@foldrun/core 2.7.0 → 2.9.0

package/dist/src/run-container.js

@@ -477,6 +477,7 @@ try {
   const { buildConsultTools } = await import("@foldrun/core/agent-tools");
   const { buildSearchTools, buildHistoryTools, buildDeskTools } = await import("@foldrun/core/context-tools");
   const { httpChannel, buildAskTool, buildPeerTools, inboxReader } = await import("@foldrun/core/operator");
+  const { buildDelegateTools } = await import("@foldrun/core/delegate-tools");
   const { startTranslator } = await import("@foldrun/core/translator");
   const { prepareRuntime } = await import("@foldrun/core/runtime");
   const { materializeFileSecrets } = await import("@foldrun/core/secret-files");
@@ -576,6 +577,9 @@ try {
   const ask = input.ask ? buildAskTool({ channel, timeoutSec: input.ask.timeoutSec, emit }) : { server: null };
   const peers = input.peers ? buildPeerTools({ channel, self: input.peers.self, siblings: input.peers.siblings, emit }) : { server: null };
   const inbox = channel ? inboxReader(channel, emit) : undefined;
+  // sandbox: own sub-agents: a tool each, whose job runs in its own sandbox
+  // on the worker, reached over the same proxy door.
+  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec }) : { server: null };
 
   // Keyless cloud identities (FOLDRUN_IDENTITIES): each token file kept
   // fresh through the proxy's /identity door, which mints only what this
@@ -627,6 +631,7 @@ try {
       ...(desks.server ? { foldrun_desks: desks.server } : {}),
       ...(ask.server ? { foldrun_ask: ask.server } : {}),
       ...(peers.server ? { foldrun_peers: peers.server } : {}),
+      ...(delegate.server ? { foldrun_delegate: delegate.server } : {}),
       ...(install.server ? { foldrun_install: install.server } : {}),
       ...input.mcpServers,
     },
@@ -737,8 +742,11 @@ export const RETRY_SH = `retry() { what=$1; shift; n=1; until "$@"; do if [ "$n"
  *  and make one browse call per engine on the full image:
  *    docker buildx imagetools inspect node:22-trixie-slim --format '{{json .Manifest}}' | jq -r .digest
  *  The digest names the multi-arch index, so the one pin serves amd64 and
- *  arm64 alike. */
-export const NODE_BASE = "node:22-trixie-slim@sha256:b26b04c123d9ff8ab646ceb18b9d75a1173acf64b9a401094b906d27b29338d4";
+ *  arm64 alike.
+ *
+ *  23 Oct 2026: Node 22.23.4 (the 21 Oct security release: Brotli decoder
+ *  RCE, TLS hostname bypasses); the pin before carried 22.23.3. */
+export const NODE_BASE = "node:22-trixie-slim@sha256:8eb619e402eaede1748a3c8173bffab391592812e85136452f781741c7242ddf";
 // Two images from one file, as build targets.
 //
 //   full  (the default, the last stage) — everything, browsers included. The
@@ -1487,8 +1495,9 @@ export async function runStepInContainer(args) {
         const wsOut = path.join(staging, "out");
         fs.mkdirSync(wsOut);
         const back = spawnSync(cli(), ["cp", `${containerId}:/workspace/.`, wsOut], { encoding: "utf8" });
+        let applied = [];
         if (back.status === 0) {
-            applyContainerChanges(args.workspaceRoot, wsOut, wsIn, (m) => args.emit("error", m), args.divert);
+            applied = applyContainerChanges(args.workspaceRoot, wsOut, wsIn, (m) => args.emit("error", m), args.divert);
         }
         else {
             args.emit("error", `copy-out failed — the step's file changes were lost:\n${back.stderr.slice(0, 500)}`);
@@ -1502,7 +1511,7 @@ export async function runStepInContainer(args) {
             phases,
         };
         args.emit("info", timingLine(timing));
-        return { ...outcome, timing };
+        return { ...outcome, timing, applied };
     }
     finally {
         if (containerId)

package/dist/src/runner.d.ts

@@ -1,4 +1,4 @@
-import { type SubagentSpec } from "./subagents.ts";
+import { type DelegateSpec, type SubagentSpec } from "./subagents.ts";
 import { type FlowStep, type RunRecord, type StepRecord } from "./store.ts";
 import { type Catalog } from "./catalog.ts";
 import { type SearchRoot, type RunDigest } from "./context-tools.ts";
@@ -189,6 +189,26 @@ export declare function buildSubagentSpecs(o: {
     parentAllowed: string[];
     push: (type: "info" | "error", text: string) => void;
 }): SubagentSpec[];
+/**
+ * The `sandbox: own` sub-agents a step may hand jobs to: a name and a
+ * description each, all the parent's sandbox needs. What they may hold is
+ * read from their own file when a job arrives — never cut to the parent's,
+ * and never seen by it. `canRun` is false where nothing can start their
+ * sandbox (a sub-agent's own step: depth one; a step outside a run).
+ */
+export declare function buildDelegateSpecs(o: {
+    names: unknown;
+    self: string;
+    workspaceRoot: string;
+    canRun: boolean;
+    push: (type: "info" | "error", text: string) => void;
+    /** Told, per offered sub-agent, whether a tool it holds acts outside the
+     *  workspace — a delegating step whose job may have sent something must
+     *  not be re-run as if it had only read (launchStep's retry policy). */
+    outward?: (name: string, outward: boolean) => void;
+    tenant?: string;
+    tags?: string[];
+}): DelegateSpec[];
 export declare function sharedInstructions(agentDir: string, tenant: string): string | null;
 /**
  * Which of an agent's in-scope skills load for this run.
@@ -474,6 +494,11 @@ export declare function actedThenFailedCheck(events: {
  * happened to create it.
  */
 export declare function copyTreeBytes(from: string, to: string): void;
+/** Whether two agents of one workspace call the same model supply: each
+ *  resolved the way agentContext does — its own provider: block, else the
+ *  workspace's — and compared in a stable key order. The account key is
+ *  shared by both, so two that resolve to no block share it (Codex review). */
+export declare function sameSupply(workspaceDir: string, tenant: string, a: string, b: string): boolean;
 /** A refusal of the credential itself, in any of the wordings Claude Code
  *  has used. "Failed to authenticate: OAuth token revoked" (9 Oct 2026, a
  *  step started one second before the 09:07:52Z refresh) matched none of the