@foldrun/core 1.1.3 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +29 -192
- package/README.md +14 -17
- package/dist/index.js +3 -3
- package/dist/src/deploy.d.ts +16 -0
- package/dist/src/deploy.js +35 -1
- package/dist/src/platform.d.ts +4 -4
- package/dist/src/run-container.d.ts +1 -1
- package/dist/src/run-container.js +1 -1
- package/dist/src/scan.d.ts +168 -0
- package/dist/src/scan.js +744 -0
- package/dist/src/starter.js +9 -0
- package/index.ts +3 -3
- package/package.json +4 -6
- package/src/deploy.ts +40 -2
- package/src/platform.ts +4 -4
- package/src/run-container.ts +1 -1
- package/src/scan.ts +849 -0
- package/src/starter.ts +9 -0
package/src/starter.ts
CHANGED
|
@@ -264,6 +264,14 @@ foldrun deploy --url <server> --token $FOLDRUN_TOKEN
|
|
|
264
264
|
\`check\` is cheap and catches a broken flow before a schedule fires it at 3am.
|
|
265
265
|
Run it after edits, the way you would run a typecheck.
|
|
266
266
|
|
|
267
|
+
It is also the security scanner: a key written into a file, hidden text in
|
|
268
|
+
knowledge or skills, an agent that reads the web while holding a secret and
|
|
269
|
+
an open way out, \`curl | sh\`, an MCP server at no fixed version. Every
|
|
270
|
+
finding names its rule (\`secret/hardcoded\`). \`foldrun check --security\`
|
|
271
|
+
fails on any of them; \`<!-- foldrun-ignore <rule>: <reason> -->\` on the line
|
|
272
|
+
before accepts one; \`--write-baseline\` accepts what is there today, and
|
|
273
|
+
\`--format sarif\` feeds GitHub code scanning (\`foldrun docs checks\`).
|
|
274
|
+
|
|
267
275
|
A deploy that would delete files this folder no longer has lists them and
|
|
268
276
|
stops: with no terminal it is refused. Tell the person what it would delete; add \`--yes\`
|
|
269
277
|
only when they asked for exactly that deletion.
|
|
@@ -361,6 +369,7 @@ All of it, \`/api/workspaces/<workspace>\` unless noted:
|
|
|
361
369
|
| \`/export\` · \`/import\` | GET · POST | the workspace, a flow (\`?kind=flow&name=\`) or an agent as a .zip; take one in (\`?dryRun=1\` first, \`?overwrite=1\` to replace) |
|
|
362
370
|
| \`/restore\` | POST | the workspace's source back to a point in its history — \`dryRun\` first, then \`confirm\` |
|
|
363
371
|
| \`/vocabulary\` | GET | what this workspace's documents may say |
|
|
372
|
+
| \`/check\` | GET | what \`foldrun check\` says about the deployed copy, as findings with rule ids (\`?security=1\`) |
|
|
364
373
|
| \`/assistant\` | POST | ask the assistant, or have it write agents, flows, tools and skills — from the docs only; proposals come back, nothing is written |
|
|
365
374
|
|
|
366
375
|
Account-level, outside \`/workspaces\`: \`/api/secrets\`, \`/api/keys\`, \`/api/schedule\`,
|