@foldrun/core 1.4.1 → 1.4.2

package/dist/src/deploy.js

@@ -36,7 +36,9 @@ import { repoDir } from "./gitrepo.js";
 import { entriesNoFollow } from "./paths.js";
 import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles } from "./scan.js";
 /** Directories a deploy never reads out of a source tree. */
-const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results"]);
+// `.cache` is what a run's tools leave in an agent's folder (HOME is that
+// folder): logs and font caches, never authored.
+const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results", ".cache"]);
 /** Files that are never part of a workspace, whatever directory they sit in. */
 const NOT_SOURCE_FILE = new Set([".DS_Store", "secrets.json"]);
 const IN_WORKSPACE_DIR = new RegExp(`^(${WORKSPACE_DIRS.join("|")})/`);

package/dist/src/run-container.js

@@ -59,6 +59,10 @@ const DENY_BACK_GIT_RE = /(^|\/)\.git(\/|$)/;
 const DENY_BACK_SECRET_FILES = /(^|\/)\.secret-files\//;
 // And per-agent knowledge, at any depth under agents/<name>/.
 const DENY_BACK_RE = /^agents\/[^/]+\/knowledge\//;
+// A run's caches are not workspace content either: HOME is the agent's own
+// folder, so a tool that ignores XDG_CACHE_HOME (set by the driver) still
+// writes ~/.cache or ~/.npm there. Never copied back.
+const DENY_BACK_CACHE = /^agents\/[^/]+\/\.(?:cache|npm)(?:\/|$)/;
 // A dependency tree is not workspace content. Nothing authored lives in
 // node_modules, it is enormous, and a runtime linked into a tool's directory
 // so ESM can resolve it would otherwise be copied back file by file.
@@ -80,6 +84,8 @@ export function allowedBack(rel) {
         return false;
     if (DENY_BACK_NODE_MODULES.test(norm))
         return false;
+    if (DENY_BACK_CACHE.test(norm))
+        return false;
     return true;
 }
 /**
@@ -433,6 +439,11 @@ try {
   // @file secrets crossed as content; materialise them to 0600 paths inside
   // the container (a host path from the other side would not exist here).
   const env = materializeFileSecrets(agentDir, { ...process.env, HOME: agentDir }).env;
+  // Caches go to the sandbox user's own home, not to HOME: the Claude CLI's
+  // logs, fontconfig, Mesa and gstreamer all follow XDG_CACHE_HOME, and under
+  // agents/<name>/.cache they were copied back after every step — 3,855 files
+  // across 179 agent folders on the box by 17 Oct 2026, read by nothing.
+  env.XDG_CACHE_HOME = "/home/agent/.cache";
 
   // The declared runtime, built in here — pip and npm have the network, which
   // the host side may not. It lands in .foldrun/runner/.runtimes, which the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldrun/core",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "description": "Agents are just folders. The format, the runner, the checks.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/src/deploy.ts

@@ -49,7 +49,9 @@ import { entriesNoFollow } from "./paths.ts";
 import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles, type ScanFinding, type ScanOptions } from "./scan.ts";
 
 /** Directories a deploy never reads out of a source tree. */
-const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results"]);
+// `.cache` is what a run's tools leave in an agent's folder (HOME is that
+// folder): logs and font caches, never authored.
+const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results", ".cache"]);
 
 /** Files that are never part of a workspace, whatever directory they sit in. */
 const NOT_SOURCE_FILE = new Set([".DS_Store", "secrets.json"]);

package/src/run-container.ts

@@ -192,6 +192,10 @@ const DENY_BACK_GIT_RE = /(^|\/)\.git(\/|$)/;
 const DENY_BACK_SECRET_FILES = /(^|\/)\.secret-files\//;
 // And per-agent knowledge, at any depth under agents/<name>/.
 const DENY_BACK_RE = /^agents\/[^/]+\/knowledge\//;
+// A run's caches are not workspace content either: HOME is the agent's own
+// folder, so a tool that ignores XDG_CACHE_HOME (set by the driver) still
+// writes ~/.cache or ~/.npm there. Never copied back.
+const DENY_BACK_CACHE = /^agents\/[^/]+\/\.(?:cache|npm)(?:\/|$)/;
 // A dependency tree is not workspace content. Nothing authored lives in
 // node_modules, it is enormous, and a runtime linked into a tool's directory
 // so ESM can resolve it would otherwise be copied back file by file.
@@ -207,6 +211,7 @@ export function allowedBack(rel: string): boolean {
   if (DENY_BACK_GIT_RE.test(norm)) return false;
   if (DENY_BACK_SECRET_FILES.test(norm)) return false;
   if (DENY_BACK_NODE_MODULES.test(norm)) return false;
+  if (DENY_BACK_CACHE.test(norm)) return false;
   return true;
 }
 
@@ -564,6 +569,11 @@ try {
   // @file secrets crossed as content; materialise them to 0600 paths inside
   // the container (a host path from the other side would not exist here).
   const env = materializeFileSecrets(agentDir, { ...process.env, HOME: agentDir }).env;
+  // Caches go to the sandbox user's own home, not to HOME: the Claude CLI's
+  // logs, fontconfig, Mesa and gstreamer all follow XDG_CACHE_HOME, and under
+  // agents/<name>/.cache they were copied back after every step — 3,855 files
+  // across 179 agent folders on the box by 17 Oct 2026, read by nothing.
+  env.XDG_CACHE_HOME = "/home/agent/.cache";
 
   // The declared runtime, built in here — pip and npm have the network, which
   // the host side may not. It lands in .foldrun/runner/.runtimes, which the