@foldrun/core 2.6.0 → 2.8.0

package/dist/src/run-container.js

@@ -477,6 +477,7 @@ try {
   const { buildConsultTools } = await import("@foldrun/core/agent-tools");
   const { buildSearchTools, buildHistoryTools, buildDeskTools } = await import("@foldrun/core/context-tools");
   const { httpChannel, buildAskTool, buildPeerTools, inboxReader } = await import("@foldrun/core/operator");
+  const { buildDelegateTools } = await import("@foldrun/core/delegate-tools");
   const { startTranslator } = await import("@foldrun/core/translator");
   const { prepareRuntime } = await import("@foldrun/core/runtime");
   const { materializeFileSecrets } = await import("@foldrun/core/secret-files");
@@ -576,6 +577,39 @@ try {
   const ask = input.ask ? buildAskTool({ channel, timeoutSec: input.ask.timeoutSec, emit }) : { server: null };
   const peers = input.peers ? buildPeerTools({ channel, self: input.peers.self, siblings: input.peers.siblings, emit }) : { server: null };
   const inbox = channel ? inboxReader(channel, emit) : undefined;
+  // sandbox: own sub-agents: a tool each, whose job runs in its own sandbox
+  // on the worker, reached over the same proxy door.
+  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec }) : { server: null };
+
+  // Keyless cloud identities (FOLDRUN_IDENTITIES): each token file kept
+  // fresh through the proxy's /identity door, which mints only what this
+  // step's lease was granted. Fetched before the step starts, renewed five
+  // minutes before it expires (with jitter); a failure is said and retried.
+  // Plain JS: this text is the driver, not TypeScript.
+  const identityNames = (env.FOLDRUN_IDENTITIES || "").split(",").filter(Boolean);
+  if (identityNames.length) {
+    // No backslashes: this sits inside a template literal, which eats them.
+    const ep = new RegExp("^(https?://[^/]+)/e/([A-Za-z0-9_-]{16,})/?$").exec(env.FOLDRUN_EGRESS || "");
+    const dir = env.FOLDRUN_IDENTITY_DIR || "/tmp/foldrun-identity";
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const keepFresh = async (name) => {
+      let wait = 30000;
+      try {
+        if (!ep) throw new Error("no egress proxy to ask");
+        const res = await fetch(ep[1] + "/identity/" + ep[2] + "/" + name, { signal: AbortSignal.timeout(15000) });
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok || !body.token) throw new Error((body.error && body.error.message) || ("proxy answered " + res.status));
+        const file = dir + "/" + name.toLowerCase() + ".jwt";
+        fs.writeFileSync(file + ".tmp", body.token, { mode: 0o600 });
+        fs.renameSync(file + ".tmp", file);
+        wait = Math.max(30000, body.expiresAt - Date.now() - 300000 + Math.floor(Math.random() * 60000) - 30000);
+      } catch (err) {
+        emit("error", "identity " + name + ": " + (err && err.message ? err.message : String(err)) + " — trying again in 30s");
+      }
+      setTimeout(() => { void keepFresh(name); }, wait).unref();
+    };
+    await Promise.all(identityNames.map(keepFresh));
+  }
 
   mark("tools");
   const outcome = await executeStep({
@@ -597,6 +631,7 @@ try {
       ...(desks.server ? { foldrun_desks: desks.server } : {}),
       ...(ask.server ? { foldrun_ask: ask.server } : {}),
       ...(peers.server ? { foldrun_peers: peers.server } : {}),
+      ...(delegate.server ? { foldrun_delegate: delegate.server } : {}),
       ...(install.server ? { foldrun_install: install.server } : {}),
       ...input.mcpServers,
     },
@@ -1457,8 +1492,9 @@ export async function runStepInContainer(args) {
         const wsOut = path.join(staging, "out");
         fs.mkdirSync(wsOut);
         const back = spawnSync(cli(), ["cp", `${containerId}:/workspace/.`, wsOut], { encoding: "utf8" });
+        let applied = [];
         if (back.status === 0) {
-            applyContainerChanges(args.workspaceRoot, wsOut, wsIn, (m) => args.emit("error", m), args.divert);
+            applied = applyContainerChanges(args.workspaceRoot, wsOut, wsIn, (m) => args.emit("error", m), args.divert);
         }
         else {
             args.emit("error", `copy-out failed — the step's file changes were lost:\n${back.stderr.slice(0, 500)}`);
@@ -1472,7 +1508,7 @@ export async function runStepInContainer(args) {
             phases,
         };
         args.emit("info", timingLine(timing));
-        return { ...outcome, timing };
+        return { ...outcome, timing, applied };
     }
     finally {
         if (containerId)

package/dist/src/runner.d.ts

@@ -1,4 +1,4 @@
-import { type SubagentSpec } from "./subagents.ts";
+import { type DelegateSpec, type SubagentSpec } from "./subagents.ts";
 import { type FlowStep, type RunRecord, type StepRecord } from "./store.ts";
 import { type Catalog } from "./catalog.ts";
 import { type SearchRoot, type RunDigest } from "./context-tools.ts";
@@ -189,6 +189,26 @@ export declare function buildSubagentSpecs(o: {
     parentAllowed: string[];
     push: (type: "info" | "error", text: string) => void;
 }): SubagentSpec[];
+/**
+ * The `sandbox: own` sub-agents a step may hand jobs to: a name and a
+ * description each, all the parent's sandbox needs. What they may hold is
+ * read from their own file when a job arrives — never cut to the parent's,
+ * and never seen by it. `canRun` is false where nothing can start their
+ * sandbox (a sub-agent's own step: depth one; a step outside a run).
+ */
+export declare function buildDelegateSpecs(o: {
+    names: unknown;
+    self: string;
+    workspaceRoot: string;
+    canRun: boolean;
+    push: (type: "info" | "error", text: string) => void;
+    /** Told, per offered sub-agent, whether a tool it holds acts outside the
+     *  workspace — a delegating step whose job may have sent something must
+     *  not be re-run as if it had only read (launchStep's retry policy). */
+    outward?: (name: string, outward: boolean) => void;
+    tenant?: string;
+    tags?: string[];
+}): DelegateSpec[];
 export declare function sharedInstructions(agentDir: string, tenant: string): string | null;
 /**
  * Which of an agent's in-scope skills load for this run.