
+export function checkFiles(files: DeployFile[], options: ScanOptions = {}): ScanFinding[] {
+  const finding = (i: DeployIssue, level: "error" | "warn", kind?: string): ScanFinding => {
+    const m = /^(.*?)(?::(\d+))?(?: .*)?$/.exec(i.where);
+    const file = m?.[1] || i.where;
+    const rule = ruleForWhere(i.where, kind);
+    return { rule, level, file, ...(m?.[2] ? { line: Number(m[2]) } : {}), message: i.message, fingerprint: findingFingerprint(rule, file, i.message) };
+  };
+  const own = [
+    ...deployIssues(files).map((i) => finding(i, "error")),
+    ...structuralWarnings(files).map((i) => finding(i, "warn", i.kind)),
+  ];
+  return [...filterIgnored(own, files), ...scanFiles(files, options)].sort(
+    (a, b) => a.file.localeCompare(b.file) || (a.line ?? 0) - (b.line ?? 0) || a.rule.localeCompare(b.rule),
+  );
+}
+
+function structuralWarnings(files: DeployFile[]): (DeployIssue & { kind?: string })[] {
   const front = (content: string): Record<string, unknown> => {
     try { return matter(content).data as Record<string, unknown>; } catch { return {}; }
   };
@@ -246,7 +284,7 @@ export function deployWarnings(files: DeployFile[]): DeployIssue[] {
   // Agents that grant one of them.
   const outwardAgents: string[] = [];
   const agentNames: string[] = [];
-  const out: DeployIssue[] = [];
+  const out: (DeployIssue & { kind?: string })[] = [];
   if (!files.some((f) => /^agents\/[^/]+\/agent\.md$/.test(f.path)) && !files.some((f) => /^\.(claude|agents)\/agents\/[^/]+\.md$/.test(f.path))) {
     out.push({ where: "agents/", message: "no agents yet — add one (agents/<name>/agent.md), or import one from another workspace" });
   }
@@ -268,7 +306,7 @@ export function deployWarnings(files: DeployFile[]): DeployIssue[] {
     let flow;
     try { flow = parseFlow(path.basename(f.path), f.content); } catch { continue; }
     for (const w of lintFlow(flow, { agents: agentNames, outwardAgents })) {
-      if (w.kind === "outward") out.push({ where: `${f.path}${w.line ? `:${w.line}` : ""}`, message: w.message });
+      if (w.kind === "outward") out.push({ where: `${f.path}${w.line ? `:${w.line}` : ""}`, message: w.message, kind: "outward" });
     }
   }
   return out;

package/src/platform.ts

@@ -20,7 +20,7 @@ export type IsolatedStepRunner = (args: RunInContainerArgs) => Promise<Container
 
 /** Who this install is for. `hosted` means someone is paying the operator
  *  for it — a wallet, a plan, a bill. `self-hosted` is everything else: a
- *  laptop, a company's own box, the open-source download. */
+ *  laptop, a dev install, a box nobody bills on. */
 export type Edition = "self-hosted" | "hosted";
 
 /** What a trigger gate decided. `admit: false` is never an error: the
@@ -36,9 +36,9 @@ export interface PlatformHooks {
    *  the wallet, top-ups, plan limits, whatever is added next that assumes
    *  a customer — asks before it renders or answers. Default: self-hosted,
    *  which is what a process that never registered a platform is, and what
-   *  the open-source image is unless its operator configures billing. One
-   *  predicate, one place, so "does the community build show X" is a test
-   *  and not an audit. */
+   *  any install is unless its operator configures billing. One predicate,
+   *  one place, so "does an unbilled install show X" is a test and not an
+   *  audit. */
   edition(): Edition;
   /** Put a flow run where a worker will pick it up. Default: start it here, now. */
   enqueueFlowRun(

package/src/run-container.ts

@@ -475,7 +475,7 @@ const DOCKER_VOLUME_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
  * as a trusted local file, which is precisely the path gVisor, the capability
  * drop and the egress policy all exist to close. Disk is the cheaper thing to
  * spend. One volume per tenant keeps that boundary; each carries a
- * `foldrun.io/tenant` label so it can be found and pruned (self-hosting/README.md).
+ * `foldrun.io/tenant` label so it can be found and pruned.
  *
  * The venvs inside carry the runner's own absolute paths, distinct from the
  * host's `<tenant>/.runtimes` cache — two roots, so a hit is always a real hit.