@foldrun/core 2.5.0 → 2.7.0

package/dist/src/runner.js

@@ -9,7 +9,7 @@ import { hookNames } from "./hooks.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import matter from "./matter.js";
+import matter, { parseLenient, configMatter } from "./matter.js";
 import { knownPrice, executeStep, extractJson, stepCeiling, stepCeilingFor } from "./step-exec.js";
 import { cascadeLimits, toolOwners } from "./limits.js";
 import { resolveAgentPath } from "./confine.js";
@@ -18,6 +18,7 @@ import { eventUrl } from "./webhook.js";
 import { runStepInContainer, sizeLimits, killRunSandboxes } from "./run-container.js";
 import { hostSafeEnv, platformApiUrl } from "./host-env.js";
 import { resolveModelCredential, credentialLine, accountModelBlock, isClaudeLoginToken, isModelEnvName, DECLARED_ENV_PREFIX } from "./model-credential.js";
+import { parseJudge } from "./judge-verdict.js";
 import { validateSchema, describeSchemaErrors, looksLikeSchema } from "./json-schema.js";
 import { EGRESS_ENV, MODEL_KEY_NAME, addGrant, hostOf, placeholderNames, proxyModelEnv, unsubstitute } from "./egress.js";
 import { explainRefusal, isRefusalStatus, refusalFromLine, supplyNote } from "./refusal.js";
@@ -36,11 +37,11 @@ import { ASK_TOOL, PEER_TOOLS, applyOperatorEvent, askPromptLine, askTimeoutSec,
 import { sendPlainNotification } from "./notify.js";
 import { TOOL_MAP, BUILTIN_TOOLS, ownToolNames, toolRefs, legacyUseNames, legacyUseError, retiredToolNames, retiredToolError } from "./tool-names.js";
 import { refNames } from "./refs.js";
-import { accountDir, workspaceDir, buildMemoryIndex, workspaceMemoryIndex, knowledgeIndex, workspaceKnowledgeIndex, workspaceTools, brokenToolReport, listWorkspaces, listTenants, listRuns, liveRuns, syncBundleFor, parseToolDef, readFlow, markerPresent, whenRowsPath, parseApis, resolveModel, parseProvider, providerEnvFor, resolveEffort, isEffortWord, EFFORT_LEVELS, checkFormatVersion, readRun, writeRun, runSummary, verdictOf, sumAttempts, tokensOf, parseSchemaText, STORAGE_DIR, adoptLegacyVersionKey, listAgents, } from "./store.js";
+import { accountDir, workspaceDir, buildMemoryIndex, workspaceMemoryIndex, knowledgeIndex, workspaceKnowledgeIndex, workspaceTools, brokenToolReport, listWorkspaces, listTenants, listRuns, liveRuns, syncBundleFor, parseToolDef, readFlow, markerPresent, whenRowsPath, parseApis, resolveModel, parseProvider, providerEnvFor, resolveEffort, isEffortWord, EFFORT_LEVELS, checkFormatVersion, readRun, writeRun, isRescueRecord, runSummary, verdictOf, sumAttempts, tokensOf, parseSchemaText, STORAGE_DIR, adoptLegacyVersionKey, listAgents, } from "./store.js";
 import { canReadBack } from "./tool-output.js";
 import { PromptLayers, promptCacheKey } from "./prompt-layers.js";
 import { loadCatalog, checkModel, clampEffort, catalogCost, findModel, tokenPriceOf } from "./catalog.js";
-import { resolveSecrets, getSecret, materializeSecrets, secretSites } from "./secrets.js";
+import { resolveSecrets, getSecret, materializeSecrets, secretSites, isClientCertValue, clientCertOf, withoutHeldCerts, isIdentityValue, identityOf } from "./secrets.js";
 import { resolveNetwork, networkLine, networkEnforceWanted, proxyEnv, EGRESS_CA_ENV } from "./network.js";
 import { materializeFileSecrets, cleanupFileSecrets } from "./secret-files.js";
 import { buildApiTools, secretsUsedByApi } from "./api-tools.js";
@@ -266,27 +267,9 @@ const toTags = (v) => Array.isArray(v) ? v.map(String) : typeof v === "string" &
 // rather than dropping the skill, so a cross-client skill still loads here.
 function safeMatter(raw) {
     // gray-matter caches a *failed* parse as a hollow success; ./matter.ts
-    // parses every call, so the throw below is deterministic and the fallback
-    // fires every time (it used to clear gray-matter's cache here for that).
-    try {
-        return matter(raw);
-    }
-    catch {
-        const fm = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-        if (fm) {
-            const fixed = fm[1].replace(/^([A-Za-z0-9_-]+):[ \t]+(?!["'>|])(.*:.*)$/gm, (_m, k, v) => `${k}: ${JSON.stringify(v)}`);
-            try {
-                // A function replacer, not a string: a fixed block containing `$&` or
-                // `$$` (a value with those in it) would otherwise be treated as a
-                // replacement pattern and splice the whole frontmatter into itself.
-                return matter(raw.replace(fm[1], () => fixed));
-            }
-            catch {
-                /* fall through */
-            }
-        }
-        return { data: {} };
-    }
+    // parses every call, so the strict read throws every time and the lenient
+    // one (shared with check, which warns about it) fires every time.
+    return { data: parseLenient(raw).data };
 }
 // Both layouts: <root>/<name>/SKILL.md (Agent Skills standard) and the flat
 // <root>/<name>.md convenience form. `subdir` is the skills root under the
@@ -385,7 +368,7 @@ export function readAgentsMd(dir) {
         if (!fs.existsSync(file))
             continue;
         try {
-            const parsed = matter(fs.readFileSync(file, "utf8"));
+            const parsed = configMatter(fs.readFileSync(file, "utf8"));
             return { data: parsed.data, body: withoutAgentRules(parsed.content).trim() };
         }
         catch {
@@ -753,7 +736,7 @@ grantsOnly = false) {
     // agentDir is <data>/<tenant>/projects/<workspace>/agents/<agent>, so the
     // workspace a secret should resolve against is two levels up.
     const workspace = path.basename(path.resolve(agentDir, "..", ".."));
-    const { data: front, content: body } = matter(fs.readFileSync(path.join(agentDir, "agent.md"), "utf8"));
+    const { data: front, content: body } = configMatter(fs.readFileSync(path.join(agentDir, "agent.md"), "utf8"));
     // The prompt's sections, by name and by how often they change. Added in
     // the order they are computed; assembled stable first, so the model's
     // cache keeps the agent's half across steps and runs (prompt-layers.ts).
@@ -1365,7 +1348,8 @@ grantsOnly = false) {
     // the agent, and the date the platform believes it is.
     {
         ...runtime.env,
-        ...secretEnv,
+        // An unexported client certificate is the proxy's, never a script's.
+        ...withoutHeldCerts(secretEnv),
         ...(identity.runId ? { FOLDRUN_RUN_ID: identity.runId } : {}),
         ...(identity.agent ? { FOLDRUN_AGENT: identity.agent } : {}),
         // And the workspace: a commit or a record made by a shared library
@@ -1635,6 +1619,9 @@ grantsOnly = false) {
         // asked for by name fails inside the container with "cannot find" while
         // the host path, which uses this same merged spec, works fine.
         runtime: { log: runtimeLog, error: runtimeError, executor, spec: runtimeSpec, dispose: runtime.dispose },
+        // Whole: a bound client certificate goes from here into the egress
+        // grant (runStep), which is where it is presented. Programs get theirs
+        // filtered (withoutHeldCerts) where their environments are built.
         secretEnv: { ...runtime.env, ...secretEnv },
         formatWarning: checkFormatVersion(workspaceFrontmatter(agentDir, tenant).foldrun_version).warning,
         providerEnv,
@@ -1915,6 +1902,15 @@ peerBus) {
     // AGENTS.md — every model call always; each tool call's input and output
     // unless it says `metadata`.
     const capture = workspaceFrontmatter(agentDir, tenant).capture === "metadata" ? "metadata" : "full";
+    // `judge:` (AGENTS.md): the model and effort every `verify: judge:` here
+    // grades with — field by field, the workspace's else the account's.
+    const { judgeModel, judgeEffort } = (() => {
+        const ws = parseJudge(readAgentsMd(workspaceRootOf(agentDir))?.data?.judge);
+        const account = parseJudge(readAgentsMd(accountDir(tenant))?.data?.judge);
+        const model = ws.model ?? account.model;
+        const effort = resolveEffort(ws.effort ?? account.effort ?? "");
+        return { judgeModel: model ? resolveModel(model) : undefined, judgeEffort: effort ?? undefined };
+    })();
     // A step that pours out content stops being recorded past this — its
     // calls keep their names, sizes and times (FOL-54 step 4).
     let capturedChars = 0;
@@ -2498,11 +2494,26 @@ peerBus) {
             // to refuse; the proxy adds the install's own switch and has the last
             // word (egress-proxy.ts), so false here never loosens anything.
             grant.enforce = networkEnforceWanted(readAgentsMd(accountDir(tenant))?.data?.network_enforce, readAgentsMd(workspaceRootOf(agentDir))?.data?.network_enforce);
+            // Keyless cloud identities the step declared: the proxy may mint tokens
+            // for these audiences only, for this workload (oidc-issuer.ts).
+            // A test run withholds them as it withholds every credential
+            // (test-mode.ts): a token is a credential, however it is delivered.
+            const declaredIdentities = Object.entries(liveSecrets).filter(([, v]) => typeof v === "string" && isIdentityValue(v));
+            const identitiesHeld = testRun
+                ? withholdSecrets(Object.fromEntries(declaredIdentities), {
+                    outward: scriptSpecs.some((sc) => sc.outward),
+                    allow: scriptSpecs.some((sc) => sc.testMode === "allow"),
+                }).withheld
+                : [];
+            const identities = Object.fromEntries(declaredIdentities.filter(([name]) => !identitiesHeld.includes(name)).map(([name, v]) => [name, { audience: identityOf(v).audience }]));
+            if (Object.keys(identities).length)
+                grant.identities = identities;
             const lease = await platform.egress.lease({
                 tenant,
                 runId: runId ?? "adhoc",
                 grant,
                 test: testRun,
+                who: { workspace: workspaceName, agent: step.agent },
                 ...(stepIndex !== undefined && stepIndex >= 0 ? { step: stepIndex } : {}),
                 // tools: [peers] — the roster the proxy serves, and the inboxes a
                 // colleague's message may be addressed to. Only when granted: a
@@ -2573,6 +2584,38 @@ peerBus) {
                     push("info", `test: ${name} withheld from the sandbox — TEST_MODE_WITHHELD`, { effect: { kind: "withheld", summary: `${name} withheld from the sandbox` } });
                 }
             }
+            // A keyless identity holds nothing to hand over: the sandbox gets the
+            // path of a token file the driver keeps fresh through the proxy's
+            // /identity door. Without a lease there is no door, and so no token.
+            const identityDeclared = declared.filter((name) => typeof liveSecrets[name] === "string" && isIdentityValue(liveSecrets[name]));
+            for (const name of identityDeclared)
+                delete sandboxSecrets[name];
+            for (const name of identitiesHeld) {
+                push("info", `test: ${name} withheld — no identity token on a test run`, { effect: { kind: "withheld", summary: `${name} withheld from the sandbox` } });
+            }
+            const identityNames = identityDeclared.filter((name) => !identitiesHeld.includes(name));
+            if (identityNames.length) {
+                if (lease) {
+                    const dir = "/tmp/foldrun-identity";
+                    sandboxSecrets.FOLDRUN_IDENTITIES = identityNames.join(",");
+                    sandboxSecrets.FOLDRUN_IDENTITY_DIR = dir;
+                    for (const name of identityNames)
+                        sandboxSecrets[`${name}_FILE`] = `${dir}/${name.toLowerCase()}.jwt`;
+                    push("info", `identity: ${identityNames.join(", ")} — a short-lived token in $NAME_FILE, renewed by the platform while the step runs`);
+                }
+                else {
+                    push("error", `identity: ${identityNames.join(", ")} needs a sandboxed step on the platform — no token here`);
+                }
+            }
+            // A client certificate is the proxy's to present, to the exact sites it
+            // is bound to; never the sandbox's, unless it was saved with `export`.
+            for (const name of declared) {
+                const v = liveSecrets[name];
+                if (typeof v !== "string" || !isClientCertValue(v) || bound.includes(name) || clientCertOf(v).export)
+                    continue;
+                delete sandboxSecrets[name];
+                push("info", `secrets: ${name} is a client certificate — the egress proxy presents it to the sites it is bound to (\`foldrun secrets sites ${name} <host>\`); unbound, it stays out of the sandbox`);
+            }
             // On a test run the http tools always go through the proxy as
             // placeholders, even when a script made the step materialise: the
             // proxy is where the outward-write policy lives, and a header
@@ -2651,6 +2694,8 @@ peerBus) {
                     budgetNote: stepBudgetNote,
                     price: tokenPrice,
                     verify: step.verify,
+                    ...(judgeModel ? { judgeModel } : {}),
+                    ...(judgeEffort ? { judgeEffort } : {}),
                     output: step.output,
                     schema: resolvedSchema ?? undefined,
                     maxTurns: step.maxTurns,
@@ -2705,6 +2750,9 @@ peerBus) {
                 emit: pushWatching,
                 // Stamps the sandbox, so stopping this run can destroy it.
                 runId,
+                // A step still waiting for room has no sandbox to destroy; the
+                // executor asks this before it creates one (pod-room.ts).
+                ...(stopRequested ? { stopRequested } : {}),
                 size,
                 // The pod's network, for the executor's own wall (the k8s tier's
                 // network policy): a filtered pod reaches the proxy and DNS only.
@@ -2969,7 +3017,19 @@ peerBus) {
             for (const name of held.withheld) {
                 push("info", `test: ${name} withheld from scripts — TEST_MODE_WITHHELD`, { effect: { kind: "withheld", summary: `${name} withheld from scripts` } });
             }
-            const stepSecrets = held.env;
+            // A client certificate not saved with `export` has no proxy here to
+            // present it: it stays out of everything this step runs — tools,
+            // consults, verify commands — not only out of the files.
+            const stepSecrets = Object.fromEntries(Object.entries(held.env).filter(([name, v]) => {
+                if (typeof v === "string" && isIdentityValue(v)) {
+                    push("error", `identity: ${name} needs a sandboxed step on the platform — no token here`);
+                    return false;
+                }
+                if (typeof v !== "string" || !isClientCertValue(v) || clientCertOf(v).export)
+                    return true;
+                push("info", `secrets: ${name} is a client certificate — no egress proxy here to present it; save it with export to use it as files`);
+                return false;
+            }));
             // The model credential for this machine's Claude Code — the agent's
             // own provider when it names one. The host allowlist drops it, so
             // without this every in-process step ran on the machine's login.
@@ -3040,6 +3100,8 @@ peerBus) {
                 budgetNote: stepBudgetNote,
                 price: tokenPrice,
                 verify: step.verify,
+                ...(judgeModel ? { judgeModel } : {}),
+                ...(judgeEffort ? { judgeEffort } : {}),
                 output: step.output,
                 schema: resolvedSchema ?? undefined,
                 maxTurns: step.maxTurns,
@@ -3247,7 +3309,7 @@ export function copyTreeBytes(from, to) {
 function openApiSources(agentDir, tenant) {
     const out = new Set();
     try {
-        const { data } = matter(fs.readFileSync(path.join(agentDir, "agent.md"), "utf8"));
+        const { data } = configMatter(fs.readFileSync(path.join(agentDir, "agent.md"), "utf8"));
         const front = data;
         for (const api of parseApis(front.apis))
             if (api.openapi?.startsWith("https://"))
@@ -3805,7 +3867,15 @@ async function harvestQuietly(tenant, workspace, run) {
 export const drivingRuns = new Set();
 export function driveRun(tenant, workspace, run, modelOverride, tags = [], opts = {}) {
     drivingRuns.add(run.id);
+    // The run's egress leases are renewed while it is driven, by whichever
+    // door drove it — the queue, or a reconcile that picked it back up — so an
+    // identity token is renewed for a live step however it was started.
+    const renew = platform.egress.renew;
+    const beat = renew ? setInterval(() => void renew(run.id).catch(() => undefined), 5 * 60_000) : null;
+    beat?.unref?.();
     return driveRunInner(tenant, workspace, run, modelOverride, tags, opts).finally(() => {
+        if (beat)
+            clearInterval(beat);
         drivingRuns.delete(run.id);
     });
 }
@@ -3839,10 +3909,31 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
      *
      * The flag is one-way: nothing here clears it, so the read-modify-write can
      * only ever turn a stop on, never off.
+     *
+     * And once it is on, this copy may not undo what stopRun wrote: the run
+     * stays failed, and steps that had not started stay skipped. Before
+     * 21 Oct 2026 only the flag came across, so the next save put the record
+     * back to `running` with its steps pending; a second stop then answered
+     * "failed" instead of "already failed", and the group kept starting pods
+     * (medium-desk run-mvho48wp-99e1). A step running in THIS process is left
+     * as it is: its sandbox is gone, it ends on its own, and records how.
      */
     const save = () => {
-        if (!run.stopRequested && readRun(tenant, workspace, run.id)?.stopRequested) {
+        const disk = run.stopRequested ? null : readRun(tenant, workspace, run.id);
+        if (disk?.stopRequested)
             run.stopRequested = true;
+        if (run.stopRequested) {
+            if (run.status !== "completed" && run.status !== "failed") {
+                run.status = "failed";
+                run.finishedAt ??= disk?.finishedAt ?? new Date().toISOString();
+            }
+            run.parkedAt = null;
+            for (const s of run.steps) {
+                if (s.status === "pending" || s.status === "awaiting-approval") {
+                    s.status = "skipped";
+                    s.skipReason ??= "run stopped";
+                }
+            }
         }
         writeRun(tenant, workspace, run);
     };
@@ -4063,7 +4154,13 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                         return groupData[i];
                 return undefined;
             };
-            const dataOf = (group) => {
+            // A rescue's result already stands on the step it took over, so the
+            // three handoffs below read the flow's steps only: counting the rescue
+            // too handed the next group the same output twice, or a stale one
+            // from an evaluator loop's earlier cycle.
+            const flowStepsOf = (group) => group.filter((s) => !isRescueRecord(s));
+            const dataOf = (all) => {
+                const group = flowStepsOf(all);
                 const carrying = group.filter((s) => s.status === "completed" && s.data !== undefined);
                 if (carrying.length === 0)
                     return undefined;
@@ -4071,7 +4168,8 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                     return carrying[0].data;
                 return carrying.map((s) => ({ agent: s.agent, ...(s.item ? { item: s.item } : {}), data: s.data }));
             };
-            const resultsOf = (group) => {
+            const resultsOf = (all) => {
+                const group = flowStepsOf(all);
                 const results = group
                     .filter((s) => s.status === "completed" && s.result)
                     .map((s) => s.item
@@ -4083,8 +4181,8 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
             };
             // What each step concluded — its final turn — for the handoffs that
             // should read a conclusion rather than a transcript (`each: lines`).
-            const conclusionsOf = (group) => {
-                const out = group
+            const conclusionsOf = (all) => {
+                const out = flowStepsOf(all)
                     .filter((s) => s.status === "completed" && (s.conclusion || s.result))
                     .map((s) => s.conclusion || s.result);
                 return out.length ? out.join("\n") : null;
@@ -4459,7 +4557,7 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                     save();
                     if (freshGroup.every((s) => s.status !== "pending")) {
                         // everything in this group was rejected
-                        if (freshGroup.some((s) => s.status === "failed" && !s.optional && !s.carriedFrom)) {
+                        if (freshGroup.some((s) => s.status === "failed" && !s.optional && !s.carriedFrom && !isRescueRecord(s))) {
                             run.status = "failed";
                             break;
                         }
@@ -4472,7 +4570,11 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                 // itself mid-turn at its share, so a fan-out of twenty cannot end
                 // twenty steps over — the shares sum to what was left. Between
                 // groups the check above still refuses to start the next one.
-                const launching = freshGroup.filter((s) => s.status === "pending");
+                // A rescue record is the on-fail of a step in this group, not a step
+                // of the flow: one left pending by a drive that died is picked up by
+                // rescueStep below, never launched alongside the group (21 Oct 2026:
+                // a resumed run launched 77 leftover fixers at once).
+                const launching = freshGroup.filter((s) => s.status === "pending" && !isRescueRecord(s));
                 // tools: [peers] — what each step of the group is told about the
                 // others, and the bus they share when they run in this process.
                 const peerBus = localPeerBus();
@@ -4531,7 +4633,7 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                         // lead's reply or for a slot — must not start it: the
                         // between-groups check runs only once this group is over,
                         // and save() is what carries the flag in from the record.
-                        if (lead || pool) {
+                        {
                             save();
                             if (run.stopRequested) {
                                 step.status = "skipped";
@@ -4694,6 +4796,13 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                 // runs out of cycles below, which used to fail the run without ever
                 // reaching the step's on-fail (medium-desk's claim-trimmer was
                 // written for exactly that case and could never run).
+                // A rescue hears a stop the way a group step does: its model loop and
+                // its executor's wait for room both poll this (no sandbox exists yet
+                // for a stop to destroy while it waits).
+                const stopPoll = () => {
+                    save();
+                    return run.stopRequested === true;
+                };
                 const rescueStep = async (step) => {
                     if (!step.onFail)
                         return;
@@ -4706,6 +4815,38 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                         });
                         return;
                     }
+                    // One rescue per failure, across drives. A worker that died
+                    // mid-rescue left an unfinished record behind it; the drive that
+                    // resumes picks that one up instead of splicing another — a crash
+                    // loop used to add one per restart (blog-desk run-mvh1zra7-ae4k,
+                    // ~80). The leftover carries the same instruction, built from the
+                    // same failure, and a running one may still hold a sandbox to
+                    // re-attach to, so it is THE rescue; any further unfinished copies
+                    // are superseded. A FINISHED rescue is history, never reused: it
+                    // answered an earlier failure — an evaluator loop's previous cycle
+                    // — not this one.
+                    const leftovers = [];
+                    for (let j = run.steps.indexOf(step) + 1; j < run.steps.length && isRescueRecord(run.steps[j]); j++) {
+                        const r = run.steps[j];
+                        if (r.agent === step.onFail && (r.rescueOf === undefined || r.rescueOf === step.agent) && (r.status === "pending" || r.status === "running")) {
+                            leftovers.push(r);
+                        }
+                    }
+                    const resumed = leftovers[0];
+                    for (const r of leftovers.slice(1)) {
+                        r.status = "skipped";
+                        r.skipReason = "superseded on resume — one rescue per failure";
+                    }
+                    if (resumed) {
+                        step.events.push({ t: new Date().toISOString(), type: "info", text: `resuming the rescue by [[${step.onFail}]] that an earlier drive started` });
+                        resumed.rescueOf ??= step.agent;
+                        resumed.attempts = Math.max(1, resumed.attempts ?? 0);
+                        resumed.status = "running";
+                        save();
+                        await runStep(rescuerDir, tenant, resumed, ctx, save, modelOverride, tags, effortOverride, run.id, ctxData, null, undefined, run.test === true, stopPoll, flowTimezone, run.steps.indexOf(resumed));
+                        settleRescue(step, resumed);
+                        return;
+                    }
                     step.events.push({
                         t: new Date().toISOString(),
                         type: "info",
@@ -4722,6 +4863,7 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                     const owesMarker = step.until ? `\nThe step's loop ended without its marker: your reply must end with a line saying ${step.until}.` : "";
                     const rescue = {
                         agent: step.onFail,
+                        rescueOf: step.agent,
                         instruction: `${step.instruction}\n\n<rescue>\nYou are taking this step over: [[${step.agent}]] attempted it and failed. ` +
                             `Its failure, for whatever it is worth:\n${failure}${approved}${owesMarker}\n</rescue>`,
                         ...(step.ask ? { ask: step.ask } : {}),
@@ -4751,7 +4893,11 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                     rescue.attempts = 1;
                     rescue.status = "running";
                     save();
-                    await runStep(rescuerDir, tenant, rescue, ctx, save, modelOverride, tags, effortOverride, run.id, ctxData, null, undefined, run.test === true, undefined, flowTimezone, run.steps.indexOf(rescue));
+                    await runStep(rescuerDir, tenant, rescue, ctx, save, modelOverride, tags, effortOverride, run.id, ctxData, null, undefined, run.test === true, stopPoll, flowTimezone, run.steps.indexOf(rescue));
+                    settleRescue(step, rescue);
+                };
+                // What a rescue's end means for the step it took over.
+                const settleRescue = (step, rescue) => {
                     // runStep mutates rescue.status; widen past TS's "running" narrowing.
                     const rescueOutcome = rescue.status;
                     if (rescueOutcome === "completed") {
@@ -4786,7 +4932,10 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                 // here: the person chose to start after it. Counting it stopped
                 // fix-desk's "re-run from the verifier" (run-muwfi5jn-4217) in under
                 // a second, before the one step it was asked to run.
-                const requiredFailed = freshGroup.some((s) => s.status === "failed" && !s.optional && !s.carriedFrom);
+                // A rescue record's own failure is already on the step it took over
+                // ("also failed"); counted here it would fail a group whose step a
+                // later rescue completed.
+                const requiredFailed = freshGroup.some((s) => s.status === "failed" && !s.optional && !s.carriedFrom && !isRescueRecord(s));
                 if (requiredFailed) {
                     run.status = "failed";
                     break;
@@ -4862,6 +5011,11 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                         for (const s of [...ordered[gi - 1], ...freshGroup]) {
                             if (s.status === "skipped" && s.each)
                                 continue; // an expanded template stays expanded
+                            // A rescue answered its own failure and stays as it ended: reset
+                            // to pending it read as an interrupted rescue, and the next
+                            // cycle's failure was handed the old one's instructions.
+                            if (isRescueRecord(s))
+                                continue;
                             s.status = "pending";
                             s.result = null;
                         }

package/dist/src/scan.d.ts

@@ -83,6 +83,17 @@ export declare function untrustedTextFindings(text: string): {
 }[];
 /** The known field a key was probably meant to be, or null. */
 export declare function nearestField(key: string, known: readonly string[]): string | null;
+/** What a run leaves in an agent's folder — the Claude CLI's `.cache/` logs,
+ *  package caches — and copies back with it. Nobody wrote these, so they are
+ *  not checked as prompts or code; they are still searched for credentials,
+ *  since a key in a log here is a key in the workspace (seen live on
+ *  17 Oct 2026: zero-width characters in a CLI MCP log, reported as hidden
+ *  text). */
+/** The definition files a deploy refuses outright when their frontmatter does
+ *  not parse (deploy.ts deployIssues): the workspace's own, by these paths.
+ *  Everything else the platform reads frontmatter from — skills, and the
+ *  account library's agents, tools and hooks — is the scanner's to report. */
+export declare const STRICT_FRONTMATTER_PATH: RegExp;
 /** How many times one rule is listed for one file before the rest are counted. */
 export declare const PER_FILE_RULE = 100;
 /**

package/dist/src/scan.js

@@ -26,7 +26,7 @@
 // The reason is required: an ignore without one ignores nothing and is itself
 // reported, because "why is this allowed?" is the question a reviewer asks.
 import crypto from "node:crypto";
-import matter from "./matter.js";
+import matter, { frontmatterErrorLine, frontmatterErrorText, parseLenient, configMatter } from "./matter.js";
 import { refNames } from "./refs.js";
 import { resolveNetwork } from "./network.js";
 import { frontmatterProblems, schemaKindOf } from "./frontmatter-schema.js";
@@ -159,6 +159,32 @@ export const SCAN_RULES = [
         help: "`effort: extreme`, `size: giant`, `trigger: sometimes`, a cron the scheduler cannot read: each is ignored or falls back, " +
             "so the agent or flow quietly does something else. The message lists what the field takes.",
     },
+    {
+        id: "config/conflict",
+        category: "config",
+        level: "error",
+        title: "A field set twice: at the top and inside its job block",
+        help: "`limits:` at the top and `limits:` inside `guardrail:` cannot both be meant. The top one would be read and the other " +
+            "quietly ignored, so the file is refused until one is removed.",
+    },
+    {
+        id: "config/misplaced",
+        category: "config",
+        level: "error",
+        title: "A field inside the wrong job block",
+        help: "Each of the four blocks (governance, guardrail, observability, evaluation) holds its own fields. A setting written in " +
+            "another block is not read — a guardrail under governance: guards nothing — so the file is refused until it is moved " +
+            "to the block the message names, or to the top. A word foldrun does not read at all is only a note.",
+    },
+    {
+        id: "config/invalid-frontmatter",
+        category: "config",
+        level: "warn",
+        title: "Frontmatter that YAML cannot read",
+        help: "A value with a colon followed by a space (`description: the format (Markdown, ::: directives)`) ends the YAML. " +
+            "foldrun reads a skill like that by quoting the value, but the dashboard editor and the source API refuse to save it, " +
+            "and other tools that read the file may not. Quote the value: `description: \"…\"`.",
+    },
     {
         id: "config/missing-field",
         category: "config",
@@ -544,17 +570,35 @@ export function nearestField(key, known) {
     return bestD <= allowed ? best : null;
 }
 function keyLine(lines, key) {
-    const re = new RegExp(`^${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*:`);
-    const i = lines.findIndex((l) => re.test(l));
-    return i >= 0 ? i + 1 : undefined;
+    const k = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const top = new RegExp(`^${k}\\s*:`);
+    const i = lines.findIndex((l) => top.test(l));
+    if (i >= 0)
+        return i + 1;
+    // A key inside one of the four job blocks: indented, under its header.
+    const inner = new RegExp(`^\\s+${k}\\s*:`);
+    let inBlock = false;
+    for (let n = 0; n < lines.length; n++) {
+        const l = lines[n];
+        if (/^(governance|guardrail|observability|evaluation)\s*:\s*(#.*)?$/.test(l))
+            inBlock = true;
+        else if (/^\S/.test(l))
+            inBlock = false;
+        else if (inBlock && inner.test(l))
+            return n + 1;
+    }
+    return undefined;
 }
 /** Read-only: gray-matter caches by content, so two files with the same
  *  text share one object, and writing to it would leak between them. */
-function frontOf(content) {
+function frontOf(content, filePath) {
     if (!/^?---\r?\n/.test(content))
         return null;
     try {
-        return matter(content).data;
+        // An agent, a flow or AGENTS.md reads its job blocks as flat keys, as
+        // the runtime does; every other document is read as written.
+        const kind = filePath ? schemaKindOf(filePath) : null;
+        return (kind === "agent" || kind === "flow" || kind === "agents-md" ? configMatter(content) : matter(content)).data;
     }
     catch {
         return null; // a frontmatter YAML cannot read is check's finding, not ours
@@ -683,6 +727,14 @@ const VENDORED = /(?:^|\/)(?:node_modules|\.venv|venv|site-packages|__pycache__|
  *  since a key in a log here is a key in the workspace (seen live on
  *  17 Oct 2026: zero-width characters in a CLI MCP log, reported as hidden
  *  text). */
+/** The definition files a deploy refuses outright when their frontmatter does
+ *  not parse (deploy.ts deployIssues): the workspace's own, by these paths.
+ *  Everything else the platform reads frontmatter from — skills, and the
+ *  account library's agents, tools and hooks — is the scanner's to report. */
+export const STRICT_FRONTMATTER_PATH = /^(AGENTS\.md|agents\/[^/]+\/agent\.md|flows\/[^/]+\.md|tools\/[^/]+\.md|tools\/[^/]+\/tool\.md|evals\/[^/]+\.md|hooks\/[^/]+\/hook\.md|\.claude\/agents\/[^/]+\.md)$/;
+/** A skill file in either layout the runtime discovers: <name>/SKILL.md, or
+ *  the flat <name>.md, under skills/ or .agents/skills/, in the library too. */
+const SKILL_FILE = /(?:^|\/)skills\/(?:[^/]+\/SKILL\.md|[^/]+\.md)$/;
 const RUNTIME_WRITTEN = /(?:^|\/)(?:\.cache|\.npm|\.local|\.pnpm-store|\.yarn|\.foldrun)\//;
 /** Text files only — a PNG read as UTF-8 is noise to every rule here. */
 function isText(f) {
@@ -740,9 +792,35 @@ export function scanFiles(files, options = {}) {
         scanContent(f, lines, push);
         scanSupplyChain(f, lines, push);
         const schema = schemaKindOf(f.path);
+        // Frontmatter YAML cannot read. Until 2026-10-21 nothing reported it for
+        // a skill or a library file: frontOf below reads it as "no frontmatter"
+        // and moves on, and the deploy's own refusal covers only the workspace's
+        // definition files. A vaza.ai skill with `description: … (Markdown,
+        // frontmatter, ::: directives) …` deployed clean, ran (the runtime quotes
+        // the value and retries), and was refused by the source API on its next
+        // save.
+        if ((schema || SKILL_FILE.test(f.path)) && !STRICT_FRONTMATTER_PATH.test(f.path) && /^\uFEFF?---\r?\n/.test(f.content)) {
+            let err = null;
+            try {
+                matter(f.content);
+            }
+            catch (e) {
+                err = e;
+            }
+            if (err) {
+                const isSkill = schema === "skill" || SKILL_FILE.test(f.path);
+                const read = parseLenient(f.content);
+                const what = isSkill && !read.failed
+                    ? "foldrun reads this skill anyway by quoting the value, but the dashboard editor and the source API refuse to save it, and other skills clients may not load it"
+                    : isSkill
+                        ? "the runtime reads it as empty, so the skill has no name or description and is never loaded"
+                        : "the runtime cannot read this file";
+                push("config/invalid-frontmatter", f.path, frontmatterErrorLine(err), `config/invalid-frontmatter ${frontmatterErrorText(err)}`, `${frontmatterErrorText(err)} ${what === "the runtime cannot read this file" ? "The runtime cannot read this file" : what.replace(/^foldrun/, "foldrun").replace(/^the/, "The")}.`);
+            }
+        }
         // A skill with no frontmatter at all is the clearest one that never
         // loads: read it as empty, so its required fields are reported.
-        const data = schema || docKind(f.path) ? (frontOf(f.content) ?? (schema === "skill" && !/^\uFEFF?---\r?\n/.test(f.content) ? {} : null)) : null;
+        const data = schema || docKind(f.path) ? (frontOf(f.content, f.path) ?? (schema === "skill" && !/^\uFEFF?---\r?\n/.test(f.content) ? {} : null)) : null;
         if (!data)
             continue;
         if (schema) {
@@ -770,7 +848,7 @@ export function scanFiles(files, options = {}) {
     }
     // project.md is the older name the runtime still reads (Codex review, FOL-58).
     const workspaceMd = files.find((f) => f.path === "AGENTS.md") ?? files.find((f) => f.path === "project.md");
-    scanAgents(agents, outward, toolDefs, push, { account: options.accountNetwork, workspace: workspaceMd ? frontOf(workspaceMd.content)?.network : undefined });
+    scanAgents(agents, outward, toolDefs, push, { account: options.accountNetwork, workspace: workspaceMd ? frontOf(workspaceMd.content, "AGENTS.md")?.network : undefined });
     for (const m of more.values()) {
         findings.push({ rule: m.rule, level: m.level ?? scanRule(m.rule)?.level ?? "warn", file: m.file, message: `and ${m.n} more like this in this file, not listed`, fingerprint: m.hash.digest("hex").slice(0, 16), truncated: true });
     }