@foldrun/core 1.4.0 → 1.4.2

package/dist/src/deploy.js

@@ -36,7 +36,9 @@ import { repoDir } from "./gitrepo.js";
 import { entriesNoFollow } from "./paths.js";
 import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles } from "./scan.js";
 /** Directories a deploy never reads out of a source tree. */
-const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results"]);
+// `.cache` is what a run's tools leave in an agent's folder (HOME is that
+// folder): logs and font caches, never authored.
+const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results", ".cache"]);
 /** Files that are never part of a workspace, whatever directory they sit in. */
 const NOT_SOURCE_FILE = new Set([".DS_Store", "secrets.json"]);
 const IN_WORKSPACE_DIR = new RegExp(`^(${WORKSPACE_DIRS.join("|")})/`);

package/dist/src/run-container.js

@@ -59,6 +59,10 @@ const DENY_BACK_GIT_RE = /(^|\/)\.git(\/|$)/;
 const DENY_BACK_SECRET_FILES = /(^|\/)\.secret-files\//;
 // And per-agent knowledge, at any depth under agents/<name>/.
 const DENY_BACK_RE = /^agents\/[^/]+\/knowledge\//;
+// A run's caches are not workspace content either: HOME is the agent's own
+// folder, so a tool that ignores XDG_CACHE_HOME (set by the driver) still
+// writes ~/.cache or ~/.npm there. Never copied back.
+const DENY_BACK_CACHE = /^agents\/[^/]+\/\.(?:cache|npm)(?:\/|$)/;
 // A dependency tree is not workspace content. Nothing authored lives in
 // node_modules, it is enormous, and a runtime linked into a tool's directory
 // so ESM can resolve it would otherwise be copied back file by file.
@@ -80,6 +84,8 @@ export function allowedBack(rel) {
         return false;
     if (DENY_BACK_NODE_MODULES.test(norm))
         return false;
+    if (DENY_BACK_CACHE.test(norm))
+        return false;
     return true;
 }
 /**
@@ -433,6 +439,11 @@ try {
   // @file secrets crossed as content; materialise them to 0600 paths inside
   // the container (a host path from the other side would not exist here).
   const env = materializeFileSecrets(agentDir, { ...process.env, HOME: agentDir }).env;
+  // Caches go to the sandbox user's own home, not to HOME: the Claude CLI's
+  // logs, fontconfig, Mesa and gstreamer all follow XDG_CACHE_HOME, and under
+  // agents/<name>/.cache they were copied back after every step — 3,855 files
+  // across 179 agent folders on the box by 17 Oct 2026, read by nothing.
+  env.XDG_CACHE_HOME = "/home/agent/.cache";
 
   // The declared runtime, built in here — pip and npm have the network, which
   // the host side may not. It lands in .foldrun/runner/.runtimes, which the

package/dist/src/scan.js

@@ -646,6 +646,13 @@ function ignored(ig, rule, line) {
 /** Installed and built code: someone else's files, and a crypto library's
  *  constants are not this workspace's keys. */
 const VENDORED = /(?:^|\/)(?:node_modules|\.venv|venv|site-packages|__pycache__|vendor|dist|build|\.next)\//;
+/** What a run leaves in an agent's folder — the Claude CLI's `.cache/` logs,
+ *  package caches — and copies back with it. Nobody wrote these, so they are
+ *  not checked as prompts or code; they are still searched for credentials,
+ *  since a key in a log here is a key in the workspace (seen live on
+ *  17 Oct 2026: zero-width characters in a CLI MCP log, reported as hidden
+ *  text). */
+const RUNTIME_WRITTEN = /(?:^|\/)(?:\.cache|\.npm|\.local|\.pnpm-store|\.yarn|\.foldrun)\//;
 /** Text files only — a PNG read as UTF-8 is noise to every rule here. */
 function isText(f) {
     return !VENDORED.test(f.path) && !f.content.slice(0, 8000).includes("\u0000") && !/\.(?:png|jpe?g|gif|webp|ico|pdf|zip|gz|woff2?|ttf|mp[34]|mov|wasm)$/i.test(f.path);
@@ -679,6 +686,8 @@ export function scanFiles(files, options = {}) {
         const lines = f.content.split(/\r?\n/);
         ignoresByFile.set(f.path, readIgnores(f, lines, push));
         scanSecrets(f, lines, push);
+        if (RUNTIME_WRITTEN.test(f.path))
+            continue;
         scanContent(f, lines, push);
         scanSupplyChain(f, lines, push);
         const schema = schemaKindOf(f.path);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldrun/core",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Agents are just folders. The format, the runner, the checks.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/src/deploy.ts

@@ -49,7 +49,9 @@ import { entriesNoFollow } from "./paths.ts";
 import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles, type ScanFinding, type ScanOptions } from "./scan.ts";
 
 /** Directories a deploy never reads out of a source tree. */
-const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results"]);
+// `.cache` is what a run's tools leave in an agent's folder (HOME is that
+// folder): logs and font caches, never authored.
+const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results", ".cache"]);
 
 /** Files that are never part of a workspace, whatever directory they sit in. */
 const NOT_SOURCE_FILE = new Set([".DS_Store", "secrets.json"]);

package/src/run-container.ts

@@ -192,6 +192,10 @@ const DENY_BACK_GIT_RE = /(^|\/)\.git(\/|$)/;
 const DENY_BACK_SECRET_FILES = /(^|\/)\.secret-files\//;
 // And per-agent knowledge, at any depth under agents/<name>/.
 const DENY_BACK_RE = /^agents\/[^/]+\/knowledge\//;
+// A run's caches are not workspace content either: HOME is the agent's own
+// folder, so a tool that ignores XDG_CACHE_HOME (set by the driver) still
+// writes ~/.cache or ~/.npm there. Never copied back.
+const DENY_BACK_CACHE = /^agents\/[^/]+\/\.(?:cache|npm)(?:\/|$)/;
 // A dependency tree is not workspace content. Nothing authored lives in
 // node_modules, it is enormous, and a runtime linked into a tool's directory
 // so ESM can resolve it would otherwise be copied back file by file.
@@ -207,6 +211,7 @@ export function allowedBack(rel: string): boolean {
   if (DENY_BACK_GIT_RE.test(norm)) return false;
   if (DENY_BACK_SECRET_FILES.test(norm)) return false;
   if (DENY_BACK_NODE_MODULES.test(norm)) return false;
+  if (DENY_BACK_CACHE.test(norm)) return false;
   return true;
 }
 
@@ -564,6 +569,11 @@ try {
   // @file secrets crossed as content; materialise them to 0600 paths inside
   // the container (a host path from the other side would not exist here).
   const env = materializeFileSecrets(agentDir, { ...process.env, HOME: agentDir }).env;
+  // Caches go to the sandbox user's own home, not to HOME: the Claude CLI's
+  // logs, fontconfig, Mesa and gstreamer all follow XDG_CACHE_HOME, and under
+  // agents/<name>/.cache they were copied back after every step — 3,855 files
+  // across 179 agent folders on the box by 17 Oct 2026, read by nothing.
+  env.XDG_CACHE_HOME = "/home/agent/.cache";
 
   // The declared runtime, built in here — pip and npm have the network, which
   // the host side may not. It lands in .foldrun/runner/.runtimes, which the

package/src/scan.ts

@@ -729,6 +729,14 @@ type Push = (rule: string, file: string, line: number | undefined, text: string,
  *  constants are not this workspace's keys. */
 const VENDORED = /(?:^|\/)(?:node_modules|\.venv|venv|site-packages|__pycache__|vendor|dist|build|\.next)\//;
 
+/** What a run leaves in an agent's folder — the Claude CLI's `.cache/` logs,
+ *  package caches — and copies back with it. Nobody wrote these, so they are
+ *  not checked as prompts or code; they are still searched for credentials,
+ *  since a key in a log here is a key in the workspace (seen live on
+ *  17 Oct 2026: zero-width characters in a CLI MCP log, reported as hidden
+ *  text). */
+const RUNTIME_WRITTEN = /(?:^|\/)(?:\.cache|\.npm|\.local|\.pnpm-store|\.yarn|\.foldrun)\//;
+
 /** Text files only — a PNG read as UTF-8 is noise to every rule here. */
 function isText(f: ScanFile): boolean {
   return !VENDORED.test(f.path) && !f.content.slice(0, 8000).includes("\u0000") && !/\.(?:png|jpe?g|gif|webp|ico|pdf|zip|gz|woff2?|ttf|mp[34]|mov|wasm)$/i.test(f.path);
@@ -763,6 +771,7 @@ export function scanFiles(files: ScanFile[], options: ScanOptions = {}): ScanFin
     const lines = f.content.split(/\r?\n/);
     ignoresByFile.set(f.path, readIgnores(f, lines, push));
     scanSecrets(f, lines, push);
+    if (RUNTIME_WRITTEN.test(f.path)) continue;
     scanContent(f, lines, push);
     scanSupplyChain(f, lines, push);