@foldrun/core 11.0.0 → 11.1.0

package/dist/src/a2a-client.d.ts

@@ -112,6 +112,15 @@ export declare function stripHidden(text: string): {
 /** The address a request to `target` goes to: the egress door when the
  *  token is a placeholder only the proxy can fill, else the target. */
 export declare function routeFor(conn: Pick<A2AConnection, "token" | "egress">, target: string): string;
+/** Why the egress proxy refused a request, or null for an answer that is
+ *  the remote's. The diagnostic is fixed text of ours; the body's own words
+ *  go back as `said`, for the untrusted fence — the proxy passes a remote's
+ *  403 through as it came, so a remote can send this exact shape (Codex
+ *  review, 2 Nov 2026). */
+export declare function egressRefusal(status: number, text: string): {
+    reason: string;
+    said: string | null;
+} | null;
 /**
  * The endpoint a card names, if it names one we may call: a JSON-RPC
  * interface of protocol 1.x at the card's own origin. Pure — the card in,

package/dist/src/a2a-client.js

@@ -129,6 +129,30 @@ export function routeFor(conn, target) {
     }
     return target;
 }
+/** Why the egress proxy refused a request, or null for an answer that is
+ *  the remote's. The diagnostic is fixed text of ours; the body's own words
+ *  go back as `said`, for the untrusted fence — the proxy passes a remote's
+ *  403 through as it came, so a remote can send this exact shape (Codex
+ *  review, 2 Nov 2026). */
+export function egressRefusal(status, text) {
+    if (status !== 403)
+        return null;
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    const err = body?.error;
+    if (!err || err.type !== "egress")
+        return null;
+    const said = typeof err.message === "string" ? short(err.message.replace(/^egress:\s*/, ""), 200) : "";
+    const reason = /private|internal/i.test(said)
+        ? "its address is not allowed — this platform does not call private or internal addresses"
+        : "the platform's egress refused it";
+    return { reason, said: said || null };
+}
 /**
  * One HTTP exchange, read as JSON, to a limit, with no redirect followed.
  *
@@ -178,6 +202,11 @@ async function exchange(conn, target, init, maxBytes) {
         }
         throw new A2AError(`${conn.remote}: the answer could not be read: ${short(err?.message ?? err, 200)}`);
     }
+    // The egress proxy's own refusal ({error: {type: "egress"}}) is ours, not
+    // the remote's: the address is not allowed, and no secret would change it.
+    const egress = egressRefusal(res.status, text);
+    if (egress)
+        throw new A2AError(`${conn.remote} cannot be called from here: ${egress.reason}`, null, true, egress.said);
     if (res.status === 401 || res.status === 403) {
         throw new A2AError(`${conn.remote} refused the credential (HTTP ${res.status})${conn.token ? "" : " — this remote has no secret: set one"}`, null, true);
     }

package/dist/src/runner.js

@@ -2211,8 +2211,10 @@ mayDefer) {
         const cardProblems = new Map();
         for (const r of remotes) {
             const why = await platform.checkUntrustedUrl(r.card);
-            if (why)
+            if (why) {
                 cardProblems.set(r.name, why);
+                console.warn(`[a2a] remotes: ${r.name} refused for ${tenant}/${path.basename(workspaceRootOf(agentDir))} (${step.agent}): ${why}`);
+            }
         }
         const stepRemotes = remotes.map((r) => {
             const refused = cardProblems.get(r.name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldrun/core",
-  "version": "11.0.0",
+  "version": "11.1.0",
   "description": "Agents are just folders. The format, the runner, the checks.",
   "license": "FSL-1.1-ALv2",
   "type": "module",

package/src/a2a-client.ts

@@ -200,6 +200,28 @@ export function routeFor(conn: Pick<A2AConnection, "token" | "egress">, target:
   return target;
 }
 
+/** Why the egress proxy refused a request, or null for an answer that is
+ *  the remote's. The diagnostic is fixed text of ours; the body's own words
+ *  go back as `said`, for the untrusted fence — the proxy passes a remote's
+ *  403 through as it came, so a remote can send this exact shape (Codex
+ *  review, 2 Nov 2026). */
+export function egressRefusal(status: number, text: string): { reason: string; said: string | null } | null {
+  if (status !== 403) return null;
+  let body: unknown;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  const err = (body as { error?: { type?: unknown; message?: unknown } } | null)?.error;
+  if (!err || err.type !== "egress") return null;
+  const said = typeof err.message === "string" ? short(err.message.replace(/^egress:\s*/, ""), 200) : "";
+  const reason = /private|internal/i.test(said)
+    ? "its address is not allowed — this platform does not call private or internal addresses"
+    : "the platform's egress refused it";
+  return { reason, said: said || null };
+}
+
 /**
  * One HTTP exchange, read as JSON, to a limit, with no redirect followed.
  *
@@ -251,6 +273,10 @@ async function exchange(
     }
     throw new A2AError(`${conn.remote}: the answer could not be read: ${short((err as Error)?.message ?? err, 200)}`);
   }
+  // The egress proxy's own refusal ({error: {type: "egress"}}) is ours, not
+  // the remote's: the address is not allowed, and no secret would change it.
+  const egress = egressRefusal(res.status, text);
+  if (egress) throw new A2AError(`${conn.remote} cannot be called from here: ${egress.reason}`, null, true, egress.said);
   if (res.status === 401 || res.status === 403) {
     throw new A2AError(`${conn.remote} refused the credential (HTTP ${res.status})${conn.token ? "" : " — this remote has no secret: set one"}`, null, true);
   }

package/src/runner.ts

@@ -2407,7 +2407,10 @@ async function runStep(
     const cardProblems = new Map<string, string>();
     for (const r of remotes) {
       const why = await platform.checkUntrustedUrl(r.card);
-      if (why) cardProblems.set(r.name, why);
+      if (why) {
+        cardProblems.set(r.name, why);
+        console.warn(`[a2a] remotes: ${r.name} refused for ${tenant}/${path.basename(workspaceRootOf(agentDir))} (${step.agent}): ${why}`);
+      }
     }
     const stepRemotes: RemoteSpec[] = remotes.map((r) => {
       const refused = cardProblems.get(r.name);