@foldrun/core 2.5.0 → 2.6.0

package/dist/src/network.js

@@ -26,6 +26,8 @@
 // proxy and DNS and nothing else, so a program that ignores the proxy
 // variables fails instead of going round. This file is the vocabulary; the
 // proxy (foldrun-platform egress-proxy.ts) holds the rule per request.
+/** How wide a step's network is. */
+import { keySpan, dropEmptyBlock } from "./frontmatter-text.js";
 export const NETWORK_LEVELS = ["open", "trusted", "none"];
 /**
  * The trusted list: the domains Anthropic's Claude Code cloud environments
@@ -370,15 +372,16 @@ export function setNetworkSetting(raw, setting) {
     const close = lines.findIndex((l, i) => i > 0 && l.trim() === "---");
     if (close < 0)
         return raw;
-    const at = lines.findIndex((l, i) => i > 0 && i < close && /^network\s*:/.test(l));
-    if (at < 0) {
+    // Where network: is written — at the top or inside `guardrail:` — is
+    // where it is set (frontmatter-text.ts); written nowhere, it goes last.
+    const where = keySpan(lines.slice(1, close), "network");
+    if (!where) {
         if (line)
             lines.splice(close, 0, line);
         return lines.join(eol);
     }
-    let end = at + 1;
-    while (end < close && (/^\s+\S/.test(lines[end]) || /^\s*-\s/.test(lines[end])))
-        end++;
-    lines.splice(at, end - at, ...(line ? [line] : []));
-    return lines.join(eol);
+    const front = lines.slice(1, close);
+    front.splice(where.at, where.end - where.at, ...(line ? [`${where.indent}${line}`] : []));
+    const edited = !line && where.block !== null ? dropEmptyBlock(front, where.block) : front;
+    return [lines[0], ...edited, ...lines.slice(close)].join(eol);
 }

package/dist/src/package.js

@@ -25,7 +25,7 @@
 // claim, the files are what will run.
 import fs from "node:fs";
 import path from "node:path";
-import matter from "./matter.js";
+import matter, { configMatter } from "./matter.js";
 import { assertSafeName, isEditablePath, listWorkspaceFiles, listWorkspaces, listFlows, parseFlow, readWorkspaceFile, saveWorkspace, blankTemplateFiles, syncBundleFor, notifyWorkspaceChanged, workspaceDir, } from "./store.js";
 import { recordRevision } from "./history.js";
 import { libraryDir, libraryTools } from "./library.js";
@@ -522,7 +522,14 @@ function safeFront(content) {
     }
 }
 function frontOf(content) {
-    const d = safeFront(content);
+    // An agent's secrets: and tools: may sit in its guardrail: block.
+    let d;
+    try {
+        d = configMatter(content).data;
+    }
+    catch {
+        d = {};
+    }
     const apis = Array.isArray(d.apis) ? d.apis.map((a) => (a && typeof a === "object" ? String(a.name ?? "") : "")) : [];
     const mcp = d.mcpServers && typeof d.mcpServers === "object" ? Object.keys(d.mcpServers) : [];
     const scripts = list(d.scripts);

package/dist/src/provider-health.js

@@ -20,7 +20,7 @@
 import { accountModelBlock } from "./model-credential.js";
 import fs from "node:fs";
 import path from "node:path";
-import matter from "./matter.js";
+import { configMatter } from "./matter.js";
 import { getSecret } from "./secrets.js";
 import { noteSecretUse, healthKey } from "./secret-health.js";
 import { accountDir, workspaceDir, listWorkspaces, listAgents, parseProvider } from "./store.js";
@@ -168,7 +168,7 @@ function cheapestModel(spec) {
 }
 function frontmatterOf(file) {
     try {
-        return (matter(fs.readFileSync(file, "utf8")).data ?? {});
+        return (configMatter(fs.readFileSync(file, "utf8")).data ?? {});
     }
     catch {
         return {};

package/dist/src/run-container.d.ts

@@ -45,6 +45,9 @@ export interface ContainerStepInput {
     budgetNote?: string;
     price?: TokenPrice | null;
     verify?: string;
+    /** The model `verify: judge:` grades with (the workspace's `judge:`). */
+    judgeModel?: string;
+    judgeEffort?: string;
     /** `output: json` — checked inside, where the reply is. */
     output?: "json";
     /** `schema:` and `max_turns:`, resolved host-side — see ExecOptions. */
@@ -285,6 +288,8 @@ export declare function runtimeCacheMount(tenant: string | undefined): {
     source: string;
     target: string;
 } | null;
+/** The runner container's entrypoint, as JS text: written into the image as driver.mjs, so it must be plain JS — a TypeScript cast here broke every step on v2026.10.21.5 (tests/run-container.test.ts checks it). */
+export declare const DRIVER = "// The runner container's entrypoint. Reads one step, executes it with the\n// same core the server uses, speaks JSONL on stdout, exits.\nimport fs from \"node:fs\";\nconst input = JSON.parse(fs.readFileSync(\"/opt/runner/job/input.json\", \"utf8\"));\n// Start-up marks (run-container.ts#STARTUP_PHASES): which phase just ended,\n// on the sandbox's clock. A worker that does not know a mark skips the line.\nconst mark = (name) => process.stdout.write(JSON.stringify({ e: \"mark\", name, at: Date.now() }) + \"\\n\");\nmark(\"driver\");\nlet modelSpoke = false;\nconst emit = (type, text, extra) => {\n  // The model's first text or tool call is where start-up ends and the\n  // step's own work begins \u2014 runtime and tool lines before it are set-up.\n  if (!modelSpoke && (type === \"text\" || type === \"tool\")) { modelSpoke = true; mark(\"model\"); }\n  process.stdout.write(JSON.stringify({ e: \"event\", type, text, ...extra }) + \"\\n\");\n};\n// What this sandbox actually touched, read at the last moment from the\n// kernel's own books: cgroup v2 for CPU busy-time and peak memory,\n// /proc/net/dev for bytes on the wire. Every read is best-effort \u2014 gVisor\n// exposes some of these files and not others depending on version, and a\n// metric we cannot read is null, never guessed. Reservation is what is\n// billed; these exist so the reservation can be right-sized.\nfunction readActuals() {\n  // fs from the module's own import \u2014 the driver is ESM, and a require()\n  // here threw on every call, silently nulling every metric it guarded.\n  const read = (p) => { try { return fs.readFileSync(p, \"utf8\"); } catch { return null; } };\n  // Two cgroup dialects: v2 (cpu.stat, microseconds; memory.peak) on a\n  // plain runtime, v1-style controllers under gVisor (cpuacct.usage,\n  // NANOseconds; memory.max_usage_in_bytes) \u2014 probed on the real cluster,\n  // not assumed. Whichever answers wins; both silent means null.\n  const cpuStat = read(\"/sys/fs/cgroup/cpu.stat\");\n  const usage = cpuStat?.match(/^usage_usec (\\d+)/m);\n  const cpuacctNs = usage ? NaN : Number(read(\"/sys/fs/cgroup/cpuacct/cpuacct.usage\")?.trim());\n  const peak =\n    read(\"/sys/fs/cgroup/memory.peak\") ??\n    read(\"/sys/fs/cgroup/memory/memory.max_usage_in_bytes\") ??\n    read(\"/sys/fs/cgroup/memory/memory.usage_in_bytes\");\n  let rx = 0, tx = 0, sawNet = false;\n  const net = read(\"/proc/net/dev\");\n  if (net) {\n    for (const line of net.split(\"\\n\").slice(2)) {\n      const m = line.trim().match(/^(\\S+):\\s+(\\d+)(?:\\s+\\d+){7}\\s+(\\d+)/);\n      if (m && m[1] !== \"lo\") { rx += Number(m[2]); tx += Number(m[3]); sawNet = true; }\n    }\n  }\n  return {\n    busyCpuSecs: usage\n      ? Number(usage[1]) / 1e6\n      : Number.isFinite(cpuacctNs) && cpuacctNs > 0\n        ? cpuacctNs / 1e9\n        : null,\n    peakMemBytes: peak ? Number(peak.trim()) || null : null,\n    rxBytes: sawNet ? rx : null,\n    txBytes: sawNet ? tx : null,\n  };\n}\n\ntry {\n  // Runtime state (venvs, npm prefixes) lands in the agent user's real home\n  // \u2014 writable, inside the container, gone with it.\n  process.env.FOLDRUN_DATA = \"/home/agent/.foldrun\";\n  const { executeStep } = await import(\"@foldrun/core/step-exec\");\n  const { buildApiTools } = await import(\"@foldrun/core/api-tools\");\n  const { buildScriptTools } = await import(\"@foldrun/core/script-tools\");\n  const { buildConsultTools } = await import(\"@foldrun/core/agent-tools\");\n  const { buildSearchTools, buildHistoryTools, buildDeskTools } = await import(\"@foldrun/core/context-tools\");\n  const { httpChannel, buildAskTool, buildPeerTools, inboxReader } = await import(\"@foldrun/core/operator\");\n  const { startTranslator } = await import(\"@foldrun/core/translator\");\n  const { prepareRuntime } = await import(\"@foldrun/core/runtime\");\n  const { materializeFileSecrets } = await import(\"@foldrun/core/secret-files\");\n  const { paidWebActions } = await import(\"@foldrun/core/browser-pod\");\n  mark(\"imports\");\n\n  const agentDir = \"/workspace/\" + input.agentRel;\n  // HOME is where a bare relative path lands when anything resolves one\n  // outside cwd \u2014 and root's /root is outside the workspace, so such a read\n  // was refused by confinement with a path the agent never typed. Its own\n  // directory is both the truthful answer and the safe one.\n  // @file secrets crossed as content; materialise them to 0600 paths inside\n  // the container (a host path from the other side would not exist here).\n  const env = materializeFileSecrets(agentDir, { ...process.env, HOME: agentDir }).env;\n  // Caches go to the sandbox user's own home, not to HOME: the Claude CLI's\n  // logs, fontconfig, Mesa and gstreamer all follow XDG_CACHE_HOME, and under\n  // agents/<name>/.cache they were copied back after every step \u2014 3,855 files\n  // across 179 agent folders on the box by 17 Oct 2026, read by nothing.\n  env.XDG_CACHE_HOME = \"/home/agent/.cache\";\n\n  // The declared runtime, built in here \u2014 pip and npm have the network, which\n  // the host side may not. It lands in .foldrun/runner/.runtimes, which the\n  // executors mount from a per-tenant directory (run-container.ts#RUNTIME_CACHE):\n  // the first step for a given fingerprint installs, every later one finds\n  // .ready and skips. With no mount it still works, just fresh every time \u2014\n  // which is what this used to be unconditionally. The log says which happened.\n  const runtime = input.runtime\n    ? prepareRuntime(\"runner\", input.runtime)\n    : { interpreters: {}, env: {}, log: [], error: null };\n  for (const line of runtime.log) emit(\"info\", \"runtime: \" + line);\n  if (runtime.error) emit(\"error\", \"runtime: \" + runtime.error);\n  // The step's own environment gets it too, not only the script tools: an\n  // agent that runs \"python3 x.py\" or a shebang script through Bash should\n  // meet the packages its runtime declared, not the image's bare python.\n  Object.assign(env, runtime.env);\n\n  // install: what the agent finds it needs mid-step. apt goes through the\n  // root start-up's helper (install-helper.ts); pip and npm land in a\n  // directory of this container's own, on the paths from the first turn.\n  const { buildInstallTool, INSTALL_TOOL } = await import(\"@foldrun/core/install-tool\");\n  const { stepInstallEnv, INSTALL_SOCKET } = await import(\"@foldrun/core/runtime\");\n  const installDir = \"/home/agent/.foldrun/step\";\n  const installing = (input.allowed ?? []).includes(INSTALL_TOOL);\n  if (installing) Object.assign(env, stepInstallEnv(installDir, env));\n  const install = installing\n    ? buildInstallTool({\n        dir: installDir,\n        socket: env.FOLDRUN_INSTALL_SOCKET || INSTALL_SOCKET,\n        cacheRoot: \"/home/agent/.foldrun/runner/.runtimes\",\n        python: env.VIRTUAL_ENV ? env.VIRTUAL_ENV + \"/bin/python\" : \"python3\",\n        env,\n        emit,\n      })\n    : { server: null };\n\n  // API and script tools, rebuilt in here from their specs. Secrets were\n  // substituted into API headers before the input crossed the boundary, so\n  // buildApiTools gets an already-resolved environment. verify: gets the\n  // container's own environment, whole: it is the boundary, assembled on\n  // the host from an allowlist, and the declared secrets are in it.\n  // A long result is kept in a file only when the agent can read it back.\n  // (tool-output.ts canReadBack, inlined: the driver imports core by subpath.)\n  const keepIn = { dir: agentDir, readable: () => (input.allowed ?? []).some((t) => t === \"Read\" || t === \"Grep\") };\n  // A declared secret named like a model variable crosses as\n  // FOLDRUN_DECLARED_<NAME> (runner.ts, FOL-19): the model keeps its own\n  // settings, and the agent's API and script tools and verify: get the value\n  // back under the name it declared. Built here, after the runtime and any\n  // mid-step install have added their paths to env.\n  const toolEnv = { ...env };\n  for (const [k, v] of Object.entries(env)) if (k.startsWith(\"FOLDRUN_DECLARED_\")) toolEnv[k.slice(\"FOLDRUN_DECLARED_\".length)] = v;\n  const api = buildApiTools(\"\", input.apis, undefined, { env: toolEnv, missing: [] }, keepIn);\n  const script = buildScriptTools(\n    agentDir,\n    input.scripts,\n    toolEnv,\n    \"/library/scripts\",\n    runtime.interpreters,\n    null,\n    keepIn.readable,\n  );\n  // The translator, when the provider speaks Chat Completions: a loopback\n  // server for the length of this step. Its env replaces the endpoint the\n  // host assembled; the provider's real URL and key stay inside it.\n  const translator = input.translator ? await startTranslator(input.translator) : null;\n  if (translator) {\n    Object.assign(env, translator.env);\n    emit(\"info\", \"translator: listening on \" + translator.baseUrl + \" for \" + (input.translator.label ?? input.translator.upstreamBase));\n  }\n  const consult = buildConsultTools(input.consults ?? [], env, emit);\n  // The platform's own two groups, rebuilt from values like everything else.\n  const search = buildSearchTools(input.search ?? []);\n  const history = input.history?.length ? buildHistoryTools(input.history) : { server: null };\n  const desks = input.desks?.length ? buildDeskTools(input.desks) : { server: null };\n  // A person in the loop, over the proxy this step's lease already names:\n  // ask_person when tools: [ask], and the run's inbox after every tool call.\n  const channel = httpChannel(env.FOLDRUN_EGRESS);\n  const ask = input.ask ? buildAskTool({ channel, timeoutSec: input.ask.timeoutSec, emit }) : { server: null };\n  const peers = input.peers ? buildPeerTools({ channel, self: input.peers.self, siblings: input.peers.siblings, emit }) : { server: null };\n  const inbox = channel ? inboxReader(channel, emit) : undefined;\n\n  mark(\"tools\");\n  const outcome = await executeStep({\n    agentDir,\n    workspaceRoot: \"/workspace\",\n    libraryRoot: \"/library\",\n    prompt: input.prompt,\n    model: input.model,\n    effort: input.effort ?? null,\n    systemPrompt: input.systemPrompt,\n    allowed: input.allowed,\n    mcpNames: input.mcpNames,\n    mcpServers: {\n      ...(api.server ? { foldrun_apis: api.server } : {}),\n      ...(script.server ? { foldrun_scripts: script.server } : {}),\n      ...(consult.server ? { foldrun_agents: consult.server } : {}),\n      ...(search.server ? { foldrun_search: search.server } : {}),\n      ...(history.server ? { foldrun_history: history.server } : {}),\n      ...(desks.server ? { foldrun_desks: desks.server } : {}),\n      ...(ask.server ? { foldrun_ask: ask.server } : {}),\n      ...(peers.server ? { foldrun_peers: peers.server } : {}),\n      ...(install.server ? { foldrun_install: install.server } : {}),\n      ...input.mcpServers,\n    },\n    ...(inbox ? { inbox } : {}),\n    ...(input.subagents?.length ? { subagents: input.subagents } : {}),\n    env,\n    timeoutSec: input.timeoutSec,\n    budgetUsd: input.budgetUsd,\n    budgetNote: input.budgetNote,\n    price: input.price,\n    verify: input.verify,\n    verifyEnv: toolEnv,\n    ...(typeof input.judgeModel === \"string\" ? { judgeModel: input.judgeModel } : {}),\n    ...(typeof input.judgeEffort === \"string\" ? { judgeEffort: input.judgeEffort } : {}),\n    output: input.output,\n    schema: input.schema,\n    maxTurns: input.maxTurns,\n    ...(input.capture === \"metadata\" || input.capture === \"full\" ? { capture: input.capture } : {}),\n    ...(input.limits && Object.keys(input.limits).length ? { limits: input.limits, toolOwners: input.toolOwners ?? {} } : {}),\n    ...(input.hookNames?.length ? { hookNames: input.hookNames, hookBase: input.hookBase ?? {} } : {}),\n    // Slim browsing: the platform put this step on the slim image to browse\n    // through the account's pod, and named the file the web tool logs its\n    // reconnects to. A lost pod stops the step; what it wrote decides what\n    // the runner does next (browser-pod.ts).\n    ...(env.FOLDRUN_BROWSER_POD_EVENTS ? { browserPod: { events: env.FOLDRUN_BROWSER_POD_EVENTS, methods: api.methods ?? {}, paidWeb: paidWebActions(env), ...(env.FOLDRUN_BROWSER_INIT ? { browseInit: env.FOLDRUN_BROWSER_INIT } : {}) } } : {}),\n    // The container is the boundary; the SDK's own bash sandbox here would\n    // only block declared network use (SSH, curl) for no added safety.\n    sandboxBash: false,\n    emit,\n  });\n  for (const line of api.drainLog()) emit(\"info\", \"api: \" + line);\n  for (const line of script.drainLog()) emit(\"info\", \"script: \" + line);\n  if (translator) {\n    for (const line of translator.drainLog()) emit(\"info\", line.startsWith(\"translator\") ? line : \"translator: \" + line);\n    await translator.close();\n  }\n  // A consult's spend belongs to the step that asked.\n  const consultCost = consult.drainCost();\n  if (consultCost > 0) outcome.costUsd = (outcome.costUsd ?? 0) + consultCost;\n  if (consultCost > 0 && typeof outcome.turnsCostUsd === \"number\") outcome.turnsCostUsd += consultCost;\n  process.stdout.write(JSON.stringify({ e: \"done\", ...outcome, res: readActuals() }) + \"\\n\");\n  process.exit(0);\n} catch (err) {\n  emit(\"error\", err instanceof Error ? err.message : String(err));\n  // The failure path reports actuals too \u2014 a step that died eleven minutes\n  // in still held its slice for eleven minutes, and the failed runs are\n  // exactly the ones whose resource story gets read.\n  let res = null;\n  try { res = readActuals(); } catch { /* the reading must never mask the error */ }\n  process.stdout.write(JSON.stringify({ e: \"done\", status: \"failed\", result: null, costUsd: null, res }) + \"\\n\");\n  process.exit(0);\n}\n";
 /** The uv release copied into the image. Pinned: a floating uv is a floating
  *  resolver, and the runtime cache is keyed on the declaration, not on it. */
 export declare const UV_VERSION = "0.11.25";
@@ -415,6 +420,10 @@ export interface RunInContainerArgs {
      *  without it, "stop" could only mean "stop after this step", and a
      *  browser step has fifteen minutes left to spend. */
     runId?: string;
+    /** Whether a person has stopped the run, read from the record. A step that
+     *  waits for room before its sandbox exists asks this, since there is no
+     *  sandbox yet for the stop to destroy. */
+    stopRequested?: () => boolean;
     /** The reservation class — which limits this step's sandbox holds. */
     size?: "small" | "large" | "heavy";
     /** Re-attach to a sandbox a previous driver started, instead of creating

package/dist/src/run-container.js

@@ -410,7 +410,8 @@ export function runtimeCacheMount(tenant) {
     return { source, target: RUNTIME_CACHE };
 }
 // ---------- the runner image ----------
-const DRIVER = `// The runner container's entrypoint. Reads one step, executes it with the
+/** The runner container's entrypoint, as JS text: written into the image as driver.mjs, so it must be plain JS — a TypeScript cast here broke every step on v2026.10.21.5 (tests/run-container.test.ts checks it). */
+export const DRIVER = `// The runner container's entrypoint. Reads one step, executes it with the
 // same core the server uses, speaks JSONL on stdout, exits.
 import fs from "node:fs";
 const input = JSON.parse(fs.readFileSync("/opt/runner/job/input.json", "utf8"));
@@ -608,6 +609,8 @@ try {
     price: input.price,
     verify: input.verify,
     verifyEnv: toolEnv,
+    ...(typeof input.judgeModel === "string" ? { judgeModel: input.judgeModel } : {}),
+    ...(typeof input.judgeEffort === "string" ? { judgeEffort: input.judgeEffort } : {}),
     output: input.output,
     schema: input.schema,
     maxTurns: input.maxTurns,

package/dist/src/runner.js

@@ -9,7 +9,7 @@ import { hookNames } from "./hooks.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import matter from "./matter.js";
+import matter, { parseLenient, configMatter } from "./matter.js";
 import { knownPrice, executeStep, extractJson, stepCeiling, stepCeilingFor } from "./step-exec.js";
 import { cascadeLimits, toolOwners } from "./limits.js";
 import { resolveAgentPath } from "./confine.js";
@@ -18,6 +18,7 @@ import { eventUrl } from "./webhook.js";
 import { runStepInContainer, sizeLimits, killRunSandboxes } from "./run-container.js";
 import { hostSafeEnv, platformApiUrl } from "./host-env.js";
 import { resolveModelCredential, credentialLine, accountModelBlock, isClaudeLoginToken, isModelEnvName, DECLARED_ENV_PREFIX } from "./model-credential.js";
+import { parseJudge } from "./judge-verdict.js";
 import { validateSchema, describeSchemaErrors, looksLikeSchema } from "./json-schema.js";
 import { EGRESS_ENV, MODEL_KEY_NAME, addGrant, hostOf, placeholderNames, proxyModelEnv, unsubstitute } from "./egress.js";
 import { explainRefusal, isRefusalStatus, refusalFromLine, supplyNote } from "./refusal.js";
@@ -36,7 +37,7 @@ import { ASK_TOOL, PEER_TOOLS, applyOperatorEvent, askPromptLine, askTimeoutSec,
 import { sendPlainNotification } from "./notify.js";
 import { TOOL_MAP, BUILTIN_TOOLS, ownToolNames, toolRefs, legacyUseNames, legacyUseError, retiredToolNames, retiredToolError } from "./tool-names.js";
 import { refNames } from "./refs.js";
-import { accountDir, workspaceDir, buildMemoryIndex, workspaceMemoryIndex, knowledgeIndex, workspaceKnowledgeIndex, workspaceTools, brokenToolReport, listWorkspaces, listTenants, listRuns, liveRuns, syncBundleFor, parseToolDef, readFlow, markerPresent, whenRowsPath, parseApis, resolveModel, parseProvider, providerEnvFor, resolveEffort, isEffortWord, EFFORT_LEVELS, checkFormatVersion, readRun, writeRun, runSummary, verdictOf, sumAttempts, tokensOf, parseSchemaText, STORAGE_DIR, adoptLegacyVersionKey, listAgents, } from "./store.js";
+import { accountDir, workspaceDir, buildMemoryIndex, workspaceMemoryIndex, knowledgeIndex, workspaceKnowledgeIndex, workspaceTools, brokenToolReport, listWorkspaces, listTenants, listRuns, liveRuns, syncBundleFor, parseToolDef, readFlow, markerPresent, whenRowsPath, parseApis, resolveModel, parseProvider, providerEnvFor, resolveEffort, isEffortWord, EFFORT_LEVELS, checkFormatVersion, readRun, writeRun, isRescueRecord, runSummary, verdictOf, sumAttempts, tokensOf, parseSchemaText, STORAGE_DIR, adoptLegacyVersionKey, listAgents, } from "./store.js";
 import { canReadBack } from "./tool-output.js";
 import { PromptLayers, promptCacheKey } from "./prompt-layers.js";
 import { loadCatalog, checkModel, clampEffort, catalogCost, findModel, tokenPriceOf } from "./catalog.js";
@@ -266,27 +267,9 @@ const toTags = (v) => Array.isArray(v) ? v.map(String) : typeof v === "string" &
 // rather than dropping the skill, so a cross-client skill still loads here.
 function safeMatter(raw) {
     // gray-matter caches a *failed* parse as a hollow success; ./matter.ts
-    // parses every call, so the throw below is deterministic and the fallback
-    // fires every time (it used to clear gray-matter's cache here for that).
-    try {
-        return matter(raw);
-    }
-    catch {
-        const fm = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-        if (fm) {
-            const fixed = fm[1].replace(/^([A-Za-z0-9_-]+):[ \t]+(?!["'>|])(.*:.*)$/gm, (_m, k, v) => `${k}: ${JSON.stringify(v)}`);
-            try {
-                // A function replacer, not a string: a fixed block containing `$&` or
-                // `$$` (a value with those in it) would otherwise be treated as a
-                // replacement pattern and splice the whole frontmatter into itself.
-                return matter(raw.replace(fm[1], () => fixed));
-            }
-            catch {
-                /* fall through */
-            }
-        }
-        return { data: {} };
-    }
+    // parses every call, so the strict read throws every time and the lenient
+    // one (shared with check, which warns about it) fires every time.
+    return { data: parseLenient(raw).data };
 }
 // Both layouts: <root>/<name>/SKILL.md (Agent Skills standard) and the flat
 // <root>/<name>.md convenience form. `subdir` is the skills root under the
@@ -385,7 +368,7 @@ export function readAgentsMd(dir) {
         if (!fs.existsSync(file))
             continue;
         try {
-            const parsed = matter(fs.readFileSync(file, "utf8"));
+            const parsed = configMatter(fs.readFileSync(file, "utf8"));
             return { data: parsed.data, body: withoutAgentRules(parsed.content).trim() };
         }
         catch {
@@ -753,7 +736,7 @@ grantsOnly = false) {
     // agentDir is <data>/<tenant>/projects/<workspace>/agents/<agent>, so the
     // workspace a secret should resolve against is two levels up.
     const workspace = path.basename(path.resolve(agentDir, "..", ".."));
-    const { data: front, content: body } = matter(fs.readFileSync(path.join(agentDir, "agent.md"), "utf8"));
+    const { data: front, content: body } = configMatter(fs.readFileSync(path.join(agentDir, "agent.md"), "utf8"));
     // The prompt's sections, by name and by how often they change. Added in
     // the order they are computed; assembled stable first, so the model's
     // cache keeps the agent's half across steps and runs (prompt-layers.ts).
@@ -1915,6 +1898,15 @@ peerBus) {
     // AGENTS.md — every model call always; each tool call's input and output
     // unless it says `metadata`.
     const capture = workspaceFrontmatter(agentDir, tenant).capture === "metadata" ? "metadata" : "full";
+    // `judge:` (AGENTS.md): the model and effort every `verify: judge:` here
+    // grades with — field by field, the workspace's else the account's.
+    const { judgeModel, judgeEffort } = (() => {
+        const ws = parseJudge(readAgentsMd(workspaceRootOf(agentDir))?.data?.judge);
+        const account = parseJudge(readAgentsMd(accountDir(tenant))?.data?.judge);
+        const model = ws.model ?? account.model;
+        const effort = resolveEffort(ws.effort ?? account.effort ?? "");
+        return { judgeModel: model ? resolveModel(model) : undefined, judgeEffort: effort ?? undefined };
+    })();
     // A step that pours out content stops being recorded past this — its
     // calls keep their names, sizes and times (FOL-54 step 4).
     let capturedChars = 0;
@@ -2651,6 +2643,8 @@ peerBus) {
                     budgetNote: stepBudgetNote,
                     price: tokenPrice,
                     verify: step.verify,
+                    ...(judgeModel ? { judgeModel } : {}),
+                    ...(judgeEffort ? { judgeEffort } : {}),
                     output: step.output,
                     schema: resolvedSchema ?? undefined,
                     maxTurns: step.maxTurns,
@@ -2705,6 +2699,9 @@ peerBus) {
                 emit: pushWatching,
                 // Stamps the sandbox, so stopping this run can destroy it.
                 runId,
+                // A step still waiting for room has no sandbox to destroy; the
+                // executor asks this before it creates one (pod-room.ts).
+                ...(stopRequested ? { stopRequested } : {}),
                 size,
                 // The pod's network, for the executor's own wall (the k8s tier's
                 // network policy): a filtered pod reaches the proxy and DNS only.
@@ -3040,6 +3037,8 @@ peerBus) {
                 budgetNote: stepBudgetNote,
                 price: tokenPrice,
                 verify: step.verify,
+                ...(judgeModel ? { judgeModel } : {}),
+                ...(judgeEffort ? { judgeEffort } : {}),
                 output: step.output,
                 schema: resolvedSchema ?? undefined,
                 maxTurns: step.maxTurns,
@@ -3247,7 +3246,7 @@ export function copyTreeBytes(from, to) {
 function openApiSources(agentDir, tenant) {
     const out = new Set();
     try {
-        const { data } = matter(fs.readFileSync(path.join(agentDir, "agent.md"), "utf8"));
+        const { data } = configMatter(fs.readFileSync(path.join(agentDir, "agent.md"), "utf8"));
         const front = data;
         for (const api of parseApis(front.apis))
             if (api.openapi?.startsWith("https://"))
@@ -3839,10 +3838,31 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
      *
      * The flag is one-way: nothing here clears it, so the read-modify-write can
      * only ever turn a stop on, never off.
+     *
+     * And once it is on, this copy may not undo what stopRun wrote: the run
+     * stays failed, and steps that had not started stay skipped. Before
+     * 21 Oct 2026 only the flag came across, so the next save put the record
+     * back to `running` with its steps pending; a second stop then answered
+     * "failed" instead of "already failed", and the group kept starting pods
+     * (medium-desk run-mvho48wp-99e1). A step running in THIS process is left
+     * as it is: its sandbox is gone, it ends on its own, and records how.
      */
     const save = () => {
-        if (!run.stopRequested && readRun(tenant, workspace, run.id)?.stopRequested) {
+        const disk = run.stopRequested ? null : readRun(tenant, workspace, run.id);
+        if (disk?.stopRequested)
             run.stopRequested = true;
+        if (run.stopRequested) {
+            if (run.status !== "completed" && run.status !== "failed") {
+                run.status = "failed";
+                run.finishedAt ??= disk?.finishedAt ?? new Date().toISOString();
+            }
+            run.parkedAt = null;
+            for (const s of run.steps) {
+                if (s.status === "pending" || s.status === "awaiting-approval") {
+                    s.status = "skipped";
+                    s.skipReason ??= "run stopped";
+                }
+            }
         }
         writeRun(tenant, workspace, run);
     };
@@ -4063,7 +4083,13 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                         return groupData[i];
                 return undefined;
             };
-            const dataOf = (group) => {
+            // A rescue's result already stands on the step it took over, so the
+            // three handoffs below read the flow's steps only: counting the rescue
+            // too handed the next group the same output twice, or a stale one
+            // from an evaluator loop's earlier cycle.
+            const flowStepsOf = (group) => group.filter((s) => !isRescueRecord(s));
+            const dataOf = (all) => {
+                const group = flowStepsOf(all);
                 const carrying = group.filter((s) => s.status === "completed" && s.data !== undefined);
                 if (carrying.length === 0)
                     return undefined;
@@ -4071,7 +4097,8 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                     return carrying[0].data;
                 return carrying.map((s) => ({ agent: s.agent, ...(s.item ? { item: s.item } : {}), data: s.data }));
             };
-            const resultsOf = (group) => {
+            const resultsOf = (all) => {
+                const group = flowStepsOf(all);
                 const results = group
                     .filter((s) => s.status === "completed" && s.result)
                     .map((s) => s.item
@@ -4083,8 +4110,8 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
             };
             // What each step concluded — its final turn — for the handoffs that
             // should read a conclusion rather than a transcript (`each: lines`).
-            const conclusionsOf = (group) => {
-                const out = group
+            const conclusionsOf = (all) => {
+                const out = flowStepsOf(all)
                     .filter((s) => s.status === "completed" && (s.conclusion || s.result))
                     .map((s) => s.conclusion || s.result);
                 return out.length ? out.join("\n") : null;
@@ -4459,7 +4486,7 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                     save();
                     if (freshGroup.every((s) => s.status !== "pending")) {
                         // everything in this group was rejected
-                        if (freshGroup.some((s) => s.status === "failed" && !s.optional && !s.carriedFrom)) {
+                        if (freshGroup.some((s) => s.status === "failed" && !s.optional && !s.carriedFrom && !isRescueRecord(s))) {
                             run.status = "failed";
                             break;
                         }
@@ -4472,7 +4499,11 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                 // itself mid-turn at its share, so a fan-out of twenty cannot end
                 // twenty steps over — the shares sum to what was left. Between
                 // groups the check above still refuses to start the next one.
-                const launching = freshGroup.filter((s) => s.status === "pending");
+                // A rescue record is the on-fail of a step in this group, not a step
+                // of the flow: one left pending by a drive that died is picked up by
+                // rescueStep below, never launched alongside the group (21 Oct 2026:
+                // a resumed run launched 77 leftover fixers at once).
+                const launching = freshGroup.filter((s) => s.status === "pending" && !isRescueRecord(s));
                 // tools: [peers] — what each step of the group is told about the
                 // others, and the bus they share when they run in this process.
                 const peerBus = localPeerBus();
@@ -4531,7 +4562,7 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                         // lead's reply or for a slot — must not start it: the
                         // between-groups check runs only once this group is over,
                         // and save() is what carries the flag in from the record.
-                        if (lead || pool) {
+                        {
                             save();
                             if (run.stopRequested) {
                                 step.status = "skipped";
@@ -4694,6 +4725,13 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                 // runs out of cycles below, which used to fail the run without ever
                 // reaching the step's on-fail (medium-desk's claim-trimmer was
                 // written for exactly that case and could never run).
+                // A rescue hears a stop the way a group step does: its model loop and
+                // its executor's wait for room both poll this (no sandbox exists yet
+                // for a stop to destroy while it waits).
+                const stopPoll = () => {
+                    save();
+                    return run.stopRequested === true;
+                };
                 const rescueStep = async (step) => {
                     if (!step.onFail)
                         return;
@@ -4706,6 +4744,38 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                         });
                         return;
                     }
+                    // One rescue per failure, across drives. A worker that died
+                    // mid-rescue left an unfinished record behind it; the drive that
+                    // resumes picks that one up instead of splicing another — a crash
+                    // loop used to add one per restart (blog-desk run-mvh1zra7-ae4k,
+                    // ~80). The leftover carries the same instruction, built from the
+                    // same failure, and a running one may still hold a sandbox to
+                    // re-attach to, so it is THE rescue; any further unfinished copies
+                    // are superseded. A FINISHED rescue is history, never reused: it
+                    // answered an earlier failure — an evaluator loop's previous cycle
+                    // — not this one.
+                    const leftovers = [];
+                    for (let j = run.steps.indexOf(step) + 1; j < run.steps.length && isRescueRecord(run.steps[j]); j++) {
+                        const r = run.steps[j];
+                        if (r.agent === step.onFail && (r.rescueOf === undefined || r.rescueOf === step.agent) && (r.status === "pending" || r.status === "running")) {
+                            leftovers.push(r);
+                        }
+                    }
+                    const resumed = leftovers[0];
+                    for (const r of leftovers.slice(1)) {
+                        r.status = "skipped";
+                        r.skipReason = "superseded on resume — one rescue per failure";
+                    }
+                    if (resumed) {
+                        step.events.push({ t: new Date().toISOString(), type: "info", text: `resuming the rescue by [[${step.onFail}]] that an earlier drive started` });
+                        resumed.rescueOf ??= step.agent;
+                        resumed.attempts = Math.max(1, resumed.attempts ?? 0);
+                        resumed.status = "running";
+                        save();
+                        await runStep(rescuerDir, tenant, resumed, ctx, save, modelOverride, tags, effortOverride, run.id, ctxData, null, undefined, run.test === true, stopPoll, flowTimezone, run.steps.indexOf(resumed));
+                        settleRescue(step, resumed);
+                        return;
+                    }
                     step.events.push({
                         t: new Date().toISOString(),
                         type: "info",
@@ -4722,6 +4792,7 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                     const owesMarker = step.until ? `\nThe step's loop ended without its marker: your reply must end with a line saying ${step.until}.` : "";
                     const rescue = {
                         agent: step.onFail,
+                        rescueOf: step.agent,
                         instruction: `${step.instruction}\n\n<rescue>\nYou are taking this step over: [[${step.agent}]] attempted it and failed. ` +
                             `Its failure, for whatever it is worth:\n${failure}${approved}${owesMarker}\n</rescue>`,
                         ...(step.ask ? { ask: step.ask } : {}),
@@ -4751,7 +4822,11 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                     rescue.attempts = 1;
                     rescue.status = "running";
                     save();
-                    await runStep(rescuerDir, tenant, rescue, ctx, save, modelOverride, tags, effortOverride, run.id, ctxData, null, undefined, run.test === true, undefined, flowTimezone, run.steps.indexOf(rescue));
+                    await runStep(rescuerDir, tenant, rescue, ctx, save, modelOverride, tags, effortOverride, run.id, ctxData, null, undefined, run.test === true, stopPoll, flowTimezone, run.steps.indexOf(rescue));
+                    settleRescue(step, rescue);
+                };
+                // What a rescue's end means for the step it took over.
+                const settleRescue = (step, rescue) => {
                     // runStep mutates rescue.status; widen past TS's "running" narrowing.
                     const rescueOutcome = rescue.status;
                     if (rescueOutcome === "completed") {
@@ -4786,7 +4861,10 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                 // here: the person chose to start after it. Counting it stopped
                 // fix-desk's "re-run from the verifier" (run-muwfi5jn-4217) in under
                 // a second, before the one step it was asked to run.
-                const requiredFailed = freshGroup.some((s) => s.status === "failed" && !s.optional && !s.carriedFrom);
+                // A rescue record's own failure is already on the step it took over
+                // ("also failed"); counted here it would fail a group whose step a
+                // later rescue completed.
+                const requiredFailed = freshGroup.some((s) => s.status === "failed" && !s.optional && !s.carriedFrom && !isRescueRecord(s));
                 if (requiredFailed) {
                     run.status = "failed";
                     break;
@@ -4862,6 +4940,11 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                         for (const s of [...ordered[gi - 1], ...freshGroup]) {
                             if (s.status === "skipped" && s.each)
                                 continue; // an expanded template stays expanded
+                            // A rescue answered its own failure and stays as it ended: reset
+                            // to pending it read as an interrupted rescue, and the next
+                            // cycle's failure was handed the old one's instructions.
+                            if (isRescueRecord(s))
+                                continue;
                             s.status = "pending";
                             s.result = null;
                         }

package/dist/src/scan.d.ts

@@ -83,6 +83,17 @@ export declare function untrustedTextFindings(text: string): {
 }[];
 /** The known field a key was probably meant to be, or null. */
 export declare function nearestField(key: string, known: readonly string[]): string | null;
+/** What a run leaves in an agent's folder — the Claude CLI's `.cache/` logs,
+ *  package caches — and copies back with it. Nobody wrote these, so they are
+ *  not checked as prompts or code; they are still searched for credentials,
+ *  since a key in a log here is a key in the workspace (seen live on
+ *  17 Oct 2026: zero-width characters in a CLI MCP log, reported as hidden
+ *  text). */
+/** The definition files a deploy refuses outright when their frontmatter does
+ *  not parse (deploy.ts deployIssues): the workspace's own, by these paths.
+ *  Everything else the platform reads frontmatter from — skills, and the
+ *  account library's agents, tools and hooks — is the scanner's to report. */
+export declare const STRICT_FRONTMATTER_PATH: RegExp;
 /** How many times one rule is listed for one file before the rest are counted. */
 export declare const PER_FILE_RULE = 100;
 /**