@foldrun/core 2.14.2 → 3.0.0

package/src/runner.ts

@@ -3036,6 +3036,8 @@ async function runStep(
         tenant,
         input: {
           agentRel: path.relative(workspaceRoot, agentDir).replaceAll("\\", "/"),
+          // Its file tools inside the sandbox get the same allowance (FOL-96).
+          configWrites: step.approve === true && Boolean(step.approvedAt),
           prompt,
           model,
           effort,
@@ -3127,6 +3129,11 @@ async function runStep(
         network: { level: network.level, enforced: forward?.enforce === true },
         // A test run's state/ and storage/ changes come out under the run.
         divert: testRun && runId ? divertFor(runId) : undefined,
+        // Read at copy-out: what the host handed back into the sandbox.
+        handedBack: () => step.handedBack,
+        // A person approved this step before it ran: configuration and code
+        // it changes are kept, listed on the trail (FOL-96).
+        configWrites: step.approve === true && Boolean(step.approvedAt),
         test: testRun,
         // Resume: a sandbox a previous driver left running, recorded on the
         // step. Consumed once — a fresh attempt after this one (a retry, a
@@ -3332,6 +3339,11 @@ async function runStep(
       step.image = outcome.image ?? null;
       step.browserPod = outcome.browserPod ? { ...outcome.browserPod } : null;
       if (step.subagentOf && outcome.applied?.length) step.wrote = [...new Set([...(step.wrote ?? []), ...outcome.applied])];
+      if (outcome.refused?.length) {
+        const seen = new Map((step.refused ?? []).map((r) => [r.path, r]));
+        for (const r of outcome.refused) seen.set(r.path, r);
+        step.refused = [...seen.values()];
+      }
       if (outcome.status === "failed" && outcome.browserPod?.lost) {
         const decision = podLossDecision(outcome.browserPod);
         if (decision.rerun) {
@@ -3503,6 +3515,9 @@ async function runStep(
       const attemptInProcess = (modelEnv: Record<string, string | undefined>) => executeStep({
         agentDir,
         workspaceRoot,
+        // A person approved this step (its gate) before it ran: it may change
+        // configuration and code (FOL-96) — the desks' retro applies fixes so.
+        configWrites: step.approve === true && Boolean(step.approvedAt),
         libraryRoot: libraryDir(tenant),
         ...(subagents.length ? { subagents } : {}),
         // The colleagues' inbox, read after every tool call — the same hook
@@ -5241,6 +5256,21 @@ function driveRunInner(
           // Its files go back with the reply, so the delegating step's
           // sandbox has them too (delegate-tools.ts copyBackFiles).
           const back = readCopyBack(pDir, child.wrote ?? []);
+          // What goes back into the parent's sandbox, as the host sends it:
+          // its copy-out reads this, not the sandbox's own note (FOL-96).
+          if (back.files.length) {
+            parent.handedBack = { ...(parent.handedBack ?? {}) };
+            for (const f of back.files) {
+              const h = crypto.createHash("sha256").update(Buffer.from(f.base64, "base64")).digest("hex");
+              // Kept beside any earlier job's for the same path, never over
+              // it: either may be what the sandbox ends up holding.
+              const prev = parent.handedBack[f.path];
+              const all = prev === undefined ? [] : Array.isArray(prev) ? prev : [prev];
+              if (!all.includes(h)) all.push(h);
+              parent.handedBack[f.path] = all.length === 1 ? all[0] : all;
+            }
+            save();
+          }
           return {
             status,
             result: child.result ?? (errors || "(no reply)"),

package/src/step-exec.ts

@@ -87,6 +87,9 @@ export interface ExecOutcome {
 }
 
 export interface ExecOptions {
+  /** A person approved this step before it ran: its file tools may write
+   *  the workspace's configuration and code (confine.ts, FOL-96). */
+  configWrites?: boolean;
   /** What the step reports beyond its events (FOL-54 step 4): `metadata`
    *  sends each model call (`turn`); `full` also sends each tool call's input
    *  and output (`io`). Unset sends neither — the consult, the probe and any
@@ -520,7 +523,7 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
               }
             }
             const verdict = isFilesystemTool(hookInput.tool_name)
-              ? checkPaths(hookInput.tool_name, hookInput.tool_input as Record<string, unknown>, { agentDir, workspaceRoot, libraryRoot })
+              ? checkPaths(hookInput.tool_name, hookInput.tool_input as Record<string, unknown>, { agentDir, workspaceRoot, libraryRoot, configWrites: opts.configWrites })
               : null;
             if (verdict && !verdict.ok) {
               emit("error", verdict.reason!, via ? { subagent: via } : undefined);
@@ -560,7 +563,7 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
                 const again = hookInput.tool_name === "Bash"
                   ? checkBash(String(v.input.command ?? ""))
                   : isFilesystemTool(hookInput.tool_name)
-                    ? checkPaths(hookInput.tool_name, v.input, { agentDir, workspaceRoot, libraryRoot })
+                    ? checkPaths(hookInput.tool_name, v.input, { agentDir, workspaceRoot, libraryRoot, configWrites: opts.configWrites })
                     : { ok: true as const };
                 const granted = opts.allowed.includes(hookInput.tool_name) || opts.mcpNames.some((n) => hookInput.tool_name.startsWith(`mcp__${n}__`));
                 // The sub-agent guard read the ORIGINAL input: a rewrite of a
@@ -628,7 +631,7 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
           toolName === "Bash"
             ? checkBash(String(input.command ?? ""))
             : isFilesystemTool(toolName)
-              ? checkPaths(toolName, input, { agentDir, workspaceRoot, libraryRoot })
+              ? checkPaths(toolName, input, { agentDir, workspaceRoot, libraryRoot, configWrites: opts.configWrites })
               : { ok: true as const };
         if (!verdict.ok) {
           refund();

package/src/store.ts

@@ -2107,7 +2107,7 @@ export function parseFlow(file: string, raw: string): FlowInfo {
     // A header name is case-insensitive on the wire; a JSON field is not.
     // `body:eventId` lower-cased to `body:eventid` matched nothing, and a
     // dedupe that matches nothing admits everything.
-    idempotency: typeof data.idempotency === "string" ? idempotencyName(data.idempotency) : null,
+    idempotency: idempotencyOf(data.idempotency, data.trigger, data.signature),
     debounce: durationOf(data.debounce),
     throttle: durationOf(data.throttle),
     catchup: data.catchup === "none" || data.catchup === "last" ? data.catchup : null,
@@ -2144,6 +2144,19 @@ export function parseSchemaText(text: string): { schema: Record<string, unknown>
   return { schema: value as Record<string, unknown> };
 }
 
+/**
+ * The flow's `idempotency:`, or its default. A GitHub-signed webhook dedupes
+ * on `x-github-delivery` unless it says otherwise: GitHub's signature has no
+ * timestamp, so a delivery captured once could be replayed for ever, and
+ * every GitHub delivery carries that id (FOL-94). Any `idempotency:` the
+ * file sets wins; `none` (or `false`, `off`) turns dedupe off.
+ */
+function idempotencyOf(raw: unknown, trigger: unknown, signature: unknown): string | null {
+  if (raw === false || (typeof raw === "string" && /^(none|off|false)$/i.test(raw.trim()))) return null;
+  if (typeof raw === "string") return idempotencyName(raw);
+  return trigger === "webhook" && String(signature) === "github" ? "x-github-delivery" : null;
+}
+
 function idempotencyName(raw: string): string | null {
   const v = raw.trim();
   if (!v) return null;
@@ -3520,6 +3533,14 @@ export interface StepRecord {
   /** On an isolated sub-agent's run: the workspace paths its sandbox's
    *  changes were applied to — what its delegating step is told it wrote. */
   wrote?: string[];
+  /** What this step's sandbox changed that was not taken back to the
+   *  workspace: configuration and code, which a step proposes and a person
+   *  applies (copy-back.ts, FOL-96). */
+  refused?: { path: string; kind: "config" | "code" }[];
+  /** What the host handed back into this step's sandbox mid-step — its
+   *  `sandbox: own` jobs' files, path → sha256 — recorded HERE, on the host,
+   *  so the copy-out never has to take the sandbox's word for it (FOL-96). */
+  handedBack?: Record<string, string | string[]>;
   /**
    * Sandbox seconds this step rented, and how many of them were cold start.
    * Set only on the isolated path — an in-process step rents nothing, so