@foldrun/core 2.6.0 → 2.8.0

package/dist/src/capture.js

@@ -6,7 +6,7 @@
 // secret on the cap's edge is never kept half. Recording never fails the step.
 import { redactText } from "./scan.js";
 import { writeCapturedCall, CAPTURE_CAP } from "./store.js";
-import { isFileValue, fileContent } from "./secrets.js";
+import { isFileValue, fileContent, isApiValue, apiConfigOf, isClientCertValue, clientCertOf } from "./secrets.js";
 /** How much past the cap a step sends, so masking sees a secret whole
  *  before the cut (a value longer than this is a file secret, which is also
  *  masked line by line). */
@@ -29,6 +29,44 @@ export function redactionsFor(secrets) {
     for (const [name, raw] of Object.entries(secrets)) {
         if (typeof raw !== "string")
             continue;
+        // An API connection's header values are each a secret in their own right
+        // (a token, Basic credentials) — and a Basic header's password too.
+        // An exported client certificate's passphrase and private key reach the
+        // sandbox as files: each is masked, whole and line by line.
+        if (isClientCertValue(raw)) {
+            const c = clientCertOf(raw);
+            for (const v of [c.passphrase, c.key]) {
+                if (!v)
+                    continue;
+                add(v, name);
+                add(v.trim(), name);
+                const escaped = JSON.stringify(v).slice(1, -1);
+                if (escaped !== v)
+                    add(escaped, name);
+                for (const line of v.split(/\r?\n/))
+                    if (line.trim().length >= 16)
+                        add(line.trim(), name);
+            }
+        }
+        if (isApiValue(raw)) {
+            // Each as written and as JSON would escape it, like every value here.
+            const both = (v) => {
+                add(v, name);
+                const escaped = JSON.stringify(v).slice(1, -1);
+                if (escaped !== v)
+                    add(escaped, name);
+            };
+            for (const v of Object.values(apiConfigOf(raw).headers ?? {})) {
+                both(v);
+                const basic = /^Basic\s+([A-Za-z0-9+/=]+)$/i.exec(v.trim());
+                if (basic) {
+                    both(basic[1]);
+                    const decoded = Buffer.from(basic[1], "base64").toString("utf8");
+                    if (decoded.includes(":"))
+                        both(decoded.slice(decoded.indexOf(":") + 1));
+                }
+            }
+        }
         for (const v of isFileValue(raw) ? [raw, fileContent(raw)] : [raw]) {
             add(v, name);
             add(v.trim(), name);

package/dist/src/delegate-tools.d.ts

@@ -0,0 +1,45 @@
+import type { DelegationResult, OperatorChannel } from "./operator.ts";
+import type { EventExtra } from "./step-exec.ts";
+import { type DelegateSpec } from "./subagents.ts";
+export declare const DELEGATE_SERVER = "foldrun_delegate";
+/** A job handed over is at most this long — the sub-agent's prompt. */
+export declare const JOB_MAX = 20000;
+/** What comes back is cut here: the reply is the parent's context. */
+export declare const REPLY_MAX = 40000;
+type Emit = (type: "text" | "tool" | "info" | "error", text: string, extra?: EventExtra) => void;
+/** The granted names, the same on every path. */
+export declare function delegateToolNames(specs: DelegateSpec[]): string[];
+/** The reply as the parent reads it: the sub-agent's words, then what it changed. */
+export declare function replyText(name: string, r: DelegationResult): string;
+export declare function buildDelegateTools(opts: {
+    specs: DelegateSpec[];
+    channel: OperatorChannel | null;
+    emit: Emit;
+    /** The most one job may run; the step's own timeout bounds it anyway. */
+    timeoutSec?: number;
+    now?: () => number;
+}): {
+    server: null;
+    toolNames: string[];
+    calls: Record<string, (job: string) => Promise<unknown>>;
+} | {
+    server: import("@anthropic-ai/claude-agent-sdk").McpSdkServerConfigWithInstance;
+    toolNames: string[];
+    /** Each tool's own function, by agent name, for tests. */
+    calls: {
+        [k: string]: (job: string) => Promise<{
+            content: {
+                type: "text";
+                text: string;
+            }[];
+            isError?: boolean | undefined;
+        }>;
+    };
+};
+/** The channel for a step that runs in this process (`foldrun run`): no
+ *  proxy between it and the drive loop, so a job is handed over directly. */
+export declare function localDelegateChannel(run: (agent: string, job: string, cancelled: () => boolean) => Promise<DelegationResult>): OperatorChannel;
+/** The line the delegating step's prompt carries, so the model knows who
+ *  works where. */
+export declare function delegatePromptLine(specs: DelegateSpec[]): string;
+export {};

package/dist/src/delegate-tools.js

@@ -0,0 +1,153 @@
+// Isolated sub-agents: a colleague that does a job in ITS OWN sandbox.
+//
+//   subagents: [reader]       # on the delegating agent, unchanged
+//   sandbox: own              # on reader's own agent.md
+//
+// A sub-agent delegated to the ordinary way (subagents.ts) runs inside the
+// parent's SDK session: the parent's pod, secrets, lease and network, its
+// tools cut to the parent's. That protects the parent's context and nothing
+// else — an injected page read by the sub-agent is read in a sandbox the
+// parent's secrets are in.
+//
+// An agent marked `sandbox: own` is instead offered to the parent as a tool,
+// `delegate_<name>(job)`. The call leaves the parent's sandbox through the
+// one door it has (the egress proxy, at its lease — operator.ts), and the
+// worker runs the job as a step of its own: its own pod, its own `tools:`,
+// `secrets:` and `network:` from its own file, NOT cut to the parent's — the
+// parent may hold less. The parent waits and gets the reply text, nothing
+// else. What the sub-agent wrote reaches the workspace when it finishes, so
+// the next step sees it; the reply names the paths.
+//
+// Depth one, as for every sub-agent: the job's own `subagents:` are not
+// offered to it. Its record sits in the run after the parent's, marked
+// `subagentOf` (store.ts), with its own cost and trace.
+//
+// With no channel (a container step on an install without a proxy) the tools
+// are not granted at all; the runner says so on the step.
+import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
+import { z } from "zod";
+import { delegateToolName } from "./subagents.js";
+export const DELEGATE_SERVER = "foldrun_delegate";
+/** A job handed over is at most this long — the sub-agent's prompt. */
+export const JOB_MAX = 20_000;
+/** What comes back is cut here: the reply is the parent's context. */
+export const REPLY_MAX = 40_000;
+/** The granted names, the same on every path. */
+export function delegateToolNames(specs) {
+    return specs.map((s) => `mcp__${DELEGATE_SERVER}__${delegateToolName(s.name)}`);
+}
+/** The reply as the parent reads it: the sub-agent's words, then what it changed. */
+export function replyText(name, r) {
+    const body = r.result.trim() || "(no reply)";
+    const cut = body.length > REPLY_MAX ? `${body.slice(0, REPLY_MAX)}\n…(cut at ${REPLY_MAX} characters)` : body;
+    const wrote = r.wrote?.length
+        ? `\n\nFiles ${name} changed (in the workspace from the next step on — not in your sandbox):\n${r.wrote.slice(0, 200).map((w) => `- ${w}`).join("\n")}`
+        : "";
+    const head = r.status === "completed" ? "" : `${name} did not finish (${r.status}). What it said:\n`;
+    return head + cut + wrote;
+}
+export function buildDelegateTools(opts) {
+    const now = opts.now ?? Date.now;
+    const channel = opts.channel;
+    if (!opts.specs.length || !channel?.delegate || !channel.delegation) {
+        return { server: null, toolNames: [], calls: {} };
+    }
+    const text = (t, isError = false) => ({ content: [{ type: "text", text: t }], ...(isError ? { isError: true } : {}) });
+    const run = async (s, rawJob) => {
+        const job = String(rawJob ?? "").trim().slice(0, JOB_MAX);
+        if (!job)
+            return text(`${delegateToolName(s.name)} needs the job, written out in full.`, true);
+        let id;
+        try {
+            ({ id } = await channel.delegate(s.name, job));
+        }
+        catch (err) {
+            return text(`Could not hand ${s.name} the job: ${err instanceof Error ? err.message : String(err)}`, true);
+        }
+        opts.emit("info", `delegating to ${s.name} (own sandbox): ${job.split("\n")[0].slice(0, 160)}`, { subagent: s.name });
+        const deadline = opts.timeoutSec ? now() + opts.timeoutSec * 1000 : Infinity;
+        while (now() < deadline) {
+            let got = null;
+            try {
+                got = await channel.delegation(id, Math.min(deadline - now(), 25_000));
+            }
+            catch {
+                // A dropped long-poll is retried; the job goes on meanwhile.
+                await new Promise((r) => setTimeout(r, 2_000));
+                continue;
+            }
+            if (got) {
+                opts.emit(got.status === "completed" ? "info" : "error", `${s.name} ${got.status}${got.wrote?.length ? ` — changed ${got.wrote.length} file(s)` : ""}`, { subagent: s.name });
+                return text(replyText(s.name, got), got.status !== "completed");
+            }
+        }
+        try {
+            await channel.cancelDelegation?.(id);
+        }
+        catch {
+            /* the worker ends it with the step */
+        }
+        return text(`${s.name} did not finish in time; its job was stopped.`, true);
+    };
+    const tools = opts.specs.map((s) => tool(delegateToolName(s.name), `Hand ${s.name} a whole job: ${s.description} It works in its own sandbox with its own tools and returns its reply — ` +
+        `it has not read your conversation, so write the job out in full: what to do, what to return, where to put files.`, { job: z.string().describe("The complete, self-contained job") }, async ({ job }) => run(s, job)));
+    return {
+        server: createSdkMcpServer({ name: DELEGATE_SERVER, version: "1.0.0", tools }),
+        toolNames: delegateToolNames(opts.specs),
+        /** Each tool's own function, by agent name, for tests. */
+        calls: Object.fromEntries(opts.specs.map((s) => [s.name, (job) => run(s, job)])),
+    };
+}
+/** The channel for a step that runs in this process (`foldrun run`): no
+ *  proxy between it and the drive loop, so a job is handed over directly. */
+export function localDelegateChannel(run) {
+    const jobs = new Map();
+    let n = 0;
+    const none = async () => {
+        throw new Error("nobody can answer here");
+    };
+    return {
+        ask: none,
+        poll: async () => null,
+        inbox: async () => [],
+        async delegate(agent, job) {
+            const id = `local-${++n}`;
+            const entry = {
+                cancelled: false,
+                done: Promise.resolve(),
+            };
+            entry.done = run(agent, job, () => entry.cancelled)
+                .catch((err) => ({ status: "failed", result: err instanceof Error ? err.message : String(err) }))
+                .then((r) => (entry.result = r));
+            jobs.set(id, entry);
+            return { id };
+        },
+        async delegation(id, maxMs) {
+            const entry = jobs.get(id);
+            if (!entry)
+                return { status: "skipped", result: "no such job" };
+            if (entry.result)
+                return entry.result;
+            let timer;
+            const r = await Promise.race([
+                entry.done,
+                new Promise((res) => (timer = setTimeout(() => res(null), Math.max(0, maxMs)))),
+            ]);
+            clearTimeout(timer);
+            return r;
+        },
+        async cancelDelegation(id) {
+            const entry = jobs.get(id);
+            if (entry)
+                entry.cancelled = true;
+        },
+    };
+}
+/** The line the delegating step's prompt carries, so the model knows who
+ *  works where. */
+export function delegatePromptLine(specs) {
+    return (`<isolated-subagents>\nThese colleagues work in their own sandbox, with their own tools; call the tool to hand one a job ` +
+        `and you get back its reply and the paths of any files it changed:\n` +
+        specs.map((s) => `- ${delegateToolName(s.name)}: ${s.description}`).join("\n") +
+        `\n</isolated-subagents>`);
+}

package/dist/src/egress.d.ts

@@ -1,4 +1,4 @@
-import type { PeerInfo } from "./operator.ts";
+import type { DelegationResult, PeerInfo } from "./operator.ts";
 import type { TestEffect } from "./test-mode.ts";
 import type { NetworkLevel } from "./network.ts";
 /** `${NAME}` — the shape a secret reference takes everywhere in foldrun. */
@@ -27,6 +27,13 @@ export declare function hostOf(url: string): string | null;
  * from the step's declared secrets and the hosts its tools and provider
  * name; the proxy enforces it per request.
  */
+/** Which workload a lease is for — the runner's word, never the pod's: what
+ *  an identity token's subject is built from (oidc-issuer.ts). */
+export interface LeaseWho {
+    workspace: string;
+    agent: string;
+    flow?: string;
+}
 export interface EgressGrant {
     /** Secret name → the hosts that secret may be substituted for. */
     secrets: Record<string, {
@@ -53,6 +60,11 @@ export interface EgressGrant {
     /** Refuse a site off the list (true), or allow it and name it in the
      *  trace (false: report only). Set by the platform when it leases. */
     enforce?: boolean;
+    /** Identity name → the audience its tokens are for: the only identities
+     *  this step may ask the proxy's /identity door to mint (oidc-issuer.ts). */
+    identities?: Record<string, {
+        audience: string;
+    }>;
 }
 export interface EgressLease {
     /** The base the pod sends through: `http://…/e/<token>`. */
@@ -96,7 +108,10 @@ export interface EgressHooks {
     /** `step` — the step's index in run.steps; keys that step's operator inbox.
      *  `agent` and `peers` — this step's agent and the other steps of its
      *  parallel group (tools: [peers]): the proxy serves the roster and
-     *  addresses a colleague's message to the right inbox. */
+     *  addresses a colleague's message to the right inbox.
+     *  `delegates` — the `sandbox: own` sub-agents this step may hand a job
+     *  to over the delegate door (delegate-tools.ts); the proxy refuses any
+     *  other name. */
     lease(args: {
         tenant: string;
         runId: string;
@@ -105,7 +120,12 @@ export interface EgressHooks {
         step?: number;
         agent?: string;
         peers?: PeerInfo[];
+        who?: LeaseWho;
+        delegates?: string[];
     }): Promise<EgressLease | null>;
+    /** The run is still being driven: renew its leases' heartbeat. Optional —
+     *  an install without leases has nothing to renew. */
+    renew?(runId: string): Promise<number>;
     /** The step is over — every attempt, however it ended (tools: [peers]).
      *  A lease comes and goes per attempt, so it cannot say this: a sibling
      *  between retries, or waiting for a slot, holds none and is not done.
@@ -115,6 +135,27 @@ export interface EgressHooks {
         runId: string;
         step: number;
     }): Promise<void>;
+    /** Serve the jobs a step posts to the delegate door while it runs
+     *  (`sandbox: own` sub-agents): each is handed to `run`, whose result the
+     *  door then answers the step's long-poll with. `close()` stops serving
+     *  and settles anything unfinished as skipped. Optional: a platform
+     *  without it offers no delegate tools, and the runner says so. */
+    delegations?(args: {
+        tenant: string;
+        runId: string;
+        step: number;
+        resuming?: boolean;
+    }, run: (job: DelegationJob) => Promise<DelegationResult>): {
+        close(): Promise<void>;
+    };
+}
+/** One job posted to the delegate door. */
+export interface DelegationJob {
+    id: string;
+    agent: string;
+    job: string;
+    /** Set when the step cancelled it (the delegate tool timed out). */
+    cancelled?: () => boolean;
 }
 /** Strip a header set of the proxy's own and hop-by-hop headers. */
 export declare const HOP_BY_HOP: Set<string>;

package/dist/src/frontmatter-fields.js

@@ -44,6 +44,7 @@ const AGENT = [
     { key: "mcpServers", type: "object", help: "MCP servers, name → {command | url, args, env, headers}" },
     { key: "agents", type: ["list", "string"], help: "colleagues it may consult" },
     { key: "subagents", type: ["list", "string"], help: "colleagues it may delegate to" },
+    { key: "sandbox", type: "string", values: ["own", "parent"], help: "when delegated to as a sub-agent: own = its own sandbox, tools, secrets and network; parent (default) = inside the delegating step's" },
     { key: "secrets", type: ["list", "string"], help: "keys it spends itself" },
     { key: "budget", type: ["number", "string"], help: "USD per run" },
     { key: "limits", type: "object", validated: true, help: "per-step call limits" },
@@ -187,7 +188,7 @@ const SAID_WHAT_IT_IS = [
 const JOB_FIELDS = {
     agent: {
         governance: ["owner", "budget"],
-        guardrail: ["limits", "network", "hooks", "disallowedTools", "permissionMode", "secrets"],
+        guardrail: ["limits", "network", "hooks", "disallowedTools", "permissionMode", "secrets", "sandbox"],
     },
     flow: {
         governance: ["owner", "approvers", "approve_within", "budget", "priority"],

package/dist/src/oauth-presets.d.ts

@@ -9,5 +9,12 @@ export interface OAuthPreset {
     /** The one thing about this provider that costs an afternoon to learn. */
     hint: string;
 }
+/**
+ * @deprecated foldrun is a runner and keeps no list of providers: the
+ * dashboard and CLI take the provider's own URLs and an `authorize_extra`
+ * map (`--authorize-param`) instead. Kept for apps saved from a preset and
+ * the CLI's deprecated `--provider`; to be removed in a major.
+ */
 export declare const OAUTH_PRESETS: Record<string, OAuthPreset>;
+/** @deprecated see OAUTH_PRESETS. */
 export declare const OAUTH_PRESET_NAMES: string[];

package/dist/src/oauth-presets.js

@@ -6,6 +6,12 @@
 // What stays with the account is the OAuth *client* (id + secret): a consent
 // screen belongs to a registered app, so the developer brings those two
 // values from the provider's console and everything else is here.
+/**
+ * @deprecated foldrun is a runner and keeps no list of providers: the
+ * dashboard and CLI take the provider's own URLs and an `authorize_extra`
+ * map (`--authorize-param`) instead. Kept for apps saved from a preset and
+ * the CLI's deprecated `--provider`; to be removed in a major.
+ */
 export const OAUTH_PRESETS = {
     google: {
         authorize_url: "https://accounts.google.com/o/oauth2/v2/auth",
@@ -36,4 +42,5 @@ export const OAUTH_PRESETS = {
             "The redirect URL must match what the app registers exactly, and only localhost may be plain http.",
     },
 };
+/** @deprecated see OAUTH_PRESETS. */
 export const OAUTH_PRESET_NAMES = Object.keys(OAUTH_PRESETS);

package/dist/src/operator.d.ts

@@ -84,6 +84,25 @@ export interface OperatorChannel {
     tell?(to: string, text: string): Promise<{
         to: string[];
     }>;
+    /** `sandbox: own` sub-agents (delegate-tools.ts): hand `agent` a job. The
+     *  worker runs it in its own sandbox; only the reply comes back. Optional:
+     *  an older proxy has no delegate door. */
+    delegate?(agent: string, job: string): Promise<{
+        id: string;
+    }>;
+    /** Waits up to `maxMs` for that job to finish; null while it still runs. */
+    delegation?(id: string, maxMs: number): Promise<DelegationResult | null>;
+    /** The parent stopped waiting (its step ended): stop the job. Best effort. */
+    cancelDelegation?(id: string): Promise<void>;
+}
+/** How an isolated sub-agent's job ended, as the delegating step hears it. */
+export interface DelegationResult {
+    status: "completed" | "failed" | "skipped";
+    /** Its reply — all the parent sees of its work. */
+    result: string;
+    /** Workspace paths it changed. They reach the workspace when it ends, so
+     *  the next step sees them; the delegating step's own sandbox does not. */
+    wrote?: string[];
 }
 export declare const QUESTION_MAX = 2000;
 export declare const OPTION_MAX = 200;

package/dist/src/operator.js

@@ -115,6 +115,35 @@ export function httpChannel(egress, fetchImpl = fetch) {
             }));
             return { to: Array.isArray(body.to) ? body.to : [] };
         },
+        async delegate(agent, job) {
+            const body = await json(await fetchImpl(`${ep.base}/delegate/${ep.token}`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ agent, job }),
+                signal: AbortSignal.timeout(15_000),
+            }));
+            return { id: String(body.id) };
+        },
+        async delegation(id, maxMs) {
+            const wait = Math.max(0, Math.min(maxMs, POLL_MS));
+            const body = await json(await fetchImpl(`${ep.base}/delegate/${ep.token}/${encodeURIComponent(id)}?wait=${wait}`, {
+                signal: AbortSignal.timeout(wait + 15_000),
+            }));
+            const status = body.status;
+            if (status !== "completed" && status !== "failed" && status !== "skipped")
+                return null;
+            return {
+                status,
+                result: typeof body.result === "string" ? body.result : "",
+                wrote: Array.isArray(body.wrote) ? body.wrote.filter((w) => typeof w === "string") : [],
+            };
+        },
+        async cancelDelegation(id) {
+            await json(await fetchImpl(`${ep.base}/delegate/${ep.token}/${encodeURIComponent(id)}`, {
+                method: "DELETE",
+                signal: AbortSignal.timeout(5_000),
+            }));
+        },
     };
 }
 /**

package/dist/src/platform.d.ts

@@ -86,6 +86,14 @@ export interface PlatformHooks {
     isolation: Record<string, IsolatedStepRunner>;
     /** Destroy whatever sandboxes a stopped run still has. Default: nothing to destroy. */
     killRunSandboxes(runId: string): void;
+    /** Destroy ONE step's sandbox, by the ref on its record — a sandbox: own
+     *  job orphaned by a restart while its parent re-attaches, where killing
+     *  the whole run's would take the parent too. Optional: an executor that
+     *  cannot re-attach never needs it (the whole run's are killed instead). */
+    killSandbox?(sandbox: {
+        kind: string;
+        ref: string;
+    }): void;
     /** Publish storage/public/ as share links after a run. Default: no links. */
     syncPublicShares(tenant: string, workspace: string): Promise<{
         added: string[];

package/dist/src/run-container.d.ts

@@ -8,7 +8,7 @@ import { type RuntimeSpec } from "./runtime.ts";
 import { type NetworkLevel } from "./network.ts";
 import type { ScriptSpec } from "./script-tools.ts";
 import type { ConsultSpec } from "./agent-tools.ts";
-import type { SubagentSpec } from "./subagents.ts";
+import type { DelegateSpec, SubagentSpec } from "./subagents.ts";
 import { type OperatorEvent } from "./operator.ts";
 import type { SearchRoot, RunDigest } from "./context-tools.ts";
 import type { TranslatorSpec } from "./translator.ts";
@@ -38,6 +38,9 @@ export interface ContainerStepInput {
     consults: ConsultSpec[];
     /** `subagents:` — built host-side (runner.ts), plain JSON. */
     subagents?: SubagentSpec[];
+    /** `sandbox: own` sub-agents — offered as delegate_<name> tools; their
+     *  jobs run on the worker in sandboxes of their own (delegate-tools.ts). */
+    delegates?: DelegateSpec[];
     timeoutSec?: number;
     /** The step's spend ceiling and the model's per-token price — see
      *  step-exec.ts. Values, so the driver can enforce them in the pod. */
@@ -180,6 +183,10 @@ export interface ContainerStepOutcome {
     /** The pod's reconnects and, when it was lost, what the step had written —
      *  see ExecOutcome.browserPod. */
     browserPod?: BrowserPodOutcome;
+    /** Workspace paths the step's changes were applied to on the host — what
+     *  applyContainerChanges returned. An isolated sub-agent's reply names
+     *  them to the step that delegated (delegate-tools.ts). */
+    applied?: string[];
 }
 /**
  * The one place the timing line is worded, so the docker and k8s traces
@@ -289,7 +296,7 @@ export declare function runtimeCacheMount(tenant: string | undefined): {
     target: string;
 } | null;
 /** The runner container's entrypoint, as JS text: written into the image as driver.mjs, so it must be plain JS — a TypeScript cast here broke every step on v2026.10.21.5 (tests/run-container.test.ts checks it). */
-export declare const DRIVER = "// The runner container's entrypoint. Reads one step, executes it with the\n// same core the server uses, speaks JSONL on stdout, exits.\nimport fs from \"node:fs\";\nconst input = JSON.parse(fs.readFileSync(\"/opt/runner/job/input.json\", \"utf8\"));\n// Start-up marks (run-container.ts#STARTUP_PHASES): which phase just ended,\n// on the sandbox's clock. A worker that does not know a mark skips the line.\nconst mark = (name) => process.stdout.write(JSON.stringify({ e: \"mark\", name, at: Date.now() }) + \"\\n\");\nmark(\"driver\");\nlet modelSpoke = false;\nconst emit = (type, text, extra) => {\n  // The model's first text or tool call is where start-up ends and the\n  // step's own work begins \u2014 runtime and tool lines before it are set-up.\n  if (!modelSpoke && (type === \"text\" || type === \"tool\")) { modelSpoke = true; mark(\"model\"); }\n  process.stdout.write(JSON.stringify({ e: \"event\", type, text, ...extra }) + \"\\n\");\n};\n// What this sandbox actually touched, read at the last moment from the\n// kernel's own books: cgroup v2 for CPU busy-time and peak memory,\n// /proc/net/dev for bytes on the wire. Every read is best-effort \u2014 gVisor\n// exposes some of these files and not others depending on version, and a\n// metric we cannot read is null, never guessed. Reservation is what is\n// billed; these exist so the reservation can be right-sized.\nfunction readActuals() {\n  // fs from the module's own import \u2014 the driver is ESM, and a require()\n  // here threw on every call, silently nulling every metric it guarded.\n  const read = (p) => { try { return fs.readFileSync(p, \"utf8\"); } catch { return null; } };\n  // Two cgroup dialects: v2 (cpu.stat, microseconds; memory.peak) on a\n  // plain runtime, v1-style controllers under gVisor (cpuacct.usage,\n  // NANOseconds; memory.max_usage_in_bytes) \u2014 probed on the real cluster,\n  // not assumed. Whichever answers wins; both silent means null.\n  const cpuStat = read(\"/sys/fs/cgroup/cpu.stat\");\n  const usage = cpuStat?.match(/^usage_usec (\\d+)/m);\n  const cpuacctNs = usage ? NaN : Number(read(\"/sys/fs/cgroup/cpuacct/cpuacct.usage\")?.trim());\n  const peak =\n    read(\"/sys/fs/cgroup/memory.peak\") ??\n    read(\"/sys/fs/cgroup/memory/memory.max_usage_in_bytes\") ??\n    read(\"/sys/fs/cgroup/memory/memory.usage_in_bytes\");\n  let rx = 0, tx = 0, sawNet = false;\n  const net = read(\"/proc/net/dev\");\n  if (net) {\n    for (const line of net.split(\"\\n\").slice(2)) {\n      const m = line.trim().match(/^(\\S+):\\s+(\\d+)(?:\\s+\\d+){7}\\s+(\\d+)/);\n      if (m && m[1] !== \"lo\") { rx += Number(m[2]); tx += Number(m[3]); sawNet = true; }\n    }\n  }\n  return {\n    busyCpuSecs: usage\n      ? Number(usage[1]) / 1e6\n      : Number.isFinite(cpuacctNs) && cpuacctNs > 0\n        ? cpuacctNs / 1e9\n        : null,\n    peakMemBytes: peak ? Number(peak.trim()) || null : null,\n    rxBytes: sawNet ? rx : null,\n    txBytes: sawNet ? tx : null,\n  };\n}\n\ntry {\n  // Runtime state (venvs, npm prefixes) lands in the agent user's real home\n  // \u2014 writable, inside the container, gone with it.\n  process.env.FOLDRUN_DATA = \"/home/agent/.foldrun\";\n  const { executeStep } = await import(\"@foldrun/core/step-exec\");\n  const { buildApiTools } = await import(\"@foldrun/core/api-tools\");\n  const { buildScriptTools } = await import(\"@foldrun/core/script-tools\");\n  const { buildConsultTools } = await import(\"@foldrun/core/agent-tools\");\n  const { buildSearchTools, buildHistoryTools, buildDeskTools } = await import(\"@foldrun/core/context-tools\");\n  const { httpChannel, buildAskTool, buildPeerTools, inboxReader } = await import(\"@foldrun/core/operator\");\n  const { startTranslator } = await import(\"@foldrun/core/translator\");\n  const { prepareRuntime } = await import(\"@foldrun/core/runtime\");\n  const { materializeFileSecrets } = await import(\"@foldrun/core/secret-files\");\n  const { paidWebActions } = await import(\"@foldrun/core/browser-pod\");\n  mark(\"imports\");\n\n  const agentDir = \"/workspace/\" + input.agentRel;\n  // HOME is where a bare relative path lands when anything resolves one\n  // outside cwd \u2014 and root's /root is outside the workspace, so such a read\n  // was refused by confinement with a path the agent never typed. Its own\n  // directory is both the truthful answer and the safe one.\n  // @file secrets crossed as content; materialise them to 0600 paths inside\n  // the container (a host path from the other side would not exist here).\n  const env = materializeFileSecrets(agentDir, { ...process.env, HOME: agentDir }).env;\n  // Caches go to the sandbox user's own home, not to HOME: the Claude CLI's\n  // logs, fontconfig, Mesa and gstreamer all follow XDG_CACHE_HOME, and under\n  // agents/<name>/.cache they were copied back after every step \u2014 3,855 files\n  // across 179 agent folders on the box by 17 Oct 2026, read by nothing.\n  env.XDG_CACHE_HOME = \"/home/agent/.cache\";\n\n  // The declared runtime, built in here \u2014 pip and npm have the network, which\n  // the host side may not. It lands in .foldrun/runner/.runtimes, which the\n  // executors mount from a per-tenant directory (run-container.ts#RUNTIME_CACHE):\n  // the first step for a given fingerprint installs, every later one finds\n  // .ready and skips. With no mount it still works, just fresh every time \u2014\n  // which is what this used to be unconditionally. The log says which happened.\n  const runtime = input.runtime\n    ? prepareRuntime(\"runner\", input.runtime)\n    : { interpreters: {}, env: {}, log: [], error: null };\n  for (const line of runtime.log) emit(\"info\", \"runtime: \" + line);\n  if (runtime.error) emit(\"error\", \"runtime: \" + runtime.error);\n  // The step's own environment gets it too, not only the script tools: an\n  // agent that runs \"python3 x.py\" or a shebang script through Bash should\n  // meet the packages its runtime declared, not the image's bare python.\n  Object.assign(env, runtime.env);\n\n  // install: what the agent finds it needs mid-step. apt goes through the\n  // root start-up's helper (install-helper.ts); pip and npm land in a\n  // directory of this container's own, on the paths from the first turn.\n  const { buildInstallTool, INSTALL_TOOL } = await import(\"@foldrun/core/install-tool\");\n  const { stepInstallEnv, INSTALL_SOCKET } = await import(\"@foldrun/core/runtime\");\n  const installDir = \"/home/agent/.foldrun/step\";\n  const installing = (input.allowed ?? []).includes(INSTALL_TOOL);\n  if (installing) Object.assign(env, stepInstallEnv(installDir, env));\n  const install = installing\n    ? buildInstallTool({\n        dir: installDir,\n        socket: env.FOLDRUN_INSTALL_SOCKET || INSTALL_SOCKET,\n        cacheRoot: \"/home/agent/.foldrun/runner/.runtimes\",\n        python: env.VIRTUAL_ENV ? env.VIRTUAL_ENV + \"/bin/python\" : \"python3\",\n        env,\n        emit,\n      })\n    : { server: null };\n\n  // API and script tools, rebuilt in here from their specs. Secrets were\n  // substituted into API headers before the input crossed the boundary, so\n  // buildApiTools gets an already-resolved environment. verify: gets the\n  // container's own environment, whole: it is the boundary, assembled on\n  // the host from an allowlist, and the declared secrets are in it.\n  // A long result is kept in a file only when the agent can read it back.\n  // (tool-output.ts canReadBack, inlined: the driver imports core by subpath.)\n  const keepIn = { dir: agentDir, readable: () => (input.allowed ?? []).some((t) => t === \"Read\" || t === \"Grep\") };\n  // A declared secret named like a model variable crosses as\n  // FOLDRUN_DECLARED_<NAME> (runner.ts, FOL-19): the model keeps its own\n  // settings, and the agent's API and script tools and verify: get the value\n  // back under the name it declared. Built here, after the runtime and any\n  // mid-step install have added their paths to env.\n  const toolEnv = { ...env };\n  for (const [k, v] of Object.entries(env)) if (k.startsWith(\"FOLDRUN_DECLARED_\")) toolEnv[k.slice(\"FOLDRUN_DECLARED_\".length)] = v;\n  const api = buildApiTools(\"\", input.apis, undefined, { env: toolEnv, missing: [] }, keepIn);\n  const script = buildScriptTools(\n    agentDir,\n    input.scripts,\n    toolEnv,\n    \"/library/scripts\",\n    runtime.interpreters,\n    null,\n    keepIn.readable,\n  );\n  // The translator, when the provider speaks Chat Completions: a loopback\n  // server for the length of this step. Its env replaces the endpoint the\n  // host assembled; the provider's real URL and key stay inside it.\n  const translator = input.translator ? await startTranslator(input.translator) : null;\n  if (translator) {\n    Object.assign(env, translator.env);\n    emit(\"info\", \"translator: listening on \" + translator.baseUrl + \" for \" + (input.translator.label ?? input.translator.upstreamBase));\n  }\n  const consult = buildConsultTools(input.consults ?? [], env, emit);\n  // The platform's own two groups, rebuilt from values like everything else.\n  const search = buildSearchTools(input.search ?? []);\n  const history = input.history?.length ? buildHistoryTools(input.history) : { server: null };\n  const desks = input.desks?.length ? buildDeskTools(input.desks) : { server: null };\n  // A person in the loop, over the proxy this step's lease already names:\n  // ask_person when tools: [ask], and the run's inbox after every tool call.\n  const channel = httpChannel(env.FOLDRUN_EGRESS);\n  const ask = input.ask ? buildAskTool({ channel, timeoutSec: input.ask.timeoutSec, emit }) : { server: null };\n  const peers = input.peers ? buildPeerTools({ channel, self: input.peers.self, siblings: input.peers.siblings, emit }) : { server: null };\n  const inbox = channel ? inboxReader(channel, emit) : undefined;\n\n  mark(\"tools\");\n  const outcome = await executeStep({\n    agentDir,\n    workspaceRoot: \"/workspace\",\n    libraryRoot: \"/library\",\n    prompt: input.prompt,\n    model: input.model,\n    effort: input.effort ?? null,\n    systemPrompt: input.systemPrompt,\n    allowed: input.allowed,\n    mcpNames: input.mcpNames,\n    mcpServers: {\n      ...(api.server ? { foldrun_apis: api.server } : {}),\n      ...(script.server ? { foldrun_scripts: script.server } : {}),\n      ...(consult.server ? { foldrun_agents: consult.server } : {}),\n      ...(search.server ? { foldrun_search: search.server } : {}),\n      ...(history.server ? { foldrun_history: history.server } : {}),\n      ...(desks.server ? { foldrun_desks: desks.server } : {}),\n      ...(ask.server ? { foldrun_ask: ask.server } : {}),\n      ...(peers.server ? { foldrun_peers: peers.server } : {}),\n      ...(install.server ? { foldrun_install: install.server } : {}),\n      ...input.mcpServers,\n    },\n    ...(inbox ? { inbox } : {}),\n    ...(input.subagents?.length ? { subagents: input.subagents } : {}),\n    env,\n    timeoutSec: input.timeoutSec,\n    budgetUsd: input.budgetUsd,\n    budgetNote: input.budgetNote,\n    price: input.price,\n    verify: input.verify,\n    verifyEnv: toolEnv,\n    ...(typeof input.judgeModel === \"string\" ? { judgeModel: input.judgeModel } : {}),\n    ...(typeof input.judgeEffort === \"string\" ? { judgeEffort: input.judgeEffort } : {}),\n    output: input.output,\n    schema: input.schema,\n    maxTurns: input.maxTurns,\n    ...(input.capture === \"metadata\" || input.capture === \"full\" ? { capture: input.capture } : {}),\n    ...(input.limits && Object.keys(input.limits).length ? { limits: input.limits, toolOwners: input.toolOwners ?? {} } : {}),\n    ...(input.hookNames?.length ? { hookNames: input.hookNames, hookBase: input.hookBase ?? {} } : {}),\n    // Slim browsing: the platform put this step on the slim image to browse\n    // through the account's pod, and named the file the web tool logs its\n    // reconnects to. A lost pod stops the step; what it wrote decides what\n    // the runner does next (browser-pod.ts).\n    ...(env.FOLDRUN_BROWSER_POD_EVENTS ? { browserPod: { events: env.FOLDRUN_BROWSER_POD_EVENTS, methods: api.methods ?? {}, paidWeb: paidWebActions(env), ...(env.FOLDRUN_BROWSER_INIT ? { browseInit: env.FOLDRUN_BROWSER_INIT } : {}) } } : {}),\n    // The container is the boundary; the SDK's own bash sandbox here would\n    // only block declared network use (SSH, curl) for no added safety.\n    sandboxBash: false,\n    emit,\n  });\n  for (const line of api.drainLog()) emit(\"info\", \"api: \" + line);\n  for (const line of script.drainLog()) emit(\"info\", \"script: \" + line);\n  if (translator) {\n    for (const line of translator.drainLog()) emit(\"info\", line.startsWith(\"translator\") ? line : \"translator: \" + line);\n    await translator.close();\n  }\n  // A consult's spend belongs to the step that asked.\n  const consultCost = consult.drainCost();\n  if (consultCost > 0) outcome.costUsd = (outcome.costUsd ?? 0) + consultCost;\n  if (consultCost > 0 && typeof outcome.turnsCostUsd === \"number\") outcome.turnsCostUsd += consultCost;\n  process.stdout.write(JSON.stringify({ e: \"done\", ...outcome, res: readActuals() }) + \"\\n\");\n  process.exit(0);\n} catch (err) {\n  emit(\"error\", err instanceof Error ? err.message : String(err));\n  // The failure path reports actuals too \u2014 a step that died eleven minutes\n  // in still held its slice for eleven minutes, and the failed runs are\n  // exactly the ones whose resource story gets read.\n  let res = null;\n  try { res = readActuals(); } catch { /* the reading must never mask the error */ }\n  process.stdout.write(JSON.stringify({ e: \"done\", status: \"failed\", result: null, costUsd: null, res }) + \"\\n\");\n  process.exit(0);\n}\n";
+export declare const DRIVER = "// The runner container's entrypoint. Reads one step, executes it with the\n// same core the server uses, speaks JSONL on stdout, exits.\nimport fs from \"node:fs\";\nconst input = JSON.parse(fs.readFileSync(\"/opt/runner/job/input.json\", \"utf8\"));\n// Start-up marks (run-container.ts#STARTUP_PHASES): which phase just ended,\n// on the sandbox's clock. A worker that does not know a mark skips the line.\nconst mark = (name) => process.stdout.write(JSON.stringify({ e: \"mark\", name, at: Date.now() }) + \"\\n\");\nmark(\"driver\");\nlet modelSpoke = false;\nconst emit = (type, text, extra) => {\n  // The model's first text or tool call is where start-up ends and the\n  // step's own work begins \u2014 runtime and tool lines before it are set-up.\n  if (!modelSpoke && (type === \"text\" || type === \"tool\")) { modelSpoke = true; mark(\"model\"); }\n  process.stdout.write(JSON.stringify({ e: \"event\", type, text, ...extra }) + \"\\n\");\n};\n// What this sandbox actually touched, read at the last moment from the\n// kernel's own books: cgroup v2 for CPU busy-time and peak memory,\n// /proc/net/dev for bytes on the wire. Every read is best-effort \u2014 gVisor\n// exposes some of these files and not others depending on version, and a\n// metric we cannot read is null, never guessed. Reservation is what is\n// billed; these exist so the reservation can be right-sized.\nfunction readActuals() {\n  // fs from the module's own import \u2014 the driver is ESM, and a require()\n  // here threw on every call, silently nulling every metric it guarded.\n  const read = (p) => { try { return fs.readFileSync(p, \"utf8\"); } catch { return null; } };\n  // Two cgroup dialects: v2 (cpu.stat, microseconds; memory.peak) on a\n  // plain runtime, v1-style controllers under gVisor (cpuacct.usage,\n  // NANOseconds; memory.max_usage_in_bytes) \u2014 probed on the real cluster,\n  // not assumed. Whichever answers wins; both silent means null.\n  const cpuStat = read(\"/sys/fs/cgroup/cpu.stat\");\n  const usage = cpuStat?.match(/^usage_usec (\\d+)/m);\n  const cpuacctNs = usage ? NaN : Number(read(\"/sys/fs/cgroup/cpuacct/cpuacct.usage\")?.trim());\n  const peak =\n    read(\"/sys/fs/cgroup/memory.peak\") ??\n    read(\"/sys/fs/cgroup/memory/memory.max_usage_in_bytes\") ??\n    read(\"/sys/fs/cgroup/memory/memory.usage_in_bytes\");\n  let rx = 0, tx = 0, sawNet = false;\n  const net = read(\"/proc/net/dev\");\n  if (net) {\n    for (const line of net.split(\"\\n\").slice(2)) {\n      const m = line.trim().match(/^(\\S+):\\s+(\\d+)(?:\\s+\\d+){7}\\s+(\\d+)/);\n      if (m && m[1] !== \"lo\") { rx += Number(m[2]); tx += Number(m[3]); sawNet = true; }\n    }\n  }\n  return {\n    busyCpuSecs: usage\n      ? Number(usage[1]) / 1e6\n      : Number.isFinite(cpuacctNs) && cpuacctNs > 0\n        ? cpuacctNs / 1e9\n        : null,\n    peakMemBytes: peak ? Number(peak.trim()) || null : null,\n    rxBytes: sawNet ? rx : null,\n    txBytes: sawNet ? tx : null,\n  };\n}\n\ntry {\n  // Runtime state (venvs, npm prefixes) lands in the agent user's real home\n  // \u2014 writable, inside the container, gone with it.\n  process.env.FOLDRUN_DATA = \"/home/agent/.foldrun\";\n  const { executeStep } = await import(\"@foldrun/core/step-exec\");\n  const { buildApiTools } = await import(\"@foldrun/core/api-tools\");\n  const { buildScriptTools } = await import(\"@foldrun/core/script-tools\");\n  const { buildConsultTools } = await import(\"@foldrun/core/agent-tools\");\n  const { buildSearchTools, buildHistoryTools, buildDeskTools } = await import(\"@foldrun/core/context-tools\");\n  const { httpChannel, buildAskTool, buildPeerTools, inboxReader } = await import(\"@foldrun/core/operator\");\n  const { buildDelegateTools } = await import(\"@foldrun/core/delegate-tools\");\n  const { startTranslator } = await import(\"@foldrun/core/translator\");\n  const { prepareRuntime } = await import(\"@foldrun/core/runtime\");\n  const { materializeFileSecrets } = await import(\"@foldrun/core/secret-files\");\n  const { paidWebActions } = await import(\"@foldrun/core/browser-pod\");\n  mark(\"imports\");\n\n  const agentDir = \"/workspace/\" + input.agentRel;\n  // HOME is where a bare relative path lands when anything resolves one\n  // outside cwd \u2014 and root's /root is outside the workspace, so such a read\n  // was refused by confinement with a path the agent never typed. Its own\n  // directory is both the truthful answer and the safe one.\n  // @file secrets crossed as content; materialise them to 0600 paths inside\n  // the container (a host path from the other side would not exist here).\n  const env = materializeFileSecrets(agentDir, { ...process.env, HOME: agentDir }).env;\n  // Caches go to the sandbox user's own home, not to HOME: the Claude CLI's\n  // logs, fontconfig, Mesa and gstreamer all follow XDG_CACHE_HOME, and under\n  // agents/<name>/.cache they were copied back after every step \u2014 3,855 files\n  // across 179 agent folders on the box by 17 Oct 2026, read by nothing.\n  env.XDG_CACHE_HOME = \"/home/agent/.cache\";\n\n  // The declared runtime, built in here \u2014 pip and npm have the network, which\n  // the host side may not. It lands in .foldrun/runner/.runtimes, which the\n  // executors mount from a per-tenant directory (run-container.ts#RUNTIME_CACHE):\n  // the first step for a given fingerprint installs, every later one finds\n  // .ready and skips. With no mount it still works, just fresh every time \u2014\n  // which is what this used to be unconditionally. The log says which happened.\n  const runtime = input.runtime\n    ? prepareRuntime(\"runner\", input.runtime)\n    : { interpreters: {}, env: {}, log: [], error: null };\n  for (const line of runtime.log) emit(\"info\", \"runtime: \" + line);\n  if (runtime.error) emit(\"error\", \"runtime: \" + runtime.error);\n  // The step's own environment gets it too, not only the script tools: an\n  // agent that runs \"python3 x.py\" or a shebang script through Bash should\n  // meet the packages its runtime declared, not the image's bare python.\n  Object.assign(env, runtime.env);\n\n  // install: what the agent finds it needs mid-step. apt goes through the\n  // root start-up's helper (install-helper.ts); pip and npm land in a\n  // directory of this container's own, on the paths from the first turn.\n  const { buildInstallTool, INSTALL_TOOL } = await import(\"@foldrun/core/install-tool\");\n  const { stepInstallEnv, INSTALL_SOCKET } = await import(\"@foldrun/core/runtime\");\n  const installDir = \"/home/agent/.foldrun/step\";\n  const installing = (input.allowed ?? []).includes(INSTALL_TOOL);\n  if (installing) Object.assign(env, stepInstallEnv(installDir, env));\n  const install = installing\n    ? buildInstallTool({\n        dir: installDir,\n        socket: env.FOLDRUN_INSTALL_SOCKET || INSTALL_SOCKET,\n        cacheRoot: \"/home/agent/.foldrun/runner/.runtimes\",\n        python: env.VIRTUAL_ENV ? env.VIRTUAL_ENV + \"/bin/python\" : \"python3\",\n        env,\n        emit,\n      })\n    : { server: null };\n\n  // API and script tools, rebuilt in here from their specs. Secrets were\n  // substituted into API headers before the input crossed the boundary, so\n  // buildApiTools gets an already-resolved environment. verify: gets the\n  // container's own environment, whole: it is the boundary, assembled on\n  // the host from an allowlist, and the declared secrets are in it.\n  // A long result is kept in a file only when the agent can read it back.\n  // (tool-output.ts canReadBack, inlined: the driver imports core by subpath.)\n  const keepIn = { dir: agentDir, readable: () => (input.allowed ?? []).some((t) => t === \"Read\" || t === \"Grep\") };\n  // A declared secret named like a model variable crosses as\n  // FOLDRUN_DECLARED_<NAME> (runner.ts, FOL-19): the model keeps its own\n  // settings, and the agent's API and script tools and verify: get the value\n  // back under the name it declared. Built here, after the runtime and any\n  // mid-step install have added their paths to env.\n  const toolEnv = { ...env };\n  for (const [k, v] of Object.entries(env)) if (k.startsWith(\"FOLDRUN_DECLARED_\")) toolEnv[k.slice(\"FOLDRUN_DECLARED_\".length)] = v;\n  const api = buildApiTools(\"\", input.apis, undefined, { env: toolEnv, missing: [] }, keepIn);\n  const script = buildScriptTools(\n    agentDir,\n    input.scripts,\n    toolEnv,\n    \"/library/scripts\",\n    runtime.interpreters,\n    null,\n    keepIn.readable,\n  );\n  // The translator, when the provider speaks Chat Completions: a loopback\n  // server for the length of this step. Its env replaces the endpoint the\n  // host assembled; the provider's real URL and key stay inside it.\n  const translator = input.translator ? await startTranslator(input.translator) : null;\n  if (translator) {\n    Object.assign(env, translator.env);\n    emit(\"info\", \"translator: listening on \" + translator.baseUrl + \" for \" + (input.translator.label ?? input.translator.upstreamBase));\n  }\n  const consult = buildConsultTools(input.consults ?? [], env, emit);\n  // The platform's own two groups, rebuilt from values like everything else.\n  const search = buildSearchTools(input.search ?? []);\n  const history = input.history?.length ? buildHistoryTools(input.history) : { server: null };\n  const desks = input.desks?.length ? buildDeskTools(input.desks) : { server: null };\n  // A person in the loop, over the proxy this step's lease already names:\n  // ask_person when tools: [ask], and the run's inbox after every tool call.\n  const channel = httpChannel(env.FOLDRUN_EGRESS);\n  const ask = input.ask ? buildAskTool({ channel, timeoutSec: input.ask.timeoutSec, emit }) : { server: null };\n  const peers = input.peers ? buildPeerTools({ channel, self: input.peers.self, siblings: input.peers.siblings, emit }) : { server: null };\n  const inbox = channel ? inboxReader(channel, emit) : undefined;\n  // sandbox: own sub-agents: a tool each, whose job runs in its own sandbox\n  // on the worker, reached over the same proxy door.\n  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec }) : { server: null };\n\n  // Keyless cloud identities (FOLDRUN_IDENTITIES): each token file kept\n  // fresh through the proxy's /identity door, which mints only what this\n  // step's lease was granted. Fetched before the step starts, renewed five\n  // minutes before it expires (with jitter); a failure is said and retried.\n  // Plain JS: this text is the driver, not TypeScript.\n  const identityNames = (env.FOLDRUN_IDENTITIES || \"\").split(\",\").filter(Boolean);\n  if (identityNames.length) {\n    // No backslashes: this sits inside a template literal, which eats them.\n    const ep = new RegExp(\"^(https?://[^/]+)/e/([A-Za-z0-9_-]{16,})/?$\").exec(env.FOLDRUN_EGRESS || \"\");\n    const dir = env.FOLDRUN_IDENTITY_DIR || \"/tmp/foldrun-identity\";\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    const keepFresh = async (name) => {\n      let wait = 30000;\n      try {\n        if (!ep) throw new Error(\"no egress proxy to ask\");\n        const res = await fetch(ep[1] + \"/identity/\" + ep[2] + \"/\" + name, { signal: AbortSignal.timeout(15000) });\n        const body = await res.json().catch(() => ({}));\n        if (!res.ok || !body.token) throw new Error((body.error && body.error.message) || (\"proxy answered \" + res.status));\n        const file = dir + \"/\" + name.toLowerCase() + \".jwt\";\n        fs.writeFileSync(file + \".tmp\", body.token, { mode: 0o600 });\n        fs.renameSync(file + \".tmp\", file);\n        wait = Math.max(30000, body.expiresAt - Date.now() - 300000 + Math.floor(Math.random() * 60000) - 30000);\n      } catch (err) {\n        emit(\"error\", \"identity \" + name + \": \" + (err && err.message ? err.message : String(err)) + \" \u2014 trying again in 30s\");\n      }\n      setTimeout(() => { void keepFresh(name); }, wait).unref();\n    };\n    await Promise.all(identityNames.map(keepFresh));\n  }\n\n  mark(\"tools\");\n  const outcome = await executeStep({\n    agentDir,\n    workspaceRoot: \"/workspace\",\n    libraryRoot: \"/library\",\n    prompt: input.prompt,\n    model: input.model,\n    effort: input.effort ?? null,\n    systemPrompt: input.systemPrompt,\n    allowed: input.allowed,\n    mcpNames: input.mcpNames,\n    mcpServers: {\n      ...(api.server ? { foldrun_apis: api.server } : {}),\n      ...(script.server ? { foldrun_scripts: script.server } : {}),\n      ...(consult.server ? { foldrun_agents: consult.server } : {}),\n      ...(search.server ? { foldrun_search: search.server } : {}),\n      ...(history.server ? { foldrun_history: history.server } : {}),\n      ...(desks.server ? { foldrun_desks: desks.server } : {}),\n      ...(ask.server ? { foldrun_ask: ask.server } : {}),\n      ...(peers.server ? { foldrun_peers: peers.server } : {}),\n      ...(delegate.server ? { foldrun_delegate: delegate.server } : {}),\n      ...(install.server ? { foldrun_install: install.server } : {}),\n      ...input.mcpServers,\n    },\n    ...(inbox ? { inbox } : {}),\n    ...(input.subagents?.length ? { subagents: input.subagents } : {}),\n    env,\n    timeoutSec: input.timeoutSec,\n    budgetUsd: input.budgetUsd,\n    budgetNote: input.budgetNote,\n    price: input.price,\n    verify: input.verify,\n    verifyEnv: toolEnv,\n    ...(typeof input.judgeModel === \"string\" ? { judgeModel: input.judgeModel } : {}),\n    ...(typeof input.judgeEffort === \"string\" ? { judgeEffort: input.judgeEffort } : {}),\n    output: input.output,\n    schema: input.schema,\n    maxTurns: input.maxTurns,\n    ...(input.capture === \"metadata\" || input.capture === \"full\" ? { capture: input.capture } : {}),\n    ...(input.limits && Object.keys(input.limits).length ? { limits: input.limits, toolOwners: input.toolOwners ?? {} } : {}),\n    ...(input.hookNames?.length ? { hookNames: input.hookNames, hookBase: input.hookBase ?? {} } : {}),\n    // Slim browsing: the platform put this step on the slim image to browse\n    // through the account's pod, and named the file the web tool logs its\n    // reconnects to. A lost pod stops the step; what it wrote decides what\n    // the runner does next (browser-pod.ts).\n    ...(env.FOLDRUN_BROWSER_POD_EVENTS ? { browserPod: { events: env.FOLDRUN_BROWSER_POD_EVENTS, methods: api.methods ?? {}, paidWeb: paidWebActions(env), ...(env.FOLDRUN_BROWSER_INIT ? { browseInit: env.FOLDRUN_BROWSER_INIT } : {}) } } : {}),\n    // The container is the boundary; the SDK's own bash sandbox here would\n    // only block declared network use (SSH, curl) for no added safety.\n    sandboxBash: false,\n    emit,\n  });\n  for (const line of api.drainLog()) emit(\"info\", \"api: \" + line);\n  for (const line of script.drainLog()) emit(\"info\", \"script: \" + line);\n  if (translator) {\n    for (const line of translator.drainLog()) emit(\"info\", line.startsWith(\"translator\") ? line : \"translator: \" + line);\n    await translator.close();\n  }\n  // A consult's spend belongs to the step that asked.\n  const consultCost = consult.drainCost();\n  if (consultCost > 0) outcome.costUsd = (outcome.costUsd ?? 0) + consultCost;\n  if (consultCost > 0 && typeof outcome.turnsCostUsd === \"number\") outcome.turnsCostUsd += consultCost;\n  process.stdout.write(JSON.stringify({ e: \"done\", ...outcome, res: readActuals() }) + \"\\n\");\n  process.exit(0);\n} catch (err) {\n  emit(\"error\", err instanceof Error ? err.message : String(err));\n  // The failure path reports actuals too \u2014 a step that died eleven minutes\n  // in still held its slice for eleven minutes, and the failed runs are\n  // exactly the ones whose resource story gets read.\n  let res = null;\n  try { res = readActuals(); } catch { /* the reading must never mask the error */ }\n  process.stdout.write(JSON.stringify({ e: \"done\", status: \"failed\", result: null, costUsd: null, res }) + \"\\n\");\n  process.exit(0);\n}\n";
 /** The uv release copied into the image. Pinned: a floating uv is a floating
  *  resolver, and the runtime cache is keyed on the declaration, not on it. */
 export declare const UV_VERSION = "0.11.25";