@foldrun/core 2.3.0 → 2.5.0

package/dist/src/deploy.js

@@ -20,20 +20,24 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { saveWorkspace, keptOnDeploy, workspaceDir, listRunSummaries, listWorkspaceFiles, parseFlow, parseToolDef, WORKSPACE_DIRS, assertSafeName, } from "./store.js";
+import { saveWorkspace, keptOnDeploy, workspaceDir, listRunSummaries, listWorkspaceFiles, parseFlow, parseToolDef, WORKSPACE_DIRS, assertSafeName, accountDir, frontmatterErrorText, } from "./store.js";
+import { readAgentsMdKeys } from "./agents-md.js";
+import { libraryTools } from "./library.js";
 import { lintFlow } from "./flow-lint.js";
 import { refNames } from "./refs.js";
-import matter from "gray-matter";
+import matter from "./matter.js";
 import { conformanceIssues } from "./okf.js";
 import { timezoneProblem } from "./clock.js";
 import { webProblems, webWarnings, runnerEngines } from "./providers.js";
 import { readLimits } from "./limits.js";
+import { parseAlerts } from "./alerts.js";
+import { parseTelemetry } from "./otel-config.js";
 import { networkProblems } from "./network.js";
 import { actionProblems } from "./web-actions.js";
 import { languageProblem } from "./language.js";
 import { localeProblems } from "./locale.js";
 import { entriesNoFollow } from "./paths.js";
-import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles } from "./scan.js";
+import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles, scanRule } from "./scan.js";
 /** Directories a deploy never reads out of a source tree. */
 // `.cache` is what a run's tools leave in an agent's folder (HOME is that
 // folder): logs and font caches, never authored.
@@ -73,9 +77,40 @@ export function isSourcePath(rel) {
 // head. Shared by the deploy import (readTree) and the CLI checker so the two
 // agree on what counts as an agent.
 export const SUBAGENT_IMPORT_DIRS = [".agents/agents", ".claude/agents"];
-export function readTree(dir) {
+/** What agents write as they run, not what anyone authored: state/ and
+ *  memory/, the workspace's or one agent's. */
+const DATA_PATH = /^(?:agents\/[^/]+\/)?(?:state|memory)\//;
+export class TreeTooLarge extends Error {
+    /** What an HTTP route answers with it. */
+    status = 413;
+}
+export function readTree(dir, opts = {}) {
     const root = path.resolve(dir);
     const out = [];
+    let dataBytes = 0;
+    let dataFiles = 0;
+    let sourceBytes = 0;
+    /** May this file be read? Data over its budget is left out; source over
+     *  its budget ends the read. */
+    const admit = (rel, bytes) => {
+        if (DATA_PATH.test(rel)) {
+            const over = (opts.maxDataFileBytes !== undefined && bytes > opts.maxDataFileBytes) ||
+                (opts.maxDataBytes !== undefined && dataBytes + bytes > opts.maxDataBytes) ||
+                (opts.maxDataFiles !== undefined && dataFiles >= opts.maxDataFiles);
+            if (over) {
+                opts.onSkip?.(rel, bytes);
+                return false;
+            }
+            dataBytes += bytes;
+            dataFiles++;
+            return true;
+        }
+        sourceBytes += bytes;
+        if (opts.maxSourceBytes !== undefined && sourceBytes > opts.maxSourceBytes) {
+            throw new TreeTooLarge(`the workspace's files other than state/ and memory/ are over ${Math.round(opts.maxSourceBytes / 1048576)} MiB — not read`);
+        }
+        return true;
+    };
     const walk = (abs, rel) => {
         let entries;
         try {
@@ -104,6 +139,8 @@ export function readTree(dir) {
                 walk(full, next);
             }
             else if (next === "AGENTS.md" || next === "project.md" || IN_WORKSPACE_DIR.test(next)) {
+                if (!admit(next, stat.size))
+                    continue;
                 out.push({ path: next, content: fs.readFileSync(full, "utf8") });
             }
         }
@@ -143,11 +180,16 @@ export function readTree(dir) {
                 continue;
             const full = path.join(root, importDir, entry);
             try {
-                if (fs.lstatSync(full).isSymbolicLink())
+                const st = fs.lstatSync(full);
+                if (st.isSymbolicLink())
+                    continue;
+                if (!admit(target, st.size))
                     continue;
                 out.push({ path: target, content: fs.readFileSync(full, "utf8") });
             }
-            catch {
+            catch (err) {
+                if (err instanceof TreeTooLarge)
+                    throw err;
                 // an unreadable import is skipped, not fatal
             }
         }
@@ -195,6 +237,89 @@ export function unopenedFrontmatter(raw) {
  * advice (an agent that could leak, an unpinned package) is for `foldrun
  * check` and the Checks page, not for every deploy's output.
  */
+/**
+ * What `deploy_block:` in AGENTS.md refuses (FOL-58). `none`, the default:
+ * the scanner's findings are warnings and the deploy goes ahead, as it always
+ * did. `secrets`: a key or password written into a file is refused.
+ * `security`: every security finding is — secrets, hidden or injected text,
+ * the lethal trifecta, pipe-to-shell, an unpinned MCP server, a step that
+ * acts outside with no check or approval. A
+ * `foldrun-ignore` with a reason still accepts one.
+ */
+export const DEPLOY_BLOCK_MODES = ["none", "secrets", "security"];
+const blockMode = (v) => typeof v === "string" && DEPLOY_BLOCK_MODES.includes(v.trim()) ? v.trim() : null;
+/** The workspace's own AGENTS.md, else the account's, else none. */
+export function deployBlockMode(files, accountKeys) {
+    // project.md is the older name readAgentsMdKeys still reads (Codex review).
+    const own = files.find((f) => f.path === "AGENTS.md") ?? files.find((f) => f.path === "project.md");
+    let fromWorkspace = null;
+    if (own) {
+        try {
+            fromWorkspace = blockMode(matter(own.content).data.deploy_block);
+        }
+        catch {
+            // an AGENTS.md that does not parse is reported elsewhere
+        }
+    }
+    return fromWorkspace ?? blockMode(accountKeys.deploy_block) ?? "none";
+}
+function blockersFor(tenant, given) {
+    // The tree as it will be written: `./AGENTS.md` is saved as AGENTS.md, so
+    // it is read as that here too (Codex review).
+    // Two entries for one path: the save keeps the last, so this does too.
+    const byPath = new Map();
+    for (const f of given) {
+        // path.normalize, as saveWorkspace writes it (a backslash is a filename
+        // character here, not a separator — Codex review).
+        const p = path.normalize(f.path);
+        byPath.set(p, { ...f, path: p });
+    }
+    const files = [...byPath.values()];
+    const account = readAgentsMdKeys(accountDir(tenant));
+    const mode = deployBlockMode(files, account);
+    if (mode === "none")
+        return [];
+    // Nearest wins: a workspace tool of the same name replaces the library's,
+    // and the scanner adds the workspace's own outward tools itself. Named as
+    // the runtime names them — the definition's name:, else the file's.
+    const ownTools = new Set();
+    for (const f of files) {
+        const m = /^tools\/([^/]+?)(?:\/tool)?\.md$/.exec(f.path);
+        if (!m)
+            continue;
+        let data = {};
+        try {
+            data = matter(f.content).data;
+        }
+        catch {
+            continue; // unreadable: the runtime skips it and keeps the library's
+        }
+        // Only a definition the runtime accepts replaces the library's; an
+        // invalid one is skipped there, and the library tool stays (Codex review).
+        const def = parseToolDef(data, m[1], f.content);
+        if (def)
+            ownTools.add(def.name ?? m[1]);
+    }
+    const outwardTools = Object.entries(libraryTools(tenant))
+        .filter(([n, d]) => d.outward === true && !ownTools.has(n))
+        .map(([n]) => n);
+    return deployBlockers(files, mode, { accountNetwork: account.network, outwardTools });
+}
+/** The findings `mode` turns into refusals, as deploy issues. */
+export function deployBlockers(files, mode, options = {}) {
+    if (mode === "none")
+        return [];
+    // Every finding checkFiles reports — the scanner's and the structural
+    // ones, flow/outward-ungated among them (Codex review) — with the same
+    // ignores honoured, kept by its rule's category.
+    const categories = new Set(mode === "secrets" ? ["secret"] : ["secret", "content", "security", "supply-chain"]);
+    return checkFiles(files, options)
+        .filter((f) => f.level !== "info" && categories.has(scanRule(f.rule)?.category ?? ""))
+        .map((f) => ({
+        where: `${f.file}${f.line ? `:${f.line}` : ""}`,
+        message: `${f.message} [${f.rule}] — refused: deploy_block: ${mode} in AGENTS.md`,
+    }));
+}
 export function deployWarnings(files) {
     const scanned = scanFiles(files, { only: ["secret", "content"] })
         .filter((f) => f.level !== "info")
@@ -217,11 +342,11 @@ export function checkFiles(files, options = {}) {
     };
     const own = [
         ...deployIssues(files).map((i) => finding(i, "error")),
-        ...structuralWarnings(files).map((i) => finding(i, "warn", i.kind)),
+        ...structuralWarnings(files, options.outwardTools).map((i) => finding(i, "warn", i.kind)),
     ];
     return [...filterIgnored(own, files), ...scanFiles(files, options)].sort((a, b) => a.file.localeCompare(b.file) || (a.line ?? 0) - (b.line ?? 0) || a.rule.localeCompare(b.rule));
 }
-function structuralWarnings(files) {
+function structuralWarnings(files, extraOutward = []) {
     const front = (content) => {
         try {
             return matter(content).data;
@@ -230,8 +355,9 @@ function structuralWarnings(files) {
             return {};
         }
     };
-    // Workspace tools that change something outside the workspace.
-    const outwardTools = new Set();
+    // Tools that change something outside the workspace: the workspace's own,
+    // and the library's the caller resolved (nearest wins already applied).
+    const outwardTools = new Set(extraOutward);
     for (const f of files) {
         const m = f.path.match(/^tools\/([^/]+?)(?:\/tool)?\.md$/);
         if (!m)
@@ -242,6 +368,9 @@ function structuralWarnings(files) {
         // and the CLI use; parseToolDef does not fold it onto the def.
         if (def && data.outward === true)
             outwardTools.add(def.name ?? m[1]);
+        // A workspace tool that is not outward replaces a library one that was.
+        else if (def)
+            outwardTools.delete(def.name ?? m[1]);
     }
     // Agents that grant one of them.
     const outwardAgents = [];
@@ -311,6 +440,26 @@ export function deployIssues(files) {
         if (m)
             agents.add(m[1]);
     }
+    // Frontmatter whose YAML does not parse is a file the runtime cannot read:
+    // an agent with no tools and the default model, a flow that never fires,
+    // a tool that is skipped. Refused where it was written. Until 20 Oct 2026
+    // nothing said so — gray-matter's cache let a second parse pass — and one
+    // such agent file kept the worker from booting for every account.
+    // Definition files only: a skill is read leniently (an unquoted colon is
+    // quoted and retried, runner.ts safeMatter), and the markdown beside a
+    // definition — references, a tool's README — is prose, not frontmatter.
+    for (const f of files) {
+        if (!/^(AGENTS\.md|agents\/[^/]+\/agent\.md|flows\/[^/]+\.md|tools\/[^/]+\.md|tools\/[^/]+\/tool\.md|evals\/[^/]+\.md|hooks\/[^/]+\/hook\.md|\.claude\/agents\/[^/]+\.md)$/.test(f.path))
+            continue;
+        if (!/^\uFEFF?---\r?\n/.test(f.content))
+            continue;
+        try {
+            matter(f.content);
+        }
+        catch (err) {
+            at(f.path, frontmatterErrorText(err));
+        }
+    }
     // `timezone:` is read at four levels and a value nothing can parse falls
     // silently through to the level above — so it is refused where it was
     // written, not discovered as a date that is a day out.
@@ -346,6 +495,13 @@ export function deployIssues(files) {
         // above it — wider or narrower than the author wrote.
         for (const w of networkProblems(front.network))
             at(f.path, w);
+        // `alerts:` that cannot be read would never alert (FOL-72).
+        for (const w of parseAlerts(front.alerts).problems)
+            at(f.path, w);
+        // `telemetry:` that cannot be read would never send — and a token
+        // written into it would ship in the file.
+        for (const w of parseTelemetry(front.telemetry).problems)
+            at(f.path, w);
         const lang = languageProblem(front.language);
         if (lang)
             at(f.path, lang);
@@ -489,7 +645,10 @@ export function planDeploy(tenant, workspace, files, opts = {}) {
         added: added.sort(),
         updated: updated.sort(),
         removed: removed.sort(),
-        issues: deployIssues(files),
+        // deploy_block: (FOL-58) turns the scanner's findings into refusals —
+        // scanned with what the Checks page passes too: the account's network:
+        // and the library's outward tools (Codex review).
+        issues: [...deployIssues(files), ...blockersFor(tenant, files)],
         warnings: deployWarnings(files),
         blockedBy: runsInFlight(tenant, workspace),
     };

package/dist/src/egress.d.ts

@@ -1,3 +1,4 @@
+import type { PeerInfo } from "./operator.ts";
 import type { TestEffect } from "./test-mode.ts";
 import type { NetworkLevel } from "./network.ts";
 /** `${NAME}` — the shape a secret reference takes everywhere in foldrun. */
@@ -92,14 +93,28 @@ export interface EgressHooks {
      *  policy in test-mode.ts to every request on this lease. Carried on the
      *  lease, not the request, because the pod is the party not trusted to
      *  say so. */
-    /** `step` — the step's index in run.steps; keys that step's operator inbox. */
+    /** `step` — the step's index in run.steps; keys that step's operator inbox.
+     *  `agent` and `peers` — this step's agent and the other steps of its
+     *  parallel group (tools: [peers]): the proxy serves the roster and
+     *  addresses a colleague's message to the right inbox. */
     lease(args: {
         tenant: string;
         runId: string;
         grant: EgressGrant;
         test?: boolean;
         step?: number;
+        agent?: string;
+        peers?: PeerInfo[];
     }): Promise<EgressLease | null>;
+    /** The step is over — every attempt, however it ended (tools: [peers]).
+     *  A lease comes and goes per attempt, so it cannot say this: a sibling
+     *  between retries, or waiting for a slot, holds none and is not done.
+     *  Optional: a platform without it keeps every sibling reachable. */
+    stepEnded?(args: {
+        tenant: string;
+        runId: string;
+        step: number;
+    }): Promise<void>;
 }
 /** Strip a header set of the proxy's own and hop-by-hop headers. */
 export declare const HOP_BY_HOP: Set<string>;

package/dist/src/evals.d.ts

@@ -62,10 +62,14 @@ export declare function listEvals(tenant: string, workspace: string): EvalInfo[]
  * regressions file when there is one, so a flow collects its cases in one
  * place instead of one file per press.
  */
-export declare function promoteRunToEval(tenant: string, workspace: string, runId: string, opts?: {
+export declare function promoteRunToEval(tenant: string, workspace: string, runId: string, 
+/** `should`: what a run that went wrong should have done, in a sentence —
+ *  the judge's claim for the case (FOL-72 step 10). */
+opts?: {
     evalName?: string;
     caseName?: string;
     expect?: string[];
+    should?: string;
     by?: string;
 }): {
     file: string;

package/dist/src/evals.js

@@ -30,16 +30,16 @@
 // Deterministic checks run first and cost nothing. The judge only runs if
 // they pass — no point paying a model to grade output already known to be
 // wrong.
-import { accountModelEnv } from "./model-env.js";
+import { accountModelEnv, withModelEnv } from "./model-env.js";
 import { sdkEnv } from "./step-exec.js";
 import fs from "node:fs";
 import path from "node:path";
 import { deployedCommit } from "./deploy.js";
 import { latestRevisionId } from "./history.js";
-import matter from "gray-matter";
+import matter from "./matter.js";
 import { spawn } from "node:child_process";
 import { query } from "@anthropic-ai/claude-agent-sdk";
-import { workspaceDir, readRun, writeWorkspaceFile, resolveModel, resolveEffort, assertSafeName, } from "./store.js";
+import { workspaceDir, readRun, runVerdict, writeWorkspaceFile, resolveModel, resolveEffort, assertSafeName, } from "./store.js";
 import { startFlowRun, loadFlow } from "./runner.js";
 import { platform, platformQueues } from "./platform.js";
 const ASSERTION_TYPES = ["contains", "not-contains", "matches", "file", "run", "judge"];
@@ -198,16 +198,27 @@ function layoutTask(task) {
  * regressions file when there is one, so a flow collects its cases in one
  * place instead of one file per press.
  */
-export function promoteRunToEval(tenant, workspace, runId, opts = {}) {
+export function promoteRunToEval(tenant, workspace, runId, 
+/** `should`: what a run that went wrong should have done, in a sentence —
+ *  the judge's claim for the case (FOL-72 step 10). */
+opts = {}) {
     const run = readRun(tenant, workspace, runId);
     if (!run)
         throw refuse(`run ${runId} not found`, 404);
-    if (run.status !== "completed") {
-        throw refuse(`only a completed run can become an eval — this one is ${run.status}`, 409);
+    if (run.status !== "completed" && run.status !== "failed") {
+        throw refuse(`only a finished run can become an eval — this one is ${run.status}`, 409);
+    }
+    // A run that went wrong is the test worth having most — but its own answer
+    // is the wrong one to hold the next run to, so it needs to be told what
+    // was right (FOL-72 step 10).
+    const should = oneLine(opts.should ?? "");
+    const wentWrong = run.status === "failed" || ["BAD", "BLOCKED"].includes(runVerdict(run) ?? "");
+    if (wentWrong && !should && !(opts.expect && opts.expect.length)) {
+        throw refuse("this run went wrong, so its answer is not the one to keep — say what it should have done (`should`, a sentence for the judge) or give `expect` lines", 409);
     }
     const produced = run.steps.filter((s) => (s.result ?? "").trim());
     const last = produced[produced.length - 1];
-    if (!last)
+    if (!last && !should && !(opts.expect && opts.expect.length))
         throw refuse("this run produced no result to hold the next one to", 409);
     if (run.steps.length === 0 || !run.steps[0].instruction?.trim()) {
         throw refuse("this run has no task on record", 409);
@@ -239,6 +250,9 @@ export function promoteRunToEval(tenant, workspace, runId, opts = {}) {
             return `${m[1]}: ${m[2]}`;
         });
     }
+    else if (should) {
+        expect = [`judge: ${should.slice(0, 400)}`];
+    }
     else {
         const conclusion = oneLine(run.summary?.trim() || (last.result ?? "")).slice(0, 200);
         expect = [`judge: reaches the same conclusion as the recorded run: ${conclusion}`];
@@ -382,7 +396,7 @@ async function judge(rubric, output, model, effort, env) {
     }
     return text.trim();
 }
-async function checkAssertion(assertion, output, agentDir, model, effort, judgeEnv = () => sdkEnv(undefined)) {
+async function checkAssertion(assertion, output, agentDir, model, effort, judgeEnv = () => ({ env: sdkEnv(undefined) })) {
     const hay = output.toLowerCase();
     switch (assertion.type) {
         case "contains": {
@@ -417,14 +431,14 @@ async function checkAssertion(assertion, output, agentDir, model, effort, judgeE
         case "judge": {
             // The judge runs on the account's own model key, never quietly on the
             // platform's: a customer's eval is not the operator's bill.
-            let env;
+            let m;
             try {
-                env = judgeEnv();
+                m = judgeEnv();
             }
             catch (err) {
                 return { assertion, passed: false, detail: `judge not run — ${err instanceof Error ? err.message : String(err)}` };
             }
-            const verdict = await judge(assertion.value, output, model, effort, env);
+            const verdict = await withModelEnv(m, (env) => judge(assertion.value, output, model, effort, env));
             const passed = /^\s*PASS\b/i.test(verdict);
             return { assertion, passed, detail: verdict.slice(0, 300) || "judge returned nothing" };
         }
@@ -495,13 +509,7 @@ export async function runEval(tenant, workspace, info) {
             for (const a of cheap)
                 assertions.push(await checkAssertion(a, output, agentDir, info.model, info.effort));
             if (assertions.every((r) => r.passed)) {
-                const judgeEnv = () => {
-                    const m = accountModelEnv(tenant, workspace, () => sdkEnv(undefined));
-                    if (m.format !== "anthropic") {
-                        throw new Error(`this account's provider speaks ${m.format}; a judge needs an Anthropic-format provider`);
-                    }
-                    return m.env;
-                };
+                const judgeEnv = () => accountModelEnv(tenant, workspace, () => sdkEnv(undefined));
                 for (const a of judges)
                     assertions.push(await checkAssertion(a, output, agentDir, info.model, info.effort, judgeEnv));
             }

package/dist/src/frontmatter-fields.js

@@ -24,6 +24,7 @@ const LOCALE = { validated: true };
 const AGENT = [
     { key: "name", type: "string", help: "kebab-case; the folder is the identity" },
     { key: "description", type: "string", help: "what it does and when — other agents and people read it" },
+    { key: "owner", type: "string", help: "the person accountable for it — an email or a name; else the workspace's, else the account's" },
     { key: "model", type: "string", help: "fast | default | max, an alias, or a full model id" },
     { key: "effort", type: "string", values: EFFORT_LEVELS, help: "how long it thinks" },
     { key: "size", type: "string", values: ["small", "large", "heavy"], help: "the sandbox it rents; anything else becomes large" },
@@ -59,6 +60,7 @@ const AGENTS_MD = [
     { key: "mdagent_version", type: ["string", "number"], legacy: true, help: "older spelling of foldrun_version" },
     { key: "name", type: "string", help: "the workspace's name" },
     { key: "description", type: "string", help: "shown in the workspace list" },
+    { key: "owner", type: "string", help: "the person accountable for every agent and flow here that names none" },
     { key: "provider", type: "object", help: "the model endpoint every agent here uses unless it names its own" },
     { key: "runtime", type: "object", help: "packages for agents that declare none" },
     { key: "web", type: "object", validated: true, help: "web.browse defaults" },
@@ -75,17 +77,24 @@ const AGENTS_MD = [
     { key: "budget", type: ["number", "string"], help: "USD per month, or N/day | N/week | N/month" },
     { key: "priority", type: "string", values: ["high", "normal", "low"], help: "account: where its runs stand in the queue" },
     { key: "concurrency", type: ["number", "string"], help: "account: runs at once" },
+    { key: "alerts", type: "object", validated: true, help: "thresholds that tell notify: — failure_rate (30%), min_runs, credits_day, run_minutes, stale_days, cost_spike, runs_per_hour, new_host" },
+    { key: "capture", type: "string", values: ["full", "metadata"], help: "what runs record of each tool call: full (its input and output, secrets masked) or metadata (name, size and time only)" },
+    { key: "network_enforce", type: "boolean", help: "true: a site off a step's network: list is refused, not only named in the trace. The account's or the workspace's true is enough" },
+    { key: "telemetry", type: "object", validated: true, help: "send each run as an OpenTelemetry trace — otlp: <https …/v1/traces>, headers: { authorization: ${SECRET} }" },
+    { key: "deploy_block", type: "string", values: ["none", "secrets", "security"], help: "refuse a deploy on scanner findings: secrets (a key written in) or security (any security warning)" },
     { key: "schedule", type: ["string", "object"], validated: true, legacy: true, help: "refused: only a flow has a clock" },
 ];
 const FLOW = [
     { key: "name", type: "string", help: "the flow's name" },
     { key: "description", type: "string", help: "what it is for" },
+    { key: "owner", type: "string", help: "the person accountable for it — an email or a name; else the workspace's, else the account's" },
     { key: "trigger", type: "string", values: FLOW_TRIGGERS, help: "what starts it; any other value never fires" },
     { key: "schedule", type: "string", help: "cron, when trigger: schedule" },
     { key: "timezone", type: "string", validated: true, help: "the zone its schedule reads in" },
     { key: "model", type: "string", help: "every step's model unless the step says" },
     { key: "effort", type: "string", values: EFFORT_LEVELS, help: "every step's effort unless the step says" },
     { key: "overlap", type: "string", validated: true, help: "skip | queue" },
+    { key: "issues", type: "string", values: ["stay-open", "auto-close"], help: "what a good run does to this flow's open issues: stay-open (the default — a person resolves them) or auto-close" },
     { key: "priority", type: "string", validated: true, help: "high | normal | low" },
     { key: "catchup", type: "string", validated: true, help: "last | none" },
     { key: "on", type: "string", validated: true, help: "trigger: flow — completed | failed | blocked | any" },

package/dist/src/frontmatter-schema.js

@@ -5,6 +5,7 @@ import { FRONTMATTER } from "./frontmatter-fields.js";
 import { resolveEffort, parseDuration, parseInstant, parseRate, STEP_OPTION_KEYS } from "./store.js";
 import { budgetProblem } from "./budget.js";
 import { cronProblem } from "./cron.js";
+import { modelSecretCollision } from "./model-credential.js";
 export { FRONTMATTER, schemaKindOf } from "./frontmatter-fields.js";
 /** A value for a message: a scalar as written, anything else by its shape.
  *  Never String() of a map — its `toString` is whatever the YAML says. */
@@ -29,6 +30,7 @@ const CHECKS = {
         apis: apisProblem,
         budget: (v) => budgetProblem(v, ["run"]),
         ask: (v) => askProblem(v),
+        secrets: modelSecretCollision,
     },
     "agents-md": {
         budget: (v) => budgetProblem(v, ["day", "week", "month"]),
@@ -52,6 +54,7 @@ const CHECKS = {
         transport: (v) => (["http", "script", "mcp"].includes(String(v).toLowerCase()) ? null : `"${String(v)}" is not a transport — http, script or mcp`),
         methods: methodsProblem,
         rate: (v) => (parseRate(v) ? null : `"${shown(v)}" is not a rate — N/s, N/minute, N/hour, or a number per second, above 0`),
+        secrets: modelSecretCollision,
     },
     "eval": {
         effort: (v) => (resolveEffort(v) ? null : `"${String(v)}" is not an effort — low, medium, high, xhigh or max; the judge runs at none`),

package/dist/src/history.d.ts

@@ -86,6 +86,10 @@ export declare function listRevisions(tenant: string, scope: string, opts?: {
     limit?: number;
 }): RevisionSummary[];
 export declare function readRevision(tenant: string, scope: string, id: string, forPath?: string): Revision | null;
+/** The files changed after revision `from` up to and including `to`, in a
+ *  scope — what differs between the versions two runs ran (FOL-72). Null
+ *  when either is unknown or `to` is not after `from`. */
+export declare function changedPathsBetween(tenant: string, scope: string, from: string | null, to: string | null): string[] | null;
 /** The most recent revision id for a scope — what a change is attributed
  *  to when nothing more specific (a deployed commit) is on record. */
 export declare function latestRevisionId(tenant: string, scope: string): string | null;

package/dist/src/history.js

@@ -344,6 +344,21 @@ export function readRevision(tenant, scope, id, forPath) {
     const rev = JSON.parse(fs.readFileSync(file, "utf8"));
     return forPath ? { ...rev, files: rev.files.filter((f) => f.path === forPath) } : rev;
 }
+/** The files changed after revision `from` up to and including `to`, in a
+ *  scope — what differs between the versions two runs ran (FOL-72). Null
+ *  when either is unknown or `to` is not after `from`. */
+export function changedPathsBetween(tenant, scope, from, to) {
+    if (!from || !to)
+        return null;
+    if (from === to)
+        return [];
+    const revs = listRevisions(tenant, scope, { limit: 500 }); // newest first
+    const ti = revs.findIndex((r) => r.id === to || r.commit === to);
+    const fi = revs.findIndex((r) => r.id === from || r.commit === from);
+    if (ti < 0 || fi < 0 || ti > fi)
+        return null;
+    return [...new Set(revs.slice(ti, fi).flatMap((r) => r.paths))].sort();
+}
 /** The most recent revision id for a scope — what a change is attributed
  *  to when nothing more specific (a deployed commit) is on record. */
 export function latestRevisionId(tenant, scope) {

package/dist/src/hooks.js

@@ -30,7 +30,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
-import matter from "gray-matter";
+import matter from "./matter.js";
 export const HOOK_EVENTS = ["tool.call", "tool.result", "step.start", "step.end"];
 /** Events that decide something before it happens: a failure refuses. */
 const GATES = new Set(["tool.call", "step.start"]);

package/dist/src/insights.d.ts

@@ -0,0 +1,30 @@
+import type { RunRecord } from "./store.ts";
+export type InsightKind = "cache" | "big-result" | "retry-loop" | "timeout";
+export interface Insight {
+    id: string;
+    kind: InsightKind;
+    workspace: string;
+    agent: string;
+    tool?: string;
+    title: string;
+    /** Why it happens, in a sentence. */
+    why: string;
+    fix: string;
+    /** About how many credits it cost in the window; null when not money. */
+    credits: number | null;
+    /** How many steps showed it. */
+    steps: number;
+    /** The newest runs it was seen in, at most 5. */
+    evidence: {
+        workspace: string;
+        runId: string;
+        step: number;
+    }[];
+}
+type Run = RunRecord & {
+    workspace: string;
+};
+export declare function findInsights(runs: Run[], opts?: {
+    minSteps?: number;
+}): Insight[];
+export {};