@foldrun/core 2.8.0 → 2.10.0

package/dist/src/runner.d.ts

@@ -494,6 +494,11 @@ export declare function actedThenFailedCheck(events: {
  * happened to create it.
  */
 export declare function copyTreeBytes(from: string, to: string): void;
+/** Whether two agents of one workspace call the same model supply: each
+ *  resolved the way agentContext does — its own provider: block, else the
+ *  workspace's — and compared in a stable key order. The account key is
+ *  shared by both, so two that resolve to no block share it (Codex review). */
+export declare function sameSupply(workspaceDir: string, tenant: string, a: string, b: string): boolean;
 /** A refusal of the credential itself, in any of the wordings Claude Code
  *  has used. "Failed to authenticate: OAuth token revoked" (9 Oct 2026, a
  *  step started one second before the 09:07:52Z refresh) matched none of the

package/dist/src/runner.js

@@ -4,7 +4,7 @@
 // flow, so there is a single execution path.
 import { latestRevisionId } from "./history.js";
 import { recordCallIo, redactionsFor } from "./capture.js";
-import { AUTH_REFUSAL } from "./issues.js";
+import { AUTH_REFUSAL, platformCause } from "./issues.js";
 import { hookNames } from "./hooks.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
@@ -34,7 +34,7 @@ const isolatedRun = () => {
 };
 import { gatherConsults, buildConsultTools } from "./agent-tools.js";
 import { DELEGATE_TOOL, gatherSubagents, ownSandbox, subagentPrompt, subagentTools } from "./subagents.js";
-import { DELEGATE_SERVER, buildDelegateTools, delegatePromptLine, delegateToolNames, localDelegateChannel } from "./delegate-tools.js";
+import { DELEGATE_SERVER, buildDelegateTools, delegatePromptLine, delegateToolNames, localDelegateChannel, readCopyBack } from "./delegate-tools.js";
 import { ASK_TOOL, PEER_TOOLS, applyOperatorEvent, askPromptLine, askTimeoutSec, buildAskTool, buildPeerTools, inboxReader, localPeerBus, peersPromptLine } from "./operator.js";
 import { sendPlainNotification } from "./notify.js";
 import { TOOL_MAP, BUILTIN_TOOLS, ownToolNames, toolRefs, legacyUseNames, legacyUseError, retiredToolNames, retiredToolError } from "./tool-names.js";
@@ -3510,6 +3510,34 @@ function platformFallbackEnv() {
  */
 const CREDENTIAL_ROTATION_WAIT_MS = 90_000;
 const CREDENTIAL_POLL_MS = 2_000;
+/** Platform causes a rescuer on the same model supply cannot get past. */
+const SAME_SUPPLY_WALLS = new Set(["model-cap", "model-auth"]);
+/** Whether two agents of one workspace call the same model supply: each
+ *  resolved the way agentContext does — its own provider: block, else the
+ *  workspace's — and compared in a stable key order. The account key is
+ *  shared by both, so two that resolve to no block share it (Codex review). */
+export function sameSupply(workspaceDir, tenant, a, b) {
+    const supplyOf = (agent) => {
+        const agentDir = path.join(workspaceDir, "agents", agent);
+        let own;
+        try {
+            own = matter(fs.readFileSync(path.join(agentDir, "agent.md"), "utf8")).data.provider;
+        }
+        catch {
+            own = undefined;
+        }
+        return stableJson(own ?? workspaceFrontmatter(agentDir, tenant).provider ?? null);
+    };
+    return supplyOf(a) === supplyOf(b);
+}
+function stableJson(v) {
+    if (Array.isArray(v))
+        return `[${v.map(stableJson).join(",")}]`;
+    if (v && typeof v === "object") {
+        return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${stableJson(v[k])}`).join(",")}}`;
+    }
+    return JSON.stringify(v) ?? "null";
+}
 /** A refusal of the credential itself, in any of the wordings Claude Code
  *  has used. "Failed to authenticate: OAuth token revoked" (9 Oct 2026, a
  *  step started one second before the 09:07:52Z refresh) matched none of the
@@ -4847,10 +4875,15 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                     entry.ms = Date.now() - started;
                     save();
                     const errors = child.events.filter((e) => e.type === "error").map((e) => e.text).join("\n");
+                    // Its files go back with the reply, so the delegating step's
+                    // sandbox has them too (delegate-tools.ts copyBackFiles).
+                    const back = readCopyBack(pDir, child.wrote ?? []);
                     return {
                         status,
                         result: child.result ?? (errors || "(no reply)"),
                         wrote: child.wrote ?? [],
+                        files: back.files,
+                        filesOmitted: back.omitted,
                     };
                 };
                 // An agent's own `budget:` — the most it may spend in one run — is
@@ -5017,6 +5050,19 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                         save();
                         if (run.stopRequested)
                             break;
+                        // A spent usage window resets in hours or days, never within
+                        // the retry waits below: another attempt is refused the same
+                        // way (abandon-desk's collector ran twice on 23 Oct 2026).
+                        const lastError = [...step.events].reverse().find((e) => e.type === "error")?.text;
+                        if (platformCause(lastError)?.key === "model-cap") {
+                            step.events.push({
+                                t: new Date().toISOString(),
+                                type: "info",
+                                text: `not retried — the model usage cap is reached and will not reset within a retry's wait (${attempts - attempt} left unused)`,
+                            });
+                            save();
+                            break;
+                        }
                         // The retry policy. An attempt the cluster ended for want of
                         // memory or disk is retried one size class up — the same
                         // size would end the same way. Every retry waits: 15 s, 30 s,
@@ -5087,6 +5133,21 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                         });
                         return;
                     }
+                    // A rescuer on the same model supply hits the same wall. On 23 Oct
+                    // 2026 every desk's fixer started after a spent weekly window, was
+                    // refused the same way, and the issue read "fixer also failed"
+                    // instead of the cap. A rescuer on a different supply still tries.
+                    const lastError = [...step.events].reverse().find((e) => e.type === "error")?.text;
+                    const wall = platformCause(lastError);
+                    if (wall && SAME_SUPPLY_WALLS.has(wall.key) && sameSupply(pDir, tenant, step.agent, step.onFail)) {
+                        step.events.push({
+                            t: new Date().toISOString(),
+                            type: "info",
+                            text: `not handing to [[${step.onFail}]] (on-fail): ${wall.label.toLowerCase()}, and it runs on the same model supply`,
+                        });
+                        save();
+                        return;
+                    }
                     // One rescue per failure, across drives. A worker that died
                     // mid-rescue left an unfinished record behind it; the drive that
                     // resumes picks that one up instead of splicing another — a crash

package/dist/src/scan.js

@@ -662,7 +662,7 @@ function scanAgents(agents, outward, toolDefs, push, networks) {
             const extra = refNames(sub.data.tools).filter((t) => !tools.includes(t));
             if (sub.data.sandbox === "own") {
                 if (extra.length) {
-                    push("security/subagent-own-sandbox", a.file, keyLine(a.lines, "subagents"), `subagent ${s} own ${extra.join(",")}`, `subagents: [${s}] — ${s} runs in its own sandbox with ${extra.join(", ")}, which ${a.name} does not have; only its reply comes back`);
+                    push("security/subagent-own-sandbox", a.file, keyLine(a.lines, "subagents"), `subagent ${s} own ${extra.join(",")}`, `subagents: [${s}] — ${s} runs in its own sandbox with ${extra.join(", ")}, which ${a.name} does not have; only its reply and the files it wrote come back`);
                 }
                 continue;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldrun/core",
-  "version": "2.8.0",
+  "version": "2.10.0",
   "description": "Agents are just folders. The format, the runner, the checks.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/src/delegate-tools.ts

@@ -14,9 +14,12 @@
 // one door it has (the egress proxy, at its lease — operator.ts), and the
 // worker runs the job as a step of its own: its own pod, its own `tools:`,
 // `secrets:` and `network:` from its own file, NOT cut to the parent's — the
-// parent may hold less. The parent waits and gets the reply text, nothing
-// else. What the sub-agent wrote reaches the workspace when it finishes, so
-// the next step sees it; the reply names the paths.
+// parent may hold less. The parent waits and gets the reply text. What the
+// sub-agent wrote reaches the workspace when it finishes, and comes back with
+// the reply into the parent's sandbox too (copyBackFiles), so the parent's
+// model and its `verify:` see it there: a `verify: file:` on the delegating
+// step used to fail on a file the job had written (owner, 23 Oct 2026). What
+// is too large to send back still reaches the workspace for the next step.
 //
 // Depth one, as for every sub-agent: the job's own `subagents:` are not
 // offered to it. Its record sits in the run after the parent's, marked
@@ -25,6 +28,9 @@
 // With no channel (a container step on an install without a proxy) the tools
 // are not granted at all; the runner says so on the step.
 
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
 import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
 import { z } from "zod";
 import type { DelegationResult, OperatorChannel } from "./operator.ts";
@@ -37,6 +43,193 @@ export const JOB_MAX = 20_000;
 /** What comes back is cut here: the reply is the parent's context. */
 export const REPLY_MAX = 40_000;
 
+/** What one job's files may add up to when copied back into the parent's
+ *  sandbox, and the most files. They travel with the reply through the
+ *  operator store, so the cap is on the raw bytes before base64. */
+export const COPY_BACK_MAX_BYTES = 4 * 1024 * 1024;
+export const COPY_BACK_MAX_FILES = 100;
+
+/** A workspace-relative path that stays inside the workspace. */
+function insideRel(rel: string): string | null {
+  const norm = path.posix.normalize(String(rel).replaceAll("\\", "/"));
+  if (!norm || norm === "." || norm.startsWith("../") || norm === ".." || path.posix.isAbsolute(norm)) return null;
+  return norm;
+}
+
+/** Read what a job wrote, on the host, for the trip back to the parent's
+ *  sandbox: files only (no links), confined to the workspace, until the cap.
+ *  What does not fit is named, never cut. */
+export function readCopyBack(workspaceDir: string, wrote: string[]): { files: { path: string; base64: string }[]; omitted: string[] } {
+  const files: { path: string; base64: string }[] = [];
+  const omitted: string[] = [];
+  let total = 0;
+  const root = path.resolve(workspaceDir);
+  let realRoot: string;
+  try {
+    realRoot = fs.realpathSync(root);
+  } catch {
+    return { files, omitted };
+  }
+  for (const w of [...new Set(wrote)]) {
+    const rel = insideRel(w);
+    if (!rel) continue;
+    const abs = path.join(root, rel);
+    let st: fs.Stats;
+    try {
+      st = fs.lstatSync(abs);
+      // A directory link on the way must not lead out of the workspace:
+      // what is read here goes into another sandbox (Codex review).
+      const real = fs.realpathSync(abs);
+      if (real !== realRoot && !real.startsWith(realRoot + path.sep)) continue;
+    } catch {
+      continue; // written then removed by the job
+    }
+    if (!st.isFile()) continue;
+    if (files.length >= COPY_BACK_MAX_FILES || total + st.size > COPY_BACK_MAX_BYTES) {
+      omitted.push(rel);
+      continue;
+    }
+    const buf = fs.readFileSync(abs);
+    total += buf.length;
+    files.push({ path: rel, base64: buf.toString("base64") });
+  }
+  return { files, omitted };
+}
+
+/** Where a sandbox notes what was copied back into it: path → sha256 of the
+ *  bytes written. The step's copy-out reads it (run-container.ts
+ *  applyContainerChanges) as what those files held before the step touched
+ *  them, so a job's change already on the workspace is not applied twice.
+ *  Under .foldrun/, which is never copied back as content. */
+export const COPY_BACK_MANIFEST = ".foldrun/copied-back.json";
+
+const sha256 = (b: Buffer) => crypto.createHash("sha256").update(b).digest("hex");
+
+const exists = (p: string) => {
+  try {
+    fs.lstatSync(p);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+/** The manifest's folder and file, unless either is something other than a
+ *  real directory and file — a link planted there is never followed. */
+function manifestPath(root: string): string | null {
+  const dir = path.join(root, path.dirname(COPY_BACK_MANIFEST));
+  const file = path.join(root, COPY_BACK_MANIFEST);
+  try {
+    if (!fs.lstatSync(dir).isDirectory()) return null;
+  } catch {
+    return file; // neither exists yet
+  }
+  try {
+    if (!fs.lstatSync(file).isFile()) return null;
+  } catch {
+    /* new file */
+  }
+  return file;
+}
+
+function writeManifest(root: string, manifest: Record<string, string>): void {
+  const file = manifestPath(root);
+  if (!file) return;
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(manifest), { flag: "w" });
+}
+
+/** The manifest of a sandbox's workspace, or {}. */
+export function readCopyBackManifest(workspaceRoot: string): Record<string, string> {
+  const file = manifestPath(path.resolve(workspaceRoot));
+  if (!file) return {};
+  try {
+    const m = JSON.parse(fs.readFileSync(file, "utf8"));
+    return m && typeof m === "object" && !Array.isArray(m) ? (m as Record<string, string>) : {};
+  } catch {
+    return {};
+  }
+}
+
+/** Write a job's files into this sandbox's workspace. A path that would leave
+ *  it, or land through a link, is refused. A file the step itself changed
+ *  since `since` (its own edit, not one copied back) is not overwritten: the
+ *  job's version goes beside it as `<name>.from-<agent><ext>`. */
+export function copyBackFiles(
+  workspaceRoot: string,
+  files: { path: string; base64: string }[],
+  opts: { since?: number; from?: string } = {},
+): { copied: string[]; conflicts: { path: string; copy: string }[] } {
+  const root = path.resolve(workspaceRoot);
+  const manifest = readCopyBackManifest(root);
+  const copied: string[] = [];
+  const conflicts: { path: string; copy: string }[] = [];
+  // Every directory on the way must be a real one inside the workspace: a
+  // link the step planted must not carry the write elsewhere.
+  const safeDirs = (abs: string): boolean => {
+    let dir = path.dirname(abs);
+    const chain: string[] = [];
+    while (dir.startsWith(root + path.sep)) {
+      chain.unshift(dir);
+      dir = path.dirname(dir);
+    }
+    for (const d of chain) {
+      try {
+        if (!fs.lstatSync(d).isDirectory()) return false;
+      } catch {
+        fs.mkdirSync(d);
+      }
+    }
+    return true;
+  };
+  for (const f of files) {
+    const rel = insideRel(f.path);
+    if (!rel) continue;
+    let target = rel;
+    let abs = path.join(root, rel);
+    if (!safeDirs(abs)) continue;
+    let st: fs.Stats | null = null;
+    try {
+      st = fs.lstatSync(abs);
+    } catch {
+      /* new file */
+    }
+    if (st && !st.isFile()) continue;
+    const bytes = Buffer.from(f.base64, "base64");
+    if (st) {
+      const now = fs.readFileSync(abs);
+      if (now.equals(bytes)) {
+        manifest[rel] = sha256(bytes);
+        copied.push(rel);
+        continue;
+      }
+      const ours = manifest[rel] === sha256(now);
+      const editedHere = !ours && opts.since !== undefined && st.mtimeMs > opts.since;
+      if (editedHere) {
+        // A name nothing has yet: an earlier conflict copy may be the step's
+        // own work by now (Codex review).
+        const ext = path.posix.extname(rel);
+        const stem = `${rel.slice(0, rel.length - ext.length)}.from-${(opts.from ?? "subagent").replace(/[^A-Za-z0-9_-]/g, "-")}`;
+        for (let n = 1; ; n++) {
+          target = `${stem}${n === 1 ? "" : `-${n}`}${ext}`;
+          abs = path.join(root, target);
+          if (!exists(abs)) break;
+        }
+        // Not in the manifest: this copy is not on the workspace yet, and
+        // the copy-out must carry it there.
+        fs.writeFileSync(abs, bytes);
+        conflicts.push({ path: rel, copy: target });
+        continue;
+      }
+    }
+    fs.writeFileSync(abs, bytes);
+    manifest[rel] = sha256(bytes);
+    copied.push(rel);
+  }
+  if (copied.length || conflicts.length) writeManifest(root, manifest);
+  return { copied, conflicts };
+}
+
 type Emit = (type: "text" | "tool" | "info" | "error", text: string, extra?: EventExtra) => void;
 
 /** The granted names, the same on every path. */
@@ -44,13 +237,23 @@ export function delegateToolNames(specs: DelegateSpec[]): string[] {
   return specs.map((s) => `mcp__${DELEGATE_SERVER}__${delegateToolName(s.name)}`);
 }
 
-/** The reply as the parent reads it: the sub-agent's words, then what it changed. */
-export function replyText(name: string, r: DelegationResult): string {
+/** The reply as the parent reads it: the sub-agent's words, then what it
+ *  changed — `copied` are the paths now in this sandbox too. */
+export function replyText(name: string, r: DelegationResult, copied: string[] = [], conflicts: { path: string; copy: string }[] = []): string {
   const body = r.result.trim() || "(no reply)";
   const cut = body.length > REPLY_MAX ? `${body.slice(0, REPLY_MAX)}\n…(cut at ${REPLY_MAX} characters)` : body;
-  const wrote = r.wrote?.length
-    ? `\n\nFiles ${name} changed (in the workspace from the next step on — not in your sandbox):\n${r.wrote.slice(0, 200).map((w) => `- ${w}`).join("\n")}`
-    : "";
+  const here = new Set([...copied, ...conflicts.map((c) => c.path)]);
+  const elsewhere = (r.wrote ?? []).filter((w) => !here.has(w));
+  const wrote =
+    (copied.length
+      ? `\n\nFiles ${name} changed, copied into your sandbox at the same paths:\n${copied.slice(0, 200).map((w) => `- ${w}`).join("\n")}`
+      : "") +
+    (conflicts.length
+      ? `\n\nFiles you had changed yourself, which ${name} changed too — yours are kept; its version is beside each:\n${conflicts.slice(0, 200).map((c) => `- ${c.path} → ${c.copy}`).join("\n")}`
+      : "") +
+    (elsewhere.length
+      ? `\n\nFiles ${name} changed that are not in your sandbox (too large to copy back — in the workspace from the next step on):\n${elsewhere.slice(0, 200).map((w) => `- ${w}`).join("\n")}`
+      : "");
   const head = r.status === "completed" ? "" : `${name} did not finish (${r.status}). What it said:\n`;
   return head + cut + wrote;
 }
@@ -61,9 +264,14 @@ export function buildDelegateTools(opts: {
   emit: Emit;
   /** The most one job may run; the step's own timeout bounds it anyway. */
   timeoutSec?: number;
+  /** This sandbox's workspace: where a job's files are copied back. Absent
+   *  in-process, where the job wrote the same workspace already. */
+  workspaceRoot?: string;
   now?: () => number;
 }) {
   const now = opts.now ?? Date.now;
+  // Anything in this sandbox newer than this, the step changed itself.
+  const startedAt = Date.now();
   const channel = opts.channel;
   if (!opts.specs.length || !channel?.delegate || !channel.delegation) {
     return { server: null, toolNames: [] as string[], calls: {} as Record<string, (job: string) => Promise<unknown>> };
@@ -90,8 +298,20 @@ export function buildDelegateTools(opts: {
         continue;
       }
       if (got) {
-        opts.emit(got.status === "completed" ? "info" : "error", `${s.name} ${got.status}${got.wrote?.length ? ` — changed ${got.wrote.length} file(s)` : ""}`, { subagent: s.name });
-        return text(replyText(s.name, got), got.status !== "completed");
+        let copied: string[] = [];
+        let conflicts: { path: string; copy: string }[] = [];
+        if (opts.workspaceRoot && got.files?.length) {
+          try {
+            ({ copied, conflicts } = copyBackFiles(opts.workspaceRoot, got.files, { since: startedAt, from: s.name }));
+          } catch (err) {
+            opts.emit("error", `could not copy ${s.name}'s files into this sandbox: ${err instanceof Error ? err.message : String(err)}`, { subagent: s.name });
+          }
+        }
+        const back = copied.length || conflicts.length
+          ? `; ${copied.length} copied into this sandbox${conflicts.length ? `, ${conflicts.length} kept beside the step's own edit` : ""}`
+          : "";
+        opts.emit(got.status === "completed" ? "info" : "error", `${s.name} ${got.status}${got.wrote?.length ? ` — changed ${got.wrote.length} file(s)${back}` : ""}`, { subagent: s.name });
+        return text(replyText(s.name, got, opts.workspaceRoot ? copied : (got.wrote ?? []), conflicts), got.status !== "completed");
       }
     }
     try {
@@ -168,7 +388,7 @@ export function localDelegateChannel(
 export function delegatePromptLine(specs: DelegateSpec[]): string {
   return (
     `<isolated-subagents>\nThese colleagues work in their own sandbox, with their own tools; call the tool to hand one a job ` +
-    `and you get back its reply and the paths of any files it changed:\n` +
+    `and you get back its reply, with the files it changed copied into your sandbox at the same paths:\n` +
     specs.map((s) => `- ${delegateToolName(s.name)}: ${s.description}`).join("\n") +
     `\n</isolated-subagents>`
   );

package/src/issues.ts

@@ -134,7 +134,10 @@ const PLATFORM_CAUSES: (PlatformCause & { test: RegExp })[] = [
     key: "model-cap",
     label: "The model usage cap is reached",
     fix: "runs resume when the cap resets; nothing to change in the desks.",
-    test: /weekly (usage )?limit|usage limit (reached|exceeded)|reached your (weekly|usage) limit/i,
+    // Also the runner's own sentence for a spent subscription window
+    // (refusal.ts explainRefusal): on 23 Oct 2026 "the 7-day window is 100%
+    // used" filed five desks as their own failures.
+    test: /weekly (usage )?limit|usage limit (reached|exceeded)|reached your (weekly|usage) limit|window is (100% used|spent)/i,
   },
   {
     // The provider out of capacity is not the account's cap: it passes in

package/src/operator.ts

@@ -117,6 +117,12 @@ export interface DelegationResult {
   /** Workspace paths it changed. They reach the workspace when it ends, so
    *  the next step sees them; the delegating step's own sandbox does not. */
   wrote?: string[];
+  /** What it wrote, copied back into the delegating step's sandbox, so the
+   *  parent's model and its `verify:` see it there (copyBackFiles), base64. */
+  files?: { path: string; base64: string }[];
+  /** Written paths too large to copy back: they reach the workspace when the
+   *  job ends, so the next step sees them. */
+  filesOmitted?: string[];
 }
 
 export const QUESTION_MAX = 2_000;
@@ -217,6 +223,13 @@ export function httpChannel(egress: string | undefined | null, fetchImpl: typeof
         status,
         result: typeof body.result === "string" ? body.result : "",
         wrote: Array.isArray(body.wrote) ? (body.wrote as unknown[]).filter((w): w is string => typeof w === "string") : [],
+        files: Array.isArray(body.files)
+          ? (body.files as unknown[]).filter(
+              (f): f is { path: string; base64: string } =>
+                !!f && typeof (f as { path?: unknown }).path === "string" && typeof (f as { base64?: unknown }).base64 === "string",
+            )
+          : [],
+        filesOmitted: Array.isArray(body.filesOmitted) ? (body.filesOmitted as unknown[]).filter((w): w is string => typeof w === "string") : [],
       };
     },
     async cancelDelegation(id) {

package/src/run-container.ts

@@ -412,6 +412,24 @@ export function applyContainerChanges(
   divert?: WriteDivert,
 ): string[] {
   const applied: string[] = [];
+  // Files a sandbox: own job's reply copied into this sandbox mid-step
+  // (delegate-tools.ts copyBackFiles), path → sha256 of what was written: for
+  // those, that is what the step started from. The job's change is already on
+  // the workspace; read against the older baseline it came back as the
+  // step's own and was merged in a second time (Codex review, 23 Oct 2026).
+  let imported: Record<string, string> = {};
+  try {
+    // Read here, on the host: a link the step planted is never followed,
+    // the same rule as every file below.
+    const dir = path.join(containerWs, ".foldrun");
+    const file = path.join(dir, "copied-back.json");
+    if (fs.lstatSync(dir).isDirectory() && fs.lstatSync(file).isFile()) {
+      const m = JSON.parse(fs.readFileSync(file, "utf8"));
+      if (m && typeof m === "object" && !Array.isArray(m)) imported = m as Record<string, string>;
+    }
+  } catch {
+    /* none copied back */
+  }
   const walk = (dir: string) => {
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
       const abs = path.join(dir, entry.name);
@@ -438,6 +456,8 @@ export function applyContainerChanges(
       } else if (baseline) {
         was = baseline[rel.replaceAll("\\", "/")] ?? null;
       }
+      const importedSha = imported[rel.replaceAll("\\", "/")];
+      if (typeof importedSha === "string") was = importedSha;
       const same = (b: Buffer) =>
         was === null || was === undefined ? false : typeof was === "string" ? sha(b) === was : b.equals(was);
       // Untouched by this step: whatever the host says now is more current
@@ -735,7 +755,7 @@ try {
   const inbox = channel ? inboxReader(channel, emit) : undefined;
   // sandbox: own sub-agents: a tool each, whose job runs in its own sandbox
   // on the worker, reached over the same proxy door.
-  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec }) : { server: null };
+  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec, workspaceRoot: "/workspace" }) : { server: null };
 
   // Keyless cloud identities (FOLDRUN_IDENTITIES): each token file kept
   // fresh through the proxy's /identity door, which mints only what this
@@ -904,8 +924,11 @@ export const RETRY_SH = `retry() { what=$1; shift; n=1; until "$@"; do if [ "$n"
  *  and make one browse call per engine on the full image:
  *    docker buildx imagetools inspect node:22-trixie-slim --format '{{json .Manifest}}' | jq -r .digest
  *  The digest names the multi-arch index, so the one pin serves amd64 and
- *  arm64 alike. */
-export const NODE_BASE = "node:22-trixie-slim@sha256:b26b04c123d9ff8ab646ceb18b9d75a1173acf64b9a401094b906d27b29338d4";
+ *  arm64 alike.
+ *
+ *  23 Oct 2026: Node 22.23.4 (the 21 Oct security release: Brotli decoder
+ *  RCE, TLS hostname bypasses); the pin before carried 22.23.3. */
+export const NODE_BASE = "node:22-trixie-slim@sha256:8eb619e402eaede1748a3c8173bffab391592812e85136452f781741c7242ddf";
 
 // Two images from one file, as build targets.
 //

package/src/runner.ts

@@ -5,7 +5,7 @@
 
 import { latestRevisionId } from "./history.ts";
 import { recordCallIo, redactionsFor } from "./capture.ts";
-import { AUTH_REFUSAL } from "./issues.ts";
+import { AUTH_REFUSAL, platformCause } from "./issues.ts";
 import { hookNames } from "./hooks.ts";
 import crypto from "node:crypto";
 import fs from "node:fs";
@@ -38,7 +38,7 @@ const isolatedRun = () => {
 };
 import { gatherConsults, buildConsultTools } from "./agent-tools.ts";
 import { DELEGATE_TOOL, gatherSubagents, ownSandbox, subagentPrompt, subagentTools, type DelegateSpec, type SubagentSpec } from "./subagents.ts";
-import { DELEGATE_SERVER, buildDelegateTools, delegatePromptLine, delegateToolNames, localDelegateChannel } from "./delegate-tools.ts";
+import { DELEGATE_SERVER, buildDelegateTools, delegatePromptLine, delegateToolNames, localDelegateChannel, readCopyBack } from "./delegate-tools.ts";
 import type { DelegationResult } from "./operator.ts";
 import type { StepDelegation } from "./store.ts";
 import { ASK_TOOL, PEER_TOOLS, applyOperatorEvent, askPromptLine, askTimeoutSec, buildAskTool, buildPeerTools, inboxReader, localPeerBus, peersPromptLine, type PeerInfo } from "./operator.ts";
@@ -3717,6 +3717,35 @@ function platformFallbackEnv(): Record<string, string> | null {
 const CREDENTIAL_ROTATION_WAIT_MS = 90_000;
 const CREDENTIAL_POLL_MS = 2_000;
 
+/** Platform causes a rescuer on the same model supply cannot get past. */
+const SAME_SUPPLY_WALLS = new Set(["model-cap", "model-auth"]);
+
+/** Whether two agents of one workspace call the same model supply: each
+ *  resolved the way agentContext does — its own provider: block, else the
+ *  workspace's — and compared in a stable key order. The account key is
+ *  shared by both, so two that resolve to no block share it (Codex review). */
+export function sameSupply(workspaceDir: string, tenant: string, a: string, b: string): boolean {
+  const supplyOf = (agent: string): string => {
+    const agentDir = path.join(workspaceDir, "agents", agent);
+    let own: unknown;
+    try {
+      own = matter(fs.readFileSync(path.join(agentDir, "agent.md"), "utf8")).data.provider;
+    } catch {
+      own = undefined;
+    }
+    return stableJson(own ?? workspaceFrontmatter(agentDir, tenant).provider ?? null);
+  };
+  return supplyOf(a) === supplyOf(b);
+}
+
+function stableJson(v: unknown): string {
+  if (Array.isArray(v)) return `[${v.map(stableJson).join(",")}]`;
+  if (v && typeof v === "object") {
+    return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${stableJson((v as Record<string, unknown>)[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(v) ?? "null";
+}
+
 /** A refusal of the credential itself, in any of the wordings Claude Code
  *  has used. "Failed to authenticate: OAuth token revoked" (9 Oct 2026, a
  *  step started one second before the 09:07:52Z refresh) matched none of the
@@ -5101,10 +5130,15 @@ function driveRunInner(
           entry.ms = Date.now() - started;
           save();
           const errors = child.events.filter((e) => e.type === "error").map((e) => e.text).join("\n");
+          // Its files go back with the reply, so the delegating step's
+          // sandbox has them too (delegate-tools.ts copyBackFiles).
+          const back = readCopyBack(pDir, child.wrote ?? []);
           return {
             status,
             result: child.result ?? (errors || "(no reply)"),
             wrote: child.wrote ?? [],
+            files: back.files,
+            filesOmitted: back.omitted,
           };
         };
         // An agent's own `budget:` — the most it may spend in one run — is
@@ -5294,6 +5328,19 @@ function driveRunInner(
                 // stop that lands while the outward check was being written.
                 save();
                 if (run.stopRequested) break;
+                // A spent usage window resets in hours or days, never within
+                // the retry waits below: another attempt is refused the same
+                // way (abandon-desk's collector ran twice on 23 Oct 2026).
+                const lastError = [...step.events].reverse().find((e) => e.type === "error")?.text;
+                if (platformCause(lastError)?.key === "model-cap") {
+                  step.events.push({
+                    t: new Date().toISOString(),
+                    type: "info",
+                    text: `not retried — the model usage cap is reached and will not reset within a retry's wait (${attempts - attempt} left unused)`,
+                  });
+                  save();
+                  break;
+                }
                 // The retry policy. An attempt the cluster ended for want of
                 // memory or disk is retried one size class up — the same
                 // size would end the same way. Every retry waits: 15 s, 30 s,
@@ -5363,6 +5410,21 @@ function driveRunInner(
             });
             return;
           }
+          // A rescuer on the same model supply hits the same wall. On 23 Oct
+          // 2026 every desk's fixer started after a spent weekly window, was
+          // refused the same way, and the issue read "fixer also failed"
+          // instead of the cap. A rescuer on a different supply still tries.
+          const lastError = [...step.events].reverse().find((e) => e.type === "error")?.text;
+          const wall = platformCause(lastError);
+          if (wall && SAME_SUPPLY_WALLS.has(wall.key) && sameSupply(pDir, tenant, step.agent, step.onFail)) {
+            step.events.push({
+              t: new Date().toISOString(),
+              type: "info",
+              text: `not handing to [[${step.onFail}]] (on-fail): ${wall.label.toLowerCase()}, and it runs on the same model supply`,
+            });
+            save();
+            return;
+          }
           // One rescue per failure, across drives. A worker that died
           // mid-rescue left an unfinished record behind it; the drive that
           // resumes picks that one up instead of splicing another — a crash

package/src/scan.ts

@@ -739,7 +739,7 @@ function scanAgents(agents: AgentFacts[], outward: Set<string>, toolDefs: Map<st
       if (sub.data.sandbox === "own") {
         if (extra.length) {
           push("security/subagent-own-sandbox", a.file, keyLine(a.lines, "subagents"), `subagent ${s} own ${extra.join(",")}`,
-            `subagents: [${s}] — ${s} runs in its own sandbox with ${extra.join(", ")}, which ${a.name} does not have; only its reply comes back`);
+            `subagents: [${s}] — ${s} runs in its own sandbox with ${extra.join(", ")}, which ${a.name} does not have; only its reply and the files it wrote come back`);
         }
         continue;
       }