@foldrun/core 2.9.0 → 2.10.0

package/dist/src/delegate-tools.d.ts

@@ -6,17 +6,64 @@ export declare const DELEGATE_SERVER = "foldrun_delegate";
 export declare const JOB_MAX = 20000;
 /** What comes back is cut here: the reply is the parent's context. */
 export declare const REPLY_MAX = 40000;
+/** What one job's files may add up to when copied back into the parent's
+ *  sandbox, and the most files. They travel with the reply through the
+ *  operator store, so the cap is on the raw bytes before base64. */
+export declare const COPY_BACK_MAX_BYTES: number;
+export declare const COPY_BACK_MAX_FILES = 100;
+/** Read what a job wrote, on the host, for the trip back to the parent's
+ *  sandbox: files only (no links), confined to the workspace, until the cap.
+ *  What does not fit is named, never cut. */
+export declare function readCopyBack(workspaceDir: string, wrote: string[]): {
+    files: {
+        path: string;
+        base64: string;
+    }[];
+    omitted: string[];
+};
+/** Where a sandbox notes what was copied back into it: path → sha256 of the
+ *  bytes written. The step's copy-out reads it (run-container.ts
+ *  applyContainerChanges) as what those files held before the step touched
+ *  them, so a job's change already on the workspace is not applied twice.
+ *  Under .foldrun/, which is never copied back as content. */
+export declare const COPY_BACK_MANIFEST = ".foldrun/copied-back.json";
+/** The manifest of a sandbox's workspace, or {}. */
+export declare function readCopyBackManifest(workspaceRoot: string): Record<string, string>;
+/** Write a job's files into this sandbox's workspace. A path that would leave
+ *  it, or land through a link, is refused. A file the step itself changed
+ *  since `since` (its own edit, not one copied back) is not overwritten: the
+ *  job's version goes beside it as `<name>.from-<agent><ext>`. */
+export declare function copyBackFiles(workspaceRoot: string, files: {
+    path: string;
+    base64: string;
+}[], opts?: {
+    since?: number;
+    from?: string;
+}): {
+    copied: string[];
+    conflicts: {
+        path: string;
+        copy: string;
+    }[];
+};
 type Emit = (type: "text" | "tool" | "info" | "error", text: string, extra?: EventExtra) => void;
 /** The granted names, the same on every path. */
 export declare function delegateToolNames(specs: DelegateSpec[]): string[];
-/** The reply as the parent reads it: the sub-agent's words, then what it changed. */
-export declare function replyText(name: string, r: DelegationResult): string;
+/** The reply as the parent reads it: the sub-agent's words, then what it
+ *  changed — `copied` are the paths now in this sandbox too. */
+export declare function replyText(name: string, r: DelegationResult, copied?: string[], conflicts?: {
+    path: string;
+    copy: string;
+}[]): string;
 export declare function buildDelegateTools(opts: {
     specs: DelegateSpec[];
     channel: OperatorChannel | null;
     emit: Emit;
     /** The most one job may run; the step's own timeout bounds it anyway. */
     timeoutSec?: number;
+    /** This sandbox's workspace: where a job's files are copied back. Absent
+     *  in-process, where the job wrote the same workspace already. */
+    workspaceRoot?: string;
     now?: () => number;
 }): {
     server: null;

package/dist/src/delegate-tools.js

@@ -14,9 +14,12 @@
 // one door it has (the egress proxy, at its lease — operator.ts), and the
 // worker runs the job as a step of its own: its own pod, its own `tools:`,
 // `secrets:` and `network:` from its own file, NOT cut to the parent's — the
-// parent may hold less. The parent waits and gets the reply text, nothing
-// else. What the sub-agent wrote reaches the workspace when it finishes, so
-// the next step sees it; the reply names the paths.
+// parent may hold less. The parent waits and gets the reply text. What the
+// sub-agent wrote reaches the workspace when it finishes, and comes back with
+// the reply into the parent's sandbox too (copyBackFiles), so the parent's
+// model and its `verify:` see it there: a `verify: file:` on the delegating
+// step used to fail on a file the job had written (owner, 23 Oct 2026). What
+// is too large to send back still reaches the workspace for the next step.
 //
 // Depth one, as for every sub-agent: the job's own `subagents:` are not
 // offered to it. Its record sits in the run after the parent's, marked
@@ -24,6 +27,9 @@
 //
 // With no channel (a container step on an install without a proxy) the tools
 // are not granted at all; the runner says so on the step.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
 import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
 import { z } from "zod";
 import { delegateToolName } from "./subagents.js";
@@ -32,22 +38,228 @@ export const DELEGATE_SERVER = "foldrun_delegate";
 export const JOB_MAX = 20_000;
 /** What comes back is cut here: the reply is the parent's context. */
 export const REPLY_MAX = 40_000;
+/** What one job's files may add up to when copied back into the parent's
+ *  sandbox, and the most files. They travel with the reply through the
+ *  operator store, so the cap is on the raw bytes before base64. */
+export const COPY_BACK_MAX_BYTES = 4 * 1024 * 1024;
+export const COPY_BACK_MAX_FILES = 100;
+/** A workspace-relative path that stays inside the workspace. */
+function insideRel(rel) {
+    const norm = path.posix.normalize(String(rel).replaceAll("\\", "/"));
+    if (!norm || norm === "." || norm.startsWith("../") || norm === ".." || path.posix.isAbsolute(norm))
+        return null;
+    return norm;
+}
+/** Read what a job wrote, on the host, for the trip back to the parent's
+ *  sandbox: files only (no links), confined to the workspace, until the cap.
+ *  What does not fit is named, never cut. */
+export function readCopyBack(workspaceDir, wrote) {
+    const files = [];
+    const omitted = [];
+    let total = 0;
+    const root = path.resolve(workspaceDir);
+    let realRoot;
+    try {
+        realRoot = fs.realpathSync(root);
+    }
+    catch {
+        return { files, omitted };
+    }
+    for (const w of [...new Set(wrote)]) {
+        const rel = insideRel(w);
+        if (!rel)
+            continue;
+        const abs = path.join(root, rel);
+        let st;
+        try {
+            st = fs.lstatSync(abs);
+            // A directory link on the way must not lead out of the workspace:
+            // what is read here goes into another sandbox (Codex review).
+            const real = fs.realpathSync(abs);
+            if (real !== realRoot && !real.startsWith(realRoot + path.sep))
+                continue;
+        }
+        catch {
+            continue; // written then removed by the job
+        }
+        if (!st.isFile())
+            continue;
+        if (files.length >= COPY_BACK_MAX_FILES || total + st.size > COPY_BACK_MAX_BYTES) {
+            omitted.push(rel);
+            continue;
+        }
+        const buf = fs.readFileSync(abs);
+        total += buf.length;
+        files.push({ path: rel, base64: buf.toString("base64") });
+    }
+    return { files, omitted };
+}
+/** Where a sandbox notes what was copied back into it: path → sha256 of the
+ *  bytes written. The step's copy-out reads it (run-container.ts
+ *  applyContainerChanges) as what those files held before the step touched
+ *  them, so a job's change already on the workspace is not applied twice.
+ *  Under .foldrun/, which is never copied back as content. */
+export const COPY_BACK_MANIFEST = ".foldrun/copied-back.json";
+const sha256 = (b) => crypto.createHash("sha256").update(b).digest("hex");
+const exists = (p) => {
+    try {
+        fs.lstatSync(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+/** The manifest's folder and file, unless either is something other than a
+ *  real directory and file — a link planted there is never followed. */
+function manifestPath(root) {
+    const dir = path.join(root, path.dirname(COPY_BACK_MANIFEST));
+    const file = path.join(root, COPY_BACK_MANIFEST);
+    try {
+        if (!fs.lstatSync(dir).isDirectory())
+            return null;
+    }
+    catch {
+        return file; // neither exists yet
+    }
+    try {
+        if (!fs.lstatSync(file).isFile())
+            return null;
+    }
+    catch {
+        /* new file */
+    }
+    return file;
+}
+function writeManifest(root, manifest) {
+    const file = manifestPath(root);
+    if (!file)
+        return;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(manifest), { flag: "w" });
+}
+/** The manifest of a sandbox's workspace, or {}. */
+export function readCopyBackManifest(workspaceRoot) {
+    const file = manifestPath(path.resolve(workspaceRoot));
+    if (!file)
+        return {};
+    try {
+        const m = JSON.parse(fs.readFileSync(file, "utf8"));
+        return m && typeof m === "object" && !Array.isArray(m) ? m : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** Write a job's files into this sandbox's workspace. A path that would leave
+ *  it, or land through a link, is refused. A file the step itself changed
+ *  since `since` (its own edit, not one copied back) is not overwritten: the
+ *  job's version goes beside it as `<name>.from-<agent><ext>`. */
+export function copyBackFiles(workspaceRoot, files, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const manifest = readCopyBackManifest(root);
+    const copied = [];
+    const conflicts = [];
+    // Every directory on the way must be a real one inside the workspace: a
+    // link the step planted must not carry the write elsewhere.
+    const safeDirs = (abs) => {
+        let dir = path.dirname(abs);
+        const chain = [];
+        while (dir.startsWith(root + path.sep)) {
+            chain.unshift(dir);
+            dir = path.dirname(dir);
+        }
+        for (const d of chain) {
+            try {
+                if (!fs.lstatSync(d).isDirectory())
+                    return false;
+            }
+            catch {
+                fs.mkdirSync(d);
+            }
+        }
+        return true;
+    };
+    for (const f of files) {
+        const rel = insideRel(f.path);
+        if (!rel)
+            continue;
+        let target = rel;
+        let abs = path.join(root, rel);
+        if (!safeDirs(abs))
+            continue;
+        let st = null;
+        try {
+            st = fs.lstatSync(abs);
+        }
+        catch {
+            /* new file */
+        }
+        if (st && !st.isFile())
+            continue;
+        const bytes = Buffer.from(f.base64, "base64");
+        if (st) {
+            const now = fs.readFileSync(abs);
+            if (now.equals(bytes)) {
+                manifest[rel] = sha256(bytes);
+                copied.push(rel);
+                continue;
+            }
+            const ours = manifest[rel] === sha256(now);
+            const editedHere = !ours && opts.since !== undefined && st.mtimeMs > opts.since;
+            if (editedHere) {
+                // A name nothing has yet: an earlier conflict copy may be the step's
+                // own work by now (Codex review).
+                const ext = path.posix.extname(rel);
+                const stem = `${rel.slice(0, rel.length - ext.length)}.from-${(opts.from ?? "subagent").replace(/[^A-Za-z0-9_-]/g, "-")}`;
+                for (let n = 1;; n++) {
+                    target = `${stem}${n === 1 ? "" : `-${n}`}${ext}`;
+                    abs = path.join(root, target);
+                    if (!exists(abs))
+                        break;
+                }
+                // Not in the manifest: this copy is not on the workspace yet, and
+                // the copy-out must carry it there.
+                fs.writeFileSync(abs, bytes);
+                conflicts.push({ path: rel, copy: target });
+                continue;
+            }
+        }
+        fs.writeFileSync(abs, bytes);
+        manifest[rel] = sha256(bytes);
+        copied.push(rel);
+    }
+    if (copied.length || conflicts.length)
+        writeManifest(root, manifest);
+    return { copied, conflicts };
+}
 /** The granted names, the same on every path. */
 export function delegateToolNames(specs) {
     return specs.map((s) => `mcp__${DELEGATE_SERVER}__${delegateToolName(s.name)}`);
 }
-/** The reply as the parent reads it: the sub-agent's words, then what it changed. */
-export function replyText(name, r) {
+/** The reply as the parent reads it: the sub-agent's words, then what it
+ *  changed — `copied` are the paths now in this sandbox too. */
+export function replyText(name, r, copied = [], conflicts = []) {
     const body = r.result.trim() || "(no reply)";
     const cut = body.length > REPLY_MAX ? `${body.slice(0, REPLY_MAX)}\n…(cut at ${REPLY_MAX} characters)` : body;
-    const wrote = r.wrote?.length
-        ? `\n\nFiles ${name} changed (in the workspace from the next step on — not in your sandbox):\n${r.wrote.slice(0, 200).map((w) => `- ${w}`).join("\n")}`
-        : "";
+    const here = new Set([...copied, ...conflicts.map((c) => c.path)]);
+    const elsewhere = (r.wrote ?? []).filter((w) => !here.has(w));
+    const wrote = (copied.length
+        ? `\n\nFiles ${name} changed, copied into your sandbox at the same paths:\n${copied.slice(0, 200).map((w) => `- ${w}`).join("\n")}`
+        : "") +
+        (conflicts.length
+            ? `\n\nFiles you had changed yourself, which ${name} changed too — yours are kept; its version is beside each:\n${conflicts.slice(0, 200).map((c) => `- ${c.path} → ${c.copy}`).join("\n")}`
+            : "") +
+        (elsewhere.length
+            ? `\n\nFiles ${name} changed that are not in your sandbox (too large to copy back — in the workspace from the next step on):\n${elsewhere.slice(0, 200).map((w) => `- ${w}`).join("\n")}`
+            : "");
     const head = r.status === "completed" ? "" : `${name} did not finish (${r.status}). What it said:\n`;
     return head + cut + wrote;
 }
 export function buildDelegateTools(opts) {
     const now = opts.now ?? Date.now;
+    // Anything in this sandbox newer than this, the step changed itself.
+    const startedAt = Date.now();
     const channel = opts.channel;
     if (!opts.specs.length || !channel?.delegate || !channel.delegation) {
         return { server: null, toolNames: [], calls: {} };
@@ -77,8 +289,21 @@ export function buildDelegateTools(opts) {
                 continue;
             }
             if (got) {
-                opts.emit(got.status === "completed" ? "info" : "error", `${s.name} ${got.status}${got.wrote?.length ? ` — changed ${got.wrote.length} file(s)` : ""}`, { subagent: s.name });
-                return text(replyText(s.name, got), got.status !== "completed");
+                let copied = [];
+                let conflicts = [];
+                if (opts.workspaceRoot && got.files?.length) {
+                    try {
+                        ({ copied, conflicts } = copyBackFiles(opts.workspaceRoot, got.files, { since: startedAt, from: s.name }));
+                    }
+                    catch (err) {
+                        opts.emit("error", `could not copy ${s.name}'s files into this sandbox: ${err instanceof Error ? err.message : String(err)}`, { subagent: s.name });
+                    }
+                }
+                const back = copied.length || conflicts.length
+                    ? `; ${copied.length} copied into this sandbox${conflicts.length ? `, ${conflicts.length} kept beside the step's own edit` : ""}`
+                    : "";
+                opts.emit(got.status === "completed" ? "info" : "error", `${s.name} ${got.status}${got.wrote?.length ? ` — changed ${got.wrote.length} file(s)${back}` : ""}`, { subagent: s.name });
+                return text(replyText(s.name, got, opts.workspaceRoot ? copied : (got.wrote ?? []), conflicts), got.status !== "completed");
             }
         }
         try {
@@ -147,7 +372,7 @@ export function localDelegateChannel(run) {
  *  works where. */
 export function delegatePromptLine(specs) {
     return (`<isolated-subagents>\nThese colleagues work in their own sandbox, with their own tools; call the tool to hand one a job ` +
-        `and you get back its reply and the paths of any files it changed:\n` +
+        `and you get back its reply, with the files it changed copied into your sandbox at the same paths:\n` +
         specs.map((s) => `- ${delegateToolName(s.name)}: ${s.description}`).join("\n") +
         `\n</isolated-subagents>`);
 }

package/dist/src/operator.d.ts

@@ -103,6 +103,15 @@ export interface DelegationResult {
     /** Workspace paths it changed. They reach the workspace when it ends, so
      *  the next step sees them; the delegating step's own sandbox does not. */
     wrote?: string[];
+    /** What it wrote, copied back into the delegating step's sandbox, so the
+     *  parent's model and its `verify:` see it there (copyBackFiles), base64. */
+    files?: {
+        path: string;
+        base64: string;
+    }[];
+    /** Written paths too large to copy back: they reach the workspace when the
+     *  job ends, so the next step sees them. */
+    filesOmitted?: string[];
 }
 export declare const QUESTION_MAX = 2000;
 export declare const OPTION_MAX = 200;

package/dist/src/operator.js

@@ -136,6 +136,10 @@ export function httpChannel(egress, fetchImpl = fetch) {
                 status,
                 result: typeof body.result === "string" ? body.result : "",
                 wrote: Array.isArray(body.wrote) ? body.wrote.filter((w) => typeof w === "string") : [],
+                files: Array.isArray(body.files)
+                    ? body.files.filter((f) => !!f && typeof f.path === "string" && typeof f.base64 === "string")
+                    : [],
+                filesOmitted: Array.isArray(body.filesOmitted) ? body.filesOmitted.filter((w) => typeof w === "string") : [],
             };
         },
         async cancelDelegation(id) {

package/dist/src/run-container.d.ts

@@ -296,7 +296,7 @@ export declare function runtimeCacheMount(tenant: string | undefined): {
     target: string;
 } | null;
 /** The runner container's entrypoint, as JS text: written into the image as driver.mjs, so it must be plain JS — a TypeScript cast here broke every step on v2026.10.21.5 (tests/run-container.test.ts checks it). */
-export declare const DRIVER = "// The runner container's entrypoint. Reads one step, executes it with the\n// same core the server uses, speaks JSONL on stdout, exits.\nimport fs from \"node:fs\";\nconst input = JSON.parse(fs.readFileSync(\"/opt/runner/job/input.json\", \"utf8\"));\n// Start-up marks (run-container.ts#STARTUP_PHASES): which phase just ended,\n// on the sandbox's clock. A worker that does not know a mark skips the line.\nconst mark = (name) => process.stdout.write(JSON.stringify({ e: \"mark\", name, at: Date.now() }) + \"\\n\");\nmark(\"driver\");\nlet modelSpoke = false;\nconst emit = (type, text, extra) => {\n  // The model's first text or tool call is where start-up ends and the\n  // step's own work begins \u2014 runtime and tool lines before it are set-up.\n  if (!modelSpoke && (type === \"text\" || type === \"tool\")) { modelSpoke = true; mark(\"model\"); }\n  process.stdout.write(JSON.stringify({ e: \"event\", type, text, ...extra }) + \"\\n\");\n};\n// What this sandbox actually touched, read at the last moment from the\n// kernel's own books: cgroup v2 for CPU busy-time and peak memory,\n// /proc/net/dev for bytes on the wire. Every read is best-effort \u2014 gVisor\n// exposes some of these files and not others depending on version, and a\n// metric we cannot read is null, never guessed. Reservation is what is\n// billed; these exist so the reservation can be right-sized.\nfunction readActuals() {\n  // fs from the module's own import \u2014 the driver is ESM, and a require()\n  // here threw on every call, silently nulling every metric it guarded.\n  const read = (p) => { try { return fs.readFileSync(p, \"utf8\"); } catch { return null; } };\n  // Two cgroup dialects: v2 (cpu.stat, microseconds; memory.peak) on a\n  // plain runtime, v1-style controllers under gVisor (cpuacct.usage,\n  // NANOseconds; memory.max_usage_in_bytes) \u2014 probed on the real cluster,\n  // not assumed. Whichever answers wins; both silent means null.\n  const cpuStat = read(\"/sys/fs/cgroup/cpu.stat\");\n  const usage = cpuStat?.match(/^usage_usec (\\d+)/m);\n  const cpuacctNs = usage ? NaN : Number(read(\"/sys/fs/cgroup/cpuacct/cpuacct.usage\")?.trim());\n  const peak =\n    read(\"/sys/fs/cgroup/memory.peak\") ??\n    read(\"/sys/fs/cgroup/memory/memory.max_usage_in_bytes\") ??\n    read(\"/sys/fs/cgroup/memory/memory.usage_in_bytes\");\n  let rx = 0, tx = 0, sawNet = false;\n  const net = read(\"/proc/net/dev\");\n  if (net) {\n    for (const line of net.split(\"\\n\").slice(2)) {\n      const m = line.trim().match(/^(\\S+):\\s+(\\d+)(?:\\s+\\d+){7}\\s+(\\d+)/);\n      if (m && m[1] !== \"lo\") { rx += Number(m[2]); tx += Number(m[3]); sawNet = true; }\n    }\n  }\n  return {\n    busyCpuSecs: usage\n      ? Number(usage[1]) / 1e6\n      : Number.isFinite(cpuacctNs) && cpuacctNs > 0\n        ? cpuacctNs / 1e9\n        : null,\n    peakMemBytes: peak ? Number(peak.trim()) || null : null,\n    rxBytes: sawNet ? rx : null,\n    txBytes: sawNet ? tx : null,\n  };\n}\n\ntry {\n  // Runtime state (venvs, npm prefixes) lands in the agent user's real home\n  // \u2014 writable, inside the container, gone with it.\n  process.env.FOLDRUN_DATA = \"/home/agent/.foldrun\";\n  const { executeStep } = await import(\"@foldrun/core/step-exec\");\n  const { buildApiTools } = await import(\"@foldrun/core/api-tools\");\n  const { buildScriptTools } = await import(\"@foldrun/core/script-tools\");\n  const { buildConsultTools } = await import(\"@foldrun/core/agent-tools\");\n  const { buildSearchTools, buildHistoryTools, buildDeskTools } = await import(\"@foldrun/core/context-tools\");\n  const { httpChannel, buildAskTool, buildPeerTools, inboxReader } = await import(\"@foldrun/core/operator\");\n  const { buildDelegateTools } = await import(\"@foldrun/core/delegate-tools\");\n  const { startTranslator } = await import(\"@foldrun/core/translator\");\n  const { prepareRuntime } = await import(\"@foldrun/core/runtime\");\n  const { materializeFileSecrets } = await import(\"@foldrun/core/secret-files\");\n  const { paidWebActions } = await import(\"@foldrun/core/browser-pod\");\n  mark(\"imports\");\n\n  const agentDir = \"/workspace/\" + input.agentRel;\n  // HOME is where a bare relative path lands when anything resolves one\n  // outside cwd \u2014 and root's /root is outside the workspace, so such a read\n  // was refused by confinement with a path the agent never typed. Its own\n  // directory is both the truthful answer and the safe one.\n  // @file secrets crossed as content; materialise them to 0600 paths inside\n  // the container (a host path from the other side would not exist here).\n  const env = materializeFileSecrets(agentDir, { ...process.env, HOME: agentDir }).env;\n  // Caches go to the sandbox user's own home, not to HOME: the Claude CLI's\n  // logs, fontconfig, Mesa and gstreamer all follow XDG_CACHE_HOME, and under\n  // agents/<name>/.cache they were copied back after every step \u2014 3,855 files\n  // across 179 agent folders on the box by 17 Oct 2026, read by nothing.\n  env.XDG_CACHE_HOME = \"/home/agent/.cache\";\n\n  // The declared runtime, built in here \u2014 pip and npm have the network, which\n  // the host side may not. It lands in .foldrun/runner/.runtimes, which the\n  // executors mount from a per-tenant directory (run-container.ts#RUNTIME_CACHE):\n  // the first step for a given fingerprint installs, every later one finds\n  // .ready and skips. With no mount it still works, just fresh every time \u2014\n  // which is what this used to be unconditionally. The log says which happened.\n  const runtime = input.runtime\n    ? prepareRuntime(\"runner\", input.runtime)\n    : { interpreters: {}, env: {}, log: [], error: null };\n  for (const line of runtime.log) emit(\"info\", \"runtime: \" + line);\n  if (runtime.error) emit(\"error\", \"runtime: \" + runtime.error);\n  // The step's own environment gets it too, not only the script tools: an\n  // agent that runs \"python3 x.py\" or a shebang script through Bash should\n  // meet the packages its runtime declared, not the image's bare python.\n  Object.assign(env, runtime.env);\n\n  // install: what the agent finds it needs mid-step. apt goes through the\n  // root start-up's helper (install-helper.ts); pip and npm land in a\n  // directory of this container's own, on the paths from the first turn.\n  const { buildInstallTool, INSTALL_TOOL } = await import(\"@foldrun/core/install-tool\");\n  const { stepInstallEnv, INSTALL_SOCKET } = await import(\"@foldrun/core/runtime\");\n  const installDir = \"/home/agent/.foldrun/step\";\n  const installing = (input.allowed ?? []).includes(INSTALL_TOOL);\n  if (installing) Object.assign(env, stepInstallEnv(installDir, env));\n  const install = installing\n    ? buildInstallTool({\n        dir: installDir,\n        socket: env.FOLDRUN_INSTALL_SOCKET || INSTALL_SOCKET,\n        cacheRoot: \"/home/agent/.foldrun/runner/.runtimes\",\n        python: env.VIRTUAL_ENV ? env.VIRTUAL_ENV + \"/bin/python\" : \"python3\",\n        env,\n        emit,\n      })\n    : { server: null };\n\n  // API and script tools, rebuilt in here from their specs. Secrets were\n  // substituted into API headers before the input crossed the boundary, so\n  // buildApiTools gets an already-resolved environment. verify: gets the\n  // container's own environment, whole: it is the boundary, assembled on\n  // the host from an allowlist, and the declared secrets are in it.\n  // A long result is kept in a file only when the agent can read it back.\n  // (tool-output.ts canReadBack, inlined: the driver imports core by subpath.)\n  const keepIn = { dir: agentDir, readable: () => (input.allowed ?? []).some((t) => t === \"Read\" || t === \"Grep\") };\n  // A declared secret named like a model variable crosses as\n  // FOLDRUN_DECLARED_<NAME> (runner.ts, FOL-19): the model keeps its own\n  // settings, and the agent's API and script tools and verify: get the value\n  // back under the name it declared. Built here, after the runtime and any\n  // mid-step install have added their paths to env.\n  const toolEnv = { ...env };\n  for (const [k, v] of Object.entries(env)) if (k.startsWith(\"FOLDRUN_DECLARED_\")) toolEnv[k.slice(\"FOLDRUN_DECLARED_\".length)] = v;\n  const api = buildApiTools(\"\", input.apis, undefined, { env: toolEnv, missing: [] }, keepIn);\n  const script = buildScriptTools(\n    agentDir,\n    input.scripts,\n    toolEnv,\n    \"/library/scripts\",\n    runtime.interpreters,\n    null,\n    keepIn.readable,\n  );\n  // The translator, when the provider speaks Chat Completions: a loopback\n  // server for the length of this step. Its env replaces the endpoint the\n  // host assembled; the provider's real URL and key stay inside it.\n  const translator = input.translator ? await startTranslator(input.translator) : null;\n  if (translator) {\n    Object.assign(env, translator.env);\n    emit(\"info\", \"translator: listening on \" + translator.baseUrl + \" for \" + (input.translator.label ?? input.translator.upstreamBase));\n  }\n  const consult = buildConsultTools(input.consults ?? [], env, emit);\n  // The platform's own two groups, rebuilt from values like everything else.\n  const search = buildSearchTools(input.search ?? []);\n  const history = input.history?.length ? buildHistoryTools(input.history) : { server: null };\n  const desks = input.desks?.length ? buildDeskTools(input.desks) : { server: null };\n  // A person in the loop, over the proxy this step's lease already names:\n  // ask_person when tools: [ask], and the run's inbox after every tool call.\n  const channel = httpChannel(env.FOLDRUN_EGRESS);\n  const ask = input.ask ? buildAskTool({ channel, timeoutSec: input.ask.timeoutSec, emit }) : { server: null };\n  const peers = input.peers ? buildPeerTools({ channel, self: input.peers.self, siblings: input.peers.siblings, emit }) : { server: null };\n  const inbox = channel ? inboxReader(channel, emit) : undefined;\n  // sandbox: own sub-agents: a tool each, whose job runs in its own sandbox\n  // on the worker, reached over the same proxy door.\n  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec }) : { server: null };\n\n  // Keyless cloud identities (FOLDRUN_IDENTITIES): each token file kept\n  // fresh through the proxy's /identity door, which mints only what this\n  // step's lease was granted. Fetched before the step starts, renewed five\n  // minutes before it expires (with jitter); a failure is said and retried.\n  // Plain JS: this text is the driver, not TypeScript.\n  const identityNames = (env.FOLDRUN_IDENTITIES || \"\").split(\",\").filter(Boolean);\n  if (identityNames.length) {\n    // No backslashes: this sits inside a template literal, which eats them.\n    const ep = new RegExp(\"^(https?://[^/]+)/e/([A-Za-z0-9_-]{16,})/?$\").exec(env.FOLDRUN_EGRESS || \"\");\n    const dir = env.FOLDRUN_IDENTITY_DIR || \"/tmp/foldrun-identity\";\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    const keepFresh = async (name) => {\n      let wait = 30000;\n      try {\n        if (!ep) throw new Error(\"no egress proxy to ask\");\n        const res = await fetch(ep[1] + \"/identity/\" + ep[2] + \"/\" + name, { signal: AbortSignal.timeout(15000) });\n        const body = await res.json().catch(() => ({}));\n        if (!res.ok || !body.token) throw new Error((body.error && body.error.message) || (\"proxy answered \" + res.status));\n        const file = dir + \"/\" + name.toLowerCase() + \".jwt\";\n        fs.writeFileSync(file + \".tmp\", body.token, { mode: 0o600 });\n        fs.renameSync(file + \".tmp\", file);\n        wait = Math.max(30000, body.expiresAt - Date.now() - 300000 + Math.floor(Math.random() * 60000) - 30000);\n      } catch (err) {\n        emit(\"error\", \"identity \" + name + \": \" + (err && err.message ? err.message : String(err)) + \" \u2014 trying again in 30s\");\n      }\n      setTimeout(() => { void keepFresh(name); }, wait).unref();\n    };\n    await Promise.all(identityNames.map(keepFresh));\n  }\n\n  mark(\"tools\");\n  const outcome = await executeStep({\n    agentDir,\n    workspaceRoot: \"/workspace\",\n    libraryRoot: \"/library\",\n    prompt: input.prompt,\n    model: input.model,\n    effort: input.effort ?? null,\n    systemPrompt: input.systemPrompt,\n    allowed: input.allowed,\n    mcpNames: input.mcpNames,\n    mcpServers: {\n      ...(api.server ? { foldrun_apis: api.server } : {}),\n      ...(script.server ? { foldrun_scripts: script.server } : {}),\n      ...(consult.server ? { foldrun_agents: consult.server } : {}),\n      ...(search.server ? { foldrun_search: search.server } : {}),\n      ...(history.server ? { foldrun_history: history.server } : {}),\n      ...(desks.server ? { foldrun_desks: desks.server } : {}),\n      ...(ask.server ? { foldrun_ask: ask.server } : {}),\n      ...(peers.server ? { foldrun_peers: peers.server } : {}),\n      ...(delegate.server ? { foldrun_delegate: delegate.server } : {}),\n      ...(install.server ? { foldrun_install: install.server } : {}),\n      ...input.mcpServers,\n    },\n    ...(inbox ? { inbox } : {}),\n    ...(input.subagents?.length ? { subagents: input.subagents } : {}),\n    env,\n    timeoutSec: input.timeoutSec,\n    budgetUsd: input.budgetUsd,\n    budgetNote: input.budgetNote,\n    price: input.price,\n    verify: input.verify,\n    verifyEnv: toolEnv,\n    ...(typeof input.judgeModel === \"string\" ? { judgeModel: input.judgeModel } : {}),\n    ...(typeof input.judgeEffort === \"string\" ? { judgeEffort: input.judgeEffort } : {}),\n    output: input.output,\n    schema: input.schema,\n    maxTurns: input.maxTurns,\n    ...(input.capture === \"metadata\" || input.capture === \"full\" ? { capture: input.capture } : {}),\n    ...(input.limits && Object.keys(input.limits).length ? { limits: input.limits, toolOwners: input.toolOwners ?? {} } : {}),\n    ...(input.hookNames?.length ? { hookNames: input.hookNames, hookBase: input.hookBase ?? {} } : {}),\n    // Slim browsing: the platform put this step on the slim image to browse\n    // through the account's pod, and named the file the web tool logs its\n    // reconnects to. A lost pod stops the step; what it wrote decides what\n    // the runner does next (browser-pod.ts).\n    ...(env.FOLDRUN_BROWSER_POD_EVENTS ? { browserPod: { events: env.FOLDRUN_BROWSER_POD_EVENTS, methods: api.methods ?? {}, paidWeb: paidWebActions(env), ...(env.FOLDRUN_BROWSER_INIT ? { browseInit: env.FOLDRUN_BROWSER_INIT } : {}) } } : {}),\n    // The container is the boundary; the SDK's own bash sandbox here would\n    // only block declared network use (SSH, curl) for no added safety.\n    sandboxBash: false,\n    emit,\n  });\n  for (const line of api.drainLog()) emit(\"info\", \"api: \" + line);\n  for (const line of script.drainLog()) emit(\"info\", \"script: \" + line);\n  if (translator) {\n    for (const line of translator.drainLog()) emit(\"info\", line.startsWith(\"translator\") ? line : \"translator: \" + line);\n    await translator.close();\n  }\n  // A consult's spend belongs to the step that asked.\n  const consultCost = consult.drainCost();\n  if (consultCost > 0) outcome.costUsd = (outcome.costUsd ?? 0) + consultCost;\n  if (consultCost > 0 && typeof outcome.turnsCostUsd === \"number\") outcome.turnsCostUsd += consultCost;\n  process.stdout.write(JSON.stringify({ e: \"done\", ...outcome, res: readActuals() }) + \"\\n\");\n  process.exit(0);\n} catch (err) {\n  emit(\"error\", err instanceof Error ? err.message : String(err));\n  // The failure path reports actuals too \u2014 a step that died eleven minutes\n  // in still held its slice for eleven minutes, and the failed runs are\n  // exactly the ones whose resource story gets read.\n  let res = null;\n  try { res = readActuals(); } catch { /* the reading must never mask the error */ }\n  process.stdout.write(JSON.stringify({ e: \"done\", status: \"failed\", result: null, costUsd: null, res }) + \"\\n\");\n  process.exit(0);\n}\n";
+export declare const DRIVER = "// The runner container's entrypoint. Reads one step, executes it with the\n// same core the server uses, speaks JSONL on stdout, exits.\nimport fs from \"node:fs\";\nconst input = JSON.parse(fs.readFileSync(\"/opt/runner/job/input.json\", \"utf8\"));\n// Start-up marks (run-container.ts#STARTUP_PHASES): which phase just ended,\n// on the sandbox's clock. A worker that does not know a mark skips the line.\nconst mark = (name) => process.stdout.write(JSON.stringify({ e: \"mark\", name, at: Date.now() }) + \"\\n\");\nmark(\"driver\");\nlet modelSpoke = false;\nconst emit = (type, text, extra) => {\n  // The model's first text or tool call is where start-up ends and the\n  // step's own work begins \u2014 runtime and tool lines before it are set-up.\n  if (!modelSpoke && (type === \"text\" || type === \"tool\")) { modelSpoke = true; mark(\"model\"); }\n  process.stdout.write(JSON.stringify({ e: \"event\", type, text, ...extra }) + \"\\n\");\n};\n// What this sandbox actually touched, read at the last moment from the\n// kernel's own books: cgroup v2 for CPU busy-time and peak memory,\n// /proc/net/dev for bytes on the wire. Every read is best-effort \u2014 gVisor\n// exposes some of these files and not others depending on version, and a\n// metric we cannot read is null, never guessed. Reservation is what is\n// billed; these exist so the reservation can be right-sized.\nfunction readActuals() {\n  // fs from the module's own import \u2014 the driver is ESM, and a require()\n  // here threw on every call, silently nulling every metric it guarded.\n  const read = (p) => { try { return fs.readFileSync(p, \"utf8\"); } catch { return null; } };\n  // Two cgroup dialects: v2 (cpu.stat, microseconds; memory.peak) on a\n  // plain runtime, v1-style controllers under gVisor (cpuacct.usage,\n  // NANOseconds; memory.max_usage_in_bytes) \u2014 probed on the real cluster,\n  // not assumed. Whichever answers wins; both silent means null.\n  const cpuStat = read(\"/sys/fs/cgroup/cpu.stat\");\n  const usage = cpuStat?.match(/^usage_usec (\\d+)/m);\n  const cpuacctNs = usage ? NaN : Number(read(\"/sys/fs/cgroup/cpuacct/cpuacct.usage\")?.trim());\n  const peak =\n    read(\"/sys/fs/cgroup/memory.peak\") ??\n    read(\"/sys/fs/cgroup/memory/memory.max_usage_in_bytes\") ??\n    read(\"/sys/fs/cgroup/memory/memory.usage_in_bytes\");\n  let rx = 0, tx = 0, sawNet = false;\n  const net = read(\"/proc/net/dev\");\n  if (net) {\n    for (const line of net.split(\"\\n\").slice(2)) {\n      const m = line.trim().match(/^(\\S+):\\s+(\\d+)(?:\\s+\\d+){7}\\s+(\\d+)/);\n      if (m && m[1] !== \"lo\") { rx += Number(m[2]); tx += Number(m[3]); sawNet = true; }\n    }\n  }\n  return {\n    busyCpuSecs: usage\n      ? Number(usage[1]) / 1e6\n      : Number.isFinite(cpuacctNs) && cpuacctNs > 0\n        ? cpuacctNs / 1e9\n        : null,\n    peakMemBytes: peak ? Number(peak.trim()) || null : null,\n    rxBytes: sawNet ? rx : null,\n    txBytes: sawNet ? tx : null,\n  };\n}\n\ntry {\n  // Runtime state (venvs, npm prefixes) lands in the agent user's real home\n  // \u2014 writable, inside the container, gone with it.\n  process.env.FOLDRUN_DATA = \"/home/agent/.foldrun\";\n  const { executeStep } = await import(\"@foldrun/core/step-exec\");\n  const { buildApiTools } = await import(\"@foldrun/core/api-tools\");\n  const { buildScriptTools } = await import(\"@foldrun/core/script-tools\");\n  const { buildConsultTools } = await import(\"@foldrun/core/agent-tools\");\n  const { buildSearchTools, buildHistoryTools, buildDeskTools } = await import(\"@foldrun/core/context-tools\");\n  const { httpChannel, buildAskTool, buildPeerTools, inboxReader } = await import(\"@foldrun/core/operator\");\n  const { buildDelegateTools } = await import(\"@foldrun/core/delegate-tools\");\n  const { startTranslator } = await import(\"@foldrun/core/translator\");\n  const { prepareRuntime } = await import(\"@foldrun/core/runtime\");\n  const { materializeFileSecrets } = await import(\"@foldrun/core/secret-files\");\n  const { paidWebActions } = await import(\"@foldrun/core/browser-pod\");\n  mark(\"imports\");\n\n  const agentDir = \"/workspace/\" + input.agentRel;\n  // HOME is where a bare relative path lands when anything resolves one\n  // outside cwd \u2014 and root's /root is outside the workspace, so such a read\n  // was refused by confinement with a path the agent never typed. Its own\n  // directory is both the truthful answer and the safe one.\n  // @file secrets crossed as content; materialise them to 0600 paths inside\n  // the container (a host path from the other side would not exist here).\n  const env = materializeFileSecrets(agentDir, { ...process.env, HOME: agentDir }).env;\n  // Caches go to the sandbox user's own home, not to HOME: the Claude CLI's\n  // logs, fontconfig, Mesa and gstreamer all follow XDG_CACHE_HOME, and under\n  // agents/<name>/.cache they were copied back after every step \u2014 3,855 files\n  // across 179 agent folders on the box by 17 Oct 2026, read by nothing.\n  env.XDG_CACHE_HOME = \"/home/agent/.cache\";\n\n  // The declared runtime, built in here \u2014 pip and npm have the network, which\n  // the host side may not. It lands in .foldrun/runner/.runtimes, which the\n  // executors mount from a per-tenant directory (run-container.ts#RUNTIME_CACHE):\n  // the first step for a given fingerprint installs, every later one finds\n  // .ready and skips. With no mount it still works, just fresh every time \u2014\n  // which is what this used to be unconditionally. The log says which happened.\n  const runtime = input.runtime\n    ? prepareRuntime(\"runner\", input.runtime)\n    : { interpreters: {}, env: {}, log: [], error: null };\n  for (const line of runtime.log) emit(\"info\", \"runtime: \" + line);\n  if (runtime.error) emit(\"error\", \"runtime: \" + runtime.error);\n  // The step's own environment gets it too, not only the script tools: an\n  // agent that runs \"python3 x.py\" or a shebang script through Bash should\n  // meet the packages its runtime declared, not the image's bare python.\n  Object.assign(env, runtime.env);\n\n  // install: what the agent finds it needs mid-step. apt goes through the\n  // root start-up's helper (install-helper.ts); pip and npm land in a\n  // directory of this container's own, on the paths from the first turn.\n  const { buildInstallTool, INSTALL_TOOL } = await import(\"@foldrun/core/install-tool\");\n  const { stepInstallEnv, INSTALL_SOCKET } = await import(\"@foldrun/core/runtime\");\n  const installDir = \"/home/agent/.foldrun/step\";\n  const installing = (input.allowed ?? []).includes(INSTALL_TOOL);\n  if (installing) Object.assign(env, stepInstallEnv(installDir, env));\n  const install = installing\n    ? buildInstallTool({\n        dir: installDir,\n        socket: env.FOLDRUN_INSTALL_SOCKET || INSTALL_SOCKET,\n        cacheRoot: \"/home/agent/.foldrun/runner/.runtimes\",\n        python: env.VIRTUAL_ENV ? env.VIRTUAL_ENV + \"/bin/python\" : \"python3\",\n        env,\n        emit,\n      })\n    : { server: null };\n\n  // API and script tools, rebuilt in here from their specs. Secrets were\n  // substituted into API headers before the input crossed the boundary, so\n  // buildApiTools gets an already-resolved environment. verify: gets the\n  // container's own environment, whole: it is the boundary, assembled on\n  // the host from an allowlist, and the declared secrets are in it.\n  // A long result is kept in a file only when the agent can read it back.\n  // (tool-output.ts canReadBack, inlined: the driver imports core by subpath.)\n  const keepIn = { dir: agentDir, readable: () => (input.allowed ?? []).some((t) => t === \"Read\" || t === \"Grep\") };\n  // A declared secret named like a model variable crosses as\n  // FOLDRUN_DECLARED_<NAME> (runner.ts, FOL-19): the model keeps its own\n  // settings, and the agent's API and script tools and verify: get the value\n  // back under the name it declared. Built here, after the runtime and any\n  // mid-step install have added their paths to env.\n  const toolEnv = { ...env };\n  for (const [k, v] of Object.entries(env)) if (k.startsWith(\"FOLDRUN_DECLARED_\")) toolEnv[k.slice(\"FOLDRUN_DECLARED_\".length)] = v;\n  const api = buildApiTools(\"\", input.apis, undefined, { env: toolEnv, missing: [] }, keepIn);\n  const script = buildScriptTools(\n    agentDir,\n    input.scripts,\n    toolEnv,\n    \"/library/scripts\",\n    runtime.interpreters,\n    null,\n    keepIn.readable,\n  );\n  // The translator, when the provider speaks Chat Completions: a loopback\n  // server for the length of this step. Its env replaces the endpoint the\n  // host assembled; the provider's real URL and key stay inside it.\n  const translator = input.translator ? await startTranslator(input.translator) : null;\n  if (translator) {\n    Object.assign(env, translator.env);\n    emit(\"info\", \"translator: listening on \" + translator.baseUrl + \" for \" + (input.translator.label ?? input.translator.upstreamBase));\n  }\n  const consult = buildConsultTools(input.consults ?? [], env, emit);\n  // The platform's own two groups, rebuilt from values like everything else.\n  const search = buildSearchTools(input.search ?? []);\n  const history = input.history?.length ? buildHistoryTools(input.history) : { server: null };\n  const desks = input.desks?.length ? buildDeskTools(input.desks) : { server: null };\n  // A person in the loop, over the proxy this step's lease already names:\n  // ask_person when tools: [ask], and the run's inbox after every tool call.\n  const channel = httpChannel(env.FOLDRUN_EGRESS);\n  const ask = input.ask ? buildAskTool({ channel, timeoutSec: input.ask.timeoutSec, emit }) : { server: null };\n  const peers = input.peers ? buildPeerTools({ channel, self: input.peers.self, siblings: input.peers.siblings, emit }) : { server: null };\n  const inbox = channel ? inboxReader(channel, emit) : undefined;\n  // sandbox: own sub-agents: a tool each, whose job runs in its own sandbox\n  // on the worker, reached over the same proxy door.\n  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec, workspaceRoot: \"/workspace\" }) : { server: null };\n\n  // Keyless cloud identities (FOLDRUN_IDENTITIES): each token file kept\n  // fresh through the proxy's /identity door, which mints only what this\n  // step's lease was granted. Fetched before the step starts, renewed five\n  // minutes before it expires (with jitter); a failure is said and retried.\n  // Plain JS: this text is the driver, not TypeScript.\n  const identityNames = (env.FOLDRUN_IDENTITIES || \"\").split(\",\").filter(Boolean);\n  if (identityNames.length) {\n    // No backslashes: this sits inside a template literal, which eats them.\n    const ep = new RegExp(\"^(https?://[^/]+)/e/([A-Za-z0-9_-]{16,})/?$\").exec(env.FOLDRUN_EGRESS || \"\");\n    const dir = env.FOLDRUN_IDENTITY_DIR || \"/tmp/foldrun-identity\";\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    const keepFresh = async (name) => {\n      let wait = 30000;\n      try {\n        if (!ep) throw new Error(\"no egress proxy to ask\");\n        const res = await fetch(ep[1] + \"/identity/\" + ep[2] + \"/\" + name, { signal: AbortSignal.timeout(15000) });\n        const body = await res.json().catch(() => ({}));\n        if (!res.ok || !body.token) throw new Error((body.error && body.error.message) || (\"proxy answered \" + res.status));\n        const file = dir + \"/\" + name.toLowerCase() + \".jwt\";\n        fs.writeFileSync(file + \".tmp\", body.token, { mode: 0o600 });\n        fs.renameSync(file + \".tmp\", file);\n        wait = Math.max(30000, body.expiresAt - Date.now() - 300000 + Math.floor(Math.random() * 60000) - 30000);\n      } catch (err) {\n        emit(\"error\", \"identity \" + name + \": \" + (err && err.message ? err.message : String(err)) + \" \u2014 trying again in 30s\");\n      }\n      setTimeout(() => { void keepFresh(name); }, wait).unref();\n    };\n    await Promise.all(identityNames.map(keepFresh));\n  }\n\n  mark(\"tools\");\n  const outcome = await executeStep({\n    agentDir,\n    workspaceRoot: \"/workspace\",\n    libraryRoot: \"/library\",\n    prompt: input.prompt,\n    model: input.model,\n    effort: input.effort ?? null,\n    systemPrompt: input.systemPrompt,\n    allowed: input.allowed,\n    mcpNames: input.mcpNames,\n    mcpServers: {\n      ...(api.server ? { foldrun_apis: api.server } : {}),\n      ...(script.server ? { foldrun_scripts: script.server } : {}),\n      ...(consult.server ? { foldrun_agents: consult.server } : {}),\n      ...(search.server ? { foldrun_search: search.server } : {}),\n      ...(history.server ? { foldrun_history: history.server } : {}),\n      ...(desks.server ? { foldrun_desks: desks.server } : {}),\n      ...(ask.server ? { foldrun_ask: ask.server } : {}),\n      ...(peers.server ? { foldrun_peers: peers.server } : {}),\n      ...(delegate.server ? { foldrun_delegate: delegate.server } : {}),\n      ...(install.server ? { foldrun_install: install.server } : {}),\n      ...input.mcpServers,\n    },\n    ...(inbox ? { inbox } : {}),\n    ...(input.subagents?.length ? { subagents: input.subagents } : {}),\n    env,\n    timeoutSec: input.timeoutSec,\n    budgetUsd: input.budgetUsd,\n    budgetNote: input.budgetNote,\n    price: input.price,\n    verify: input.verify,\n    verifyEnv: toolEnv,\n    ...(typeof input.judgeModel === \"string\" ? { judgeModel: input.judgeModel } : {}),\n    ...(typeof input.judgeEffort === \"string\" ? { judgeEffort: input.judgeEffort } : {}),\n    output: input.output,\n    schema: input.schema,\n    maxTurns: input.maxTurns,\n    ...(input.capture === \"metadata\" || input.capture === \"full\" ? { capture: input.capture } : {}),\n    ...(input.limits && Object.keys(input.limits).length ? { limits: input.limits, toolOwners: input.toolOwners ?? {} } : {}),\n    ...(input.hookNames?.length ? { hookNames: input.hookNames, hookBase: input.hookBase ?? {} } : {}),\n    // Slim browsing: the platform put this step on the slim image to browse\n    // through the account's pod, and named the file the web tool logs its\n    // reconnects to. A lost pod stops the step; what it wrote decides what\n    // the runner does next (browser-pod.ts).\n    ...(env.FOLDRUN_BROWSER_POD_EVENTS ? { browserPod: { events: env.FOLDRUN_BROWSER_POD_EVENTS, methods: api.methods ?? {}, paidWeb: paidWebActions(env), ...(env.FOLDRUN_BROWSER_INIT ? { browseInit: env.FOLDRUN_BROWSER_INIT } : {}) } } : {}),\n    // The container is the boundary; the SDK's own bash sandbox here would\n    // only block declared network use (SSH, curl) for no added safety.\n    sandboxBash: false,\n    emit,\n  });\n  for (const line of api.drainLog()) emit(\"info\", \"api: \" + line);\n  for (const line of script.drainLog()) emit(\"info\", \"script: \" + line);\n  if (translator) {\n    for (const line of translator.drainLog()) emit(\"info\", line.startsWith(\"translator\") ? line : \"translator: \" + line);\n    await translator.close();\n  }\n  // A consult's spend belongs to the step that asked.\n  const consultCost = consult.drainCost();\n  if (consultCost > 0) outcome.costUsd = (outcome.costUsd ?? 0) + consultCost;\n  if (consultCost > 0 && typeof outcome.turnsCostUsd === \"number\") outcome.turnsCostUsd += consultCost;\n  process.stdout.write(JSON.stringify({ e: \"done\", ...outcome, res: readActuals() }) + \"\\n\");\n  process.exit(0);\n} catch (err) {\n  emit(\"error\", err instanceof Error ? err.message : String(err));\n  // The failure path reports actuals too \u2014 a step that died eleven minutes\n  // in still held its slice for eleven minutes, and the failed runs are\n  // exactly the ones whose resource story gets read.\n  let res = null;\n  try { res = readActuals(); } catch { /* the reading must never mask the error */ }\n  process.stdout.write(JSON.stringify({ e: \"done\", status: \"failed\", result: null, costUsd: null, res }) + \"\\n\");\n  process.exit(0);\n}\n";
 /** The uv release copied into the image. Pinned: a floating uv is a floating
  *  resolver, and the runtime cache is keyed on the declaration, not on it. */
 export declare const UV_VERSION = "0.11.25";

package/dist/src/run-container.js

@@ -259,6 +259,26 @@ export function mergeAppends(was, host, next) {
 }
 export function applyContainerChanges(hostWs, containerWs, baseline, note, divert) {
     const applied = [];
+    // Files a sandbox: own job's reply copied into this sandbox mid-step
+    // (delegate-tools.ts copyBackFiles), path → sha256 of what was written: for
+    // those, that is what the step started from. The job's change is already on
+    // the workspace; read against the older baseline it came back as the
+    // step's own and was merged in a second time (Codex review, 23 Oct 2026).
+    let imported = {};
+    try {
+        // Read here, on the host: a link the step planted is never followed,
+        // the same rule as every file below.
+        const dir = path.join(containerWs, ".foldrun");
+        const file = path.join(dir, "copied-back.json");
+        if (fs.lstatSync(dir).isDirectory() && fs.lstatSync(file).isFile()) {
+            const m = JSON.parse(fs.readFileSync(file, "utf8"));
+            if (m && typeof m === "object" && !Array.isArray(m))
+                imported = m;
+        }
+    }
+    catch {
+        /* none copied back */
+    }
     const walk = (dir) => {
         for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
             const abs = path.join(dir, entry.name);
@@ -289,6 +309,9 @@ export function applyContainerChanges(hostWs, containerWs, baseline, note, diver
             else if (baseline) {
                 was = baseline[rel.replaceAll("\\", "/")] ?? null;
             }
+            const importedSha = imported[rel.replaceAll("\\", "/")];
+            if (typeof importedSha === "string")
+                was = importedSha;
             const same = (b) => was === null || was === undefined ? false : typeof was === "string" ? sha(b) === was : b.equals(was);
             // Untouched by this step: whatever the host says now is more current
             // than what we handed in, including a change made while it ran.
@@ -579,7 +602,7 @@ try {
   const inbox = channel ? inboxReader(channel, emit) : undefined;
   // sandbox: own sub-agents: a tool each, whose job runs in its own sandbox
   // on the worker, reached over the same proxy door.
-  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec }) : { server: null };
+  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec, workspaceRoot: "/workspace" }) : { server: null };
 
   // Keyless cloud identities (FOLDRUN_IDENTITIES): each token file kept
   // fresh through the proxy's /identity door, which mints only what this

package/dist/src/runner.js

@@ -34,7 +34,7 @@ const isolatedRun = () => {
 };
 import { gatherConsults, buildConsultTools } from "./agent-tools.js";
 import { DELEGATE_TOOL, gatherSubagents, ownSandbox, subagentPrompt, subagentTools } from "./subagents.js";
-import { DELEGATE_SERVER, buildDelegateTools, delegatePromptLine, delegateToolNames, localDelegateChannel } from "./delegate-tools.js";
+import { DELEGATE_SERVER, buildDelegateTools, delegatePromptLine, delegateToolNames, localDelegateChannel, readCopyBack } from "./delegate-tools.js";
 import { ASK_TOOL, PEER_TOOLS, applyOperatorEvent, askPromptLine, askTimeoutSec, buildAskTool, buildPeerTools, inboxReader, localPeerBus, peersPromptLine } from "./operator.js";
 import { sendPlainNotification } from "./notify.js";
 import { TOOL_MAP, BUILTIN_TOOLS, ownToolNames, toolRefs, legacyUseNames, legacyUseError, retiredToolNames, retiredToolError } from "./tool-names.js";
@@ -4875,10 +4875,15 @@ function driveRunInner(tenant, workspace, run, modelOverride, tags, opts) {
                     entry.ms = Date.now() - started;
                     save();
                     const errors = child.events.filter((e) => e.type === "error").map((e) => e.text).join("\n");
+                    // Its files go back with the reply, so the delegating step's
+                    // sandbox has them too (delegate-tools.ts copyBackFiles).
+                    const back = readCopyBack(pDir, child.wrote ?? []);
                     return {
                         status,
                         result: child.result ?? (errors || "(no reply)"),
                         wrote: child.wrote ?? [],
+                        files: back.files,
+                        filesOmitted: back.omitted,
                     };
                 };
                 // An agent's own `budget:` — the most it may spend in one run — is

package/dist/src/scan.js

@@ -662,7 +662,7 @@ function scanAgents(agents, outward, toolDefs, push, networks) {
             const extra = refNames(sub.data.tools).filter((t) => !tools.includes(t));
             if (sub.data.sandbox === "own") {
                 if (extra.length) {
-                    push("security/subagent-own-sandbox", a.file, keyLine(a.lines, "subagents"), `subagent ${s} own ${extra.join(",")}`, `subagents: [${s}] — ${s} runs in its own sandbox with ${extra.join(", ")}, which ${a.name} does not have; only its reply comes back`);
+                    push("security/subagent-own-sandbox", a.file, keyLine(a.lines, "subagents"), `subagent ${s} own ${extra.join(",")}`, `subagents: [${s}] — ${s} runs in its own sandbox with ${extra.join(", ")}, which ${a.name} does not have; only its reply and the files it wrote come back`);
                 }
                 continue;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldrun/core",
-  "version": "2.9.0",
+  "version": "2.10.0",
   "description": "Agents are just folders. The format, the runner, the checks.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/src/delegate-tools.ts

@@ -14,9 +14,12 @@
 // one door it has (the egress proxy, at its lease — operator.ts), and the
 // worker runs the job as a step of its own: its own pod, its own `tools:`,
 // `secrets:` and `network:` from its own file, NOT cut to the parent's — the
-// parent may hold less. The parent waits and gets the reply text, nothing
-// else. What the sub-agent wrote reaches the workspace when it finishes, so
-// the next step sees it; the reply names the paths.
+// parent may hold less. The parent waits and gets the reply text. What the
+// sub-agent wrote reaches the workspace when it finishes, and comes back with
+// the reply into the parent's sandbox too (copyBackFiles), so the parent's
+// model and its `verify:` see it there: a `verify: file:` on the delegating
+// step used to fail on a file the job had written (owner, 23 Oct 2026). What
+// is too large to send back still reaches the workspace for the next step.
 //
 // Depth one, as for every sub-agent: the job's own `subagents:` are not
 // offered to it. Its record sits in the run after the parent's, marked
@@ -25,6 +28,9 @@
 // With no channel (a container step on an install without a proxy) the tools
 // are not granted at all; the runner says so on the step.
 
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
 import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
 import { z } from "zod";
 import type { DelegationResult, OperatorChannel } from "./operator.ts";
@@ -37,6 +43,193 @@ export const JOB_MAX = 20_000;
 /** What comes back is cut here: the reply is the parent's context. */
 export const REPLY_MAX = 40_000;
 
+/** What one job's files may add up to when copied back into the parent's
+ *  sandbox, and the most files. They travel with the reply through the
+ *  operator store, so the cap is on the raw bytes before base64. */
+export const COPY_BACK_MAX_BYTES = 4 * 1024 * 1024;
+export const COPY_BACK_MAX_FILES = 100;
+
+/** A workspace-relative path that stays inside the workspace. */
+function insideRel(rel: string): string | null {
+  const norm = path.posix.normalize(String(rel).replaceAll("\\", "/"));
+  if (!norm || norm === "." || norm.startsWith("../") || norm === ".." || path.posix.isAbsolute(norm)) return null;
+  return norm;
+}
+
+/** Read what a job wrote, on the host, for the trip back to the parent's
+ *  sandbox: files only (no links), confined to the workspace, until the cap.
+ *  What does not fit is named, never cut. */
+export function readCopyBack(workspaceDir: string, wrote: string[]): { files: { path: string; base64: string }[]; omitted: string[] } {
+  const files: { path: string; base64: string }[] = [];
+  const omitted: string[] = [];
+  let total = 0;
+  const root = path.resolve(workspaceDir);
+  let realRoot: string;
+  try {
+    realRoot = fs.realpathSync(root);
+  } catch {
+    return { files, omitted };
+  }
+  for (const w of [...new Set(wrote)]) {
+    const rel = insideRel(w);
+    if (!rel) continue;
+    const abs = path.join(root, rel);
+    let st: fs.Stats;
+    try {
+      st = fs.lstatSync(abs);
+      // A directory link on the way must not lead out of the workspace:
+      // what is read here goes into another sandbox (Codex review).
+      const real = fs.realpathSync(abs);
+      if (real !== realRoot && !real.startsWith(realRoot + path.sep)) continue;
+    } catch {
+      continue; // written then removed by the job
+    }
+    if (!st.isFile()) continue;
+    if (files.length >= COPY_BACK_MAX_FILES || total + st.size > COPY_BACK_MAX_BYTES) {
+      omitted.push(rel);
+      continue;
+    }
+    const buf = fs.readFileSync(abs);
+    total += buf.length;
+    files.push({ path: rel, base64: buf.toString("base64") });
+  }
+  return { files, omitted };
+}
+
+/** Where a sandbox notes what was copied back into it: path → sha256 of the
+ *  bytes written. The step's copy-out reads it (run-container.ts
+ *  applyContainerChanges) as what those files held before the step touched
+ *  them, so a job's change already on the workspace is not applied twice.
+ *  Under .foldrun/, which is never copied back as content. */
+export const COPY_BACK_MANIFEST = ".foldrun/copied-back.json";
+
+const sha256 = (b: Buffer) => crypto.createHash("sha256").update(b).digest("hex");
+
+const exists = (p: string) => {
+  try {
+    fs.lstatSync(p);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+/** The manifest's folder and file, unless either is something other than a
+ *  real directory and file — a link planted there is never followed. */
+function manifestPath(root: string): string | null {
+  const dir = path.join(root, path.dirname(COPY_BACK_MANIFEST));
+  const file = path.join(root, COPY_BACK_MANIFEST);
+  try {
+    if (!fs.lstatSync(dir).isDirectory()) return null;
+  } catch {
+    return file; // neither exists yet
+  }
+  try {
+    if (!fs.lstatSync(file).isFile()) return null;
+  } catch {
+    /* new file */
+  }
+  return file;
+}
+
+function writeManifest(root: string, manifest: Record<string, string>): void {
+  const file = manifestPath(root);
+  if (!file) return;
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(manifest), { flag: "w" });
+}
+
+/** The manifest of a sandbox's workspace, or {}. */
+export function readCopyBackManifest(workspaceRoot: string): Record<string, string> {
+  const file = manifestPath(path.resolve(workspaceRoot));
+  if (!file) return {};
+  try {
+    const m = JSON.parse(fs.readFileSync(file, "utf8"));
+    return m && typeof m === "object" && !Array.isArray(m) ? (m as Record<string, string>) : {};
+  } catch {
+    return {};
+  }
+}
+
+/** Write a job's files into this sandbox's workspace. A path that would leave
+ *  it, or land through a link, is refused. A file the step itself changed
+ *  since `since` (its own edit, not one copied back) is not overwritten: the
+ *  job's version goes beside it as `<name>.from-<agent><ext>`. */
+export function copyBackFiles(
+  workspaceRoot: string,
+  files: { path: string; base64: string }[],
+  opts: { since?: number; from?: string } = {},
+): { copied: string[]; conflicts: { path: string; copy: string }[] } {
+  const root = path.resolve(workspaceRoot);
+  const manifest = readCopyBackManifest(root);
+  const copied: string[] = [];
+  const conflicts: { path: string; copy: string }[] = [];
+  // Every directory on the way must be a real one inside the workspace: a
+  // link the step planted must not carry the write elsewhere.
+  const safeDirs = (abs: string): boolean => {
+    let dir = path.dirname(abs);
+    const chain: string[] = [];
+    while (dir.startsWith(root + path.sep)) {
+      chain.unshift(dir);
+      dir = path.dirname(dir);
+    }
+    for (const d of chain) {
+      try {
+        if (!fs.lstatSync(d).isDirectory()) return false;
+      } catch {
+        fs.mkdirSync(d);
+      }
+    }
+    return true;
+  };
+  for (const f of files) {
+    const rel = insideRel(f.path);
+    if (!rel) continue;
+    let target = rel;
+    let abs = path.join(root, rel);
+    if (!safeDirs(abs)) continue;
+    let st: fs.Stats | null = null;
+    try {
+      st = fs.lstatSync(abs);
+    } catch {
+      /* new file */
+    }
+    if (st && !st.isFile()) continue;
+    const bytes = Buffer.from(f.base64, "base64");
+    if (st) {
+      const now = fs.readFileSync(abs);
+      if (now.equals(bytes)) {
+        manifest[rel] = sha256(bytes);
+        copied.push(rel);
+        continue;
+      }
+      const ours = manifest[rel] === sha256(now);
+      const editedHere = !ours && opts.since !== undefined && st.mtimeMs > opts.since;
+      if (editedHere) {
+        // A name nothing has yet: an earlier conflict copy may be the step's
+        // own work by now (Codex review).
+        const ext = path.posix.extname(rel);
+        const stem = `${rel.slice(0, rel.length - ext.length)}.from-${(opts.from ?? "subagent").replace(/[^A-Za-z0-9_-]/g, "-")}`;
+        for (let n = 1; ; n++) {
+          target = `${stem}${n === 1 ? "" : `-${n}`}${ext}`;
+          abs = path.join(root, target);
+          if (!exists(abs)) break;
+        }
+        // Not in the manifest: this copy is not on the workspace yet, and
+        // the copy-out must carry it there.
+        fs.writeFileSync(abs, bytes);
+        conflicts.push({ path: rel, copy: target });
+        continue;
+      }
+    }
+    fs.writeFileSync(abs, bytes);
+    manifest[rel] = sha256(bytes);
+    copied.push(rel);
+  }
+  if (copied.length || conflicts.length) writeManifest(root, manifest);
+  return { copied, conflicts };
+}
+
 type Emit = (type: "text" | "tool" | "info" | "error", text: string, extra?: EventExtra) => void;
 
 /** The granted names, the same on every path. */
@@ -44,13 +237,23 @@ export function delegateToolNames(specs: DelegateSpec[]): string[] {
   return specs.map((s) => `mcp__${DELEGATE_SERVER}__${delegateToolName(s.name)}`);
 }
 
-/** The reply as the parent reads it: the sub-agent's words, then what it changed. */
-export function replyText(name: string, r: DelegationResult): string {
+/** The reply as the parent reads it: the sub-agent's words, then what it
+ *  changed — `copied` are the paths now in this sandbox too. */
+export function replyText(name: string, r: DelegationResult, copied: string[] = [], conflicts: { path: string; copy: string }[] = []): string {
   const body = r.result.trim() || "(no reply)";
   const cut = body.length > REPLY_MAX ? `${body.slice(0, REPLY_MAX)}\n…(cut at ${REPLY_MAX} characters)` : body;
-  const wrote = r.wrote?.length
-    ? `\n\nFiles ${name} changed (in the workspace from the next step on — not in your sandbox):\n${r.wrote.slice(0, 200).map((w) => `- ${w}`).join("\n")}`
-    : "";
+  const here = new Set([...copied, ...conflicts.map((c) => c.path)]);
+  const elsewhere = (r.wrote ?? []).filter((w) => !here.has(w));
+  const wrote =
+    (copied.length
+      ? `\n\nFiles ${name} changed, copied into your sandbox at the same paths:\n${copied.slice(0, 200).map((w) => `- ${w}`).join("\n")}`
+      : "") +
+    (conflicts.length
+      ? `\n\nFiles you had changed yourself, which ${name} changed too — yours are kept; its version is beside each:\n${conflicts.slice(0, 200).map((c) => `- ${c.path} → ${c.copy}`).join("\n")}`
+      : "") +
+    (elsewhere.length
+      ? `\n\nFiles ${name} changed that are not in your sandbox (too large to copy back — in the workspace from the next step on):\n${elsewhere.slice(0, 200).map((w) => `- ${w}`).join("\n")}`
+      : "");
   const head = r.status === "completed" ? "" : `${name} did not finish (${r.status}). What it said:\n`;
   return head + cut + wrote;
 }
@@ -61,9 +264,14 @@ export function buildDelegateTools(opts: {
   emit: Emit;
   /** The most one job may run; the step's own timeout bounds it anyway. */
   timeoutSec?: number;
+  /** This sandbox's workspace: where a job's files are copied back. Absent
+   *  in-process, where the job wrote the same workspace already. */
+  workspaceRoot?: string;
   now?: () => number;
 }) {
   const now = opts.now ?? Date.now;
+  // Anything in this sandbox newer than this, the step changed itself.
+  const startedAt = Date.now();
   const channel = opts.channel;
   if (!opts.specs.length || !channel?.delegate || !channel.delegation) {
     return { server: null, toolNames: [] as string[], calls: {} as Record<string, (job: string) => Promise<unknown>> };
@@ -90,8 +298,20 @@ export function buildDelegateTools(opts: {
         continue;
       }
       if (got) {
-        opts.emit(got.status === "completed" ? "info" : "error", `${s.name} ${got.status}${got.wrote?.length ? ` — changed ${got.wrote.length} file(s)` : ""}`, { subagent: s.name });
-        return text(replyText(s.name, got), got.status !== "completed");
+        let copied: string[] = [];
+        let conflicts: { path: string; copy: string }[] = [];
+        if (opts.workspaceRoot && got.files?.length) {
+          try {
+            ({ copied, conflicts } = copyBackFiles(opts.workspaceRoot, got.files, { since: startedAt, from: s.name }));
+          } catch (err) {
+            opts.emit("error", `could not copy ${s.name}'s files into this sandbox: ${err instanceof Error ? err.message : String(err)}`, { subagent: s.name });
+          }
+        }
+        const back = copied.length || conflicts.length
+          ? `; ${copied.length} copied into this sandbox${conflicts.length ? `, ${conflicts.length} kept beside the step's own edit` : ""}`
+          : "";
+        opts.emit(got.status === "completed" ? "info" : "error", `${s.name} ${got.status}${got.wrote?.length ? ` — changed ${got.wrote.length} file(s)${back}` : ""}`, { subagent: s.name });
+        return text(replyText(s.name, got, opts.workspaceRoot ? copied : (got.wrote ?? []), conflicts), got.status !== "completed");
       }
     }
     try {
@@ -168,7 +388,7 @@ export function localDelegateChannel(
 export function delegatePromptLine(specs: DelegateSpec[]): string {
   return (
     `<isolated-subagents>\nThese colleagues work in their own sandbox, with their own tools; call the tool to hand one a job ` +
-    `and you get back its reply and the paths of any files it changed:\n` +
+    `and you get back its reply, with the files it changed copied into your sandbox at the same paths:\n` +
     specs.map((s) => `- ${delegateToolName(s.name)}: ${s.description}`).join("\n") +
     `\n</isolated-subagents>`
   );

package/src/operator.ts

@@ -117,6 +117,12 @@ export interface DelegationResult {
   /** Workspace paths it changed. They reach the workspace when it ends, so
    *  the next step sees them; the delegating step's own sandbox does not. */
   wrote?: string[];
+  /** What it wrote, copied back into the delegating step's sandbox, so the
+   *  parent's model and its `verify:` see it there (copyBackFiles), base64. */
+  files?: { path: string; base64: string }[];
+  /** Written paths too large to copy back: they reach the workspace when the
+   *  job ends, so the next step sees them. */
+  filesOmitted?: string[];
 }
 
 export const QUESTION_MAX = 2_000;
@@ -217,6 +223,13 @@ export function httpChannel(egress: string | undefined | null, fetchImpl: typeof
         status,
         result: typeof body.result === "string" ? body.result : "",
         wrote: Array.isArray(body.wrote) ? (body.wrote as unknown[]).filter((w): w is string => typeof w === "string") : [],
+        files: Array.isArray(body.files)
+          ? (body.files as unknown[]).filter(
+              (f): f is { path: string; base64: string } =>
+                !!f && typeof (f as { path?: unknown }).path === "string" && typeof (f as { base64?: unknown }).base64 === "string",
+            )
+          : [],
+        filesOmitted: Array.isArray(body.filesOmitted) ? (body.filesOmitted as unknown[]).filter((w): w is string => typeof w === "string") : [],
       };
     },
     async cancelDelegation(id) {

package/src/run-container.ts

@@ -412,6 +412,24 @@ export function applyContainerChanges(
   divert?: WriteDivert,
 ): string[] {
   const applied: string[] = [];
+  // Files a sandbox: own job's reply copied into this sandbox mid-step
+  // (delegate-tools.ts copyBackFiles), path → sha256 of what was written: for
+  // those, that is what the step started from. The job's change is already on
+  // the workspace; read against the older baseline it came back as the
+  // step's own and was merged in a second time (Codex review, 23 Oct 2026).
+  let imported: Record<string, string> = {};
+  try {
+    // Read here, on the host: a link the step planted is never followed,
+    // the same rule as every file below.
+    const dir = path.join(containerWs, ".foldrun");
+    const file = path.join(dir, "copied-back.json");
+    if (fs.lstatSync(dir).isDirectory() && fs.lstatSync(file).isFile()) {
+      const m = JSON.parse(fs.readFileSync(file, "utf8"));
+      if (m && typeof m === "object" && !Array.isArray(m)) imported = m as Record<string, string>;
+    }
+  } catch {
+    /* none copied back */
+  }
   const walk = (dir: string) => {
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
       const abs = path.join(dir, entry.name);
@@ -438,6 +456,8 @@ export function applyContainerChanges(
       } else if (baseline) {
         was = baseline[rel.replaceAll("\\", "/")] ?? null;
       }
+      const importedSha = imported[rel.replaceAll("\\", "/")];
+      if (typeof importedSha === "string") was = importedSha;
       const same = (b: Buffer) =>
         was === null || was === undefined ? false : typeof was === "string" ? sha(b) === was : b.equals(was);
       // Untouched by this step: whatever the host says now is more current
@@ -735,7 +755,7 @@ try {
   const inbox = channel ? inboxReader(channel, emit) : undefined;
   // sandbox: own sub-agents: a tool each, whose job runs in its own sandbox
   // on the worker, reached over the same proxy door.
-  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec }) : { server: null };
+  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec, workspaceRoot: "/workspace" }) : { server: null };
 
   // Keyless cloud identities (FOLDRUN_IDENTITIES): each token file kept
   // fresh through the proxy's /identity door, which mints only what this

package/src/runner.ts

@@ -38,7 +38,7 @@ const isolatedRun = () => {
 };
 import { gatherConsults, buildConsultTools } from "./agent-tools.ts";
 import { DELEGATE_TOOL, gatherSubagents, ownSandbox, subagentPrompt, subagentTools, type DelegateSpec, type SubagentSpec } from "./subagents.ts";
-import { DELEGATE_SERVER, buildDelegateTools, delegatePromptLine, delegateToolNames, localDelegateChannel } from "./delegate-tools.ts";
+import { DELEGATE_SERVER, buildDelegateTools, delegatePromptLine, delegateToolNames, localDelegateChannel, readCopyBack } from "./delegate-tools.ts";
 import type { DelegationResult } from "./operator.ts";
 import type { StepDelegation } from "./store.ts";
 import { ASK_TOOL, PEER_TOOLS, applyOperatorEvent, askPromptLine, askTimeoutSec, buildAskTool, buildPeerTools, inboxReader, localPeerBus, peersPromptLine, type PeerInfo } from "./operator.ts";
@@ -5130,10 +5130,15 @@ function driveRunInner(
           entry.ms = Date.now() - started;
           save();
           const errors = child.events.filter((e) => e.type === "error").map((e) => e.text).join("\n");
+          // Its files go back with the reply, so the delegating step's
+          // sandbox has them too (delegate-tools.ts copyBackFiles).
+          const back = readCopyBack(pDir, child.wrote ?? []);
           return {
             status,
             result: child.result ?? (errors || "(no reply)"),
             wrote: child.wrote ?? [],
+            files: back.files,
+            filesOmitted: back.omitted,
           };
         };
         // An agent's own `budget:` — the most it may spend in one run — is

package/src/scan.ts

@@ -739,7 +739,7 @@ function scanAgents(agents: AgentFacts[], outward: Set<string>, toolDefs: Map<st
       if (sub.data.sandbox === "own") {
         if (extra.length) {
           push("security/subagent-own-sandbox", a.file, keyLine(a.lines, "subagents"), `subagent ${s} own ${extra.join(",")}`,
-            `subagents: [${s}] — ${s} runs in its own sandbox with ${extra.join(", ")}, which ${a.name} does not have; only its reply comes back`);
+            `subagents: [${s}] — ${s} runs in its own sandbox with ${extra.join(", ")}, which ${a.name} does not have; only its reply and the files it wrote come back`);
         }
         continue;
       }