@foldrun/core 3.0.0 → 5.0.0

package/dist/src/bounded-match.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Does `text` match `pattern`? `*` matches within one path segment, `**`
+ * across segments; every other character is itself. O(pattern × text).
+ */
+export declare function globMatch(pattern: string, text: string): boolean;
+/** A regex test that gives up after `ms`: true, false, or "timeout". Throws
+ *  on a pattern that does not compile, as `new RegExp` would. */
+export declare function boundedRegexTest(source: string, flags: string, text: string, ms?: number): boolean | "timeout";

package/dist/src/bounded-match.js

@@ -0,0 +1,80 @@
+// Matching on the shared worker and web pod against tenant-written patterns.
+//
+// A regular expression or a glob a tenant writes runs here, not in their
+// sandbox (an eval's `matches:`, a gate's `preview:`). A pattern that
+// backtracks — `(a+)+$`, or `**a**a**a**b` turned into `.*a.*a.*a.*b` —
+// holds the one event loop every account shares. So: globs match in linear
+// time with no regex at all, and a regex runs under a time limit
+// (29 Oct 2026, OWASP review).
+import vm from "node:vm";
+/**
+ * Does `text` match `pattern`? `*` matches within one path segment, `**`
+ * across segments; every other character is itself. O(pattern × text).
+ */
+export function globMatch(pattern, text) {
+    const toks = [];
+    for (let i = 0; i < pattern.length;) {
+        if (pattern[i] === "*") {
+            if (pattern[i + 1] === "*") {
+                i += 2;
+                while (pattern[i] === "*")
+                    i++;
+                // "**" swallows a neighbouring "**" or "*": the same set either way.
+                if (toks[toks.length - 1] !== "**")
+                    toks.push("**");
+            }
+            else {
+                i++;
+                if (toks[toks.length - 1] !== "**" && toks[toks.length - 1] !== "*")
+                    toks.push("*");
+            }
+        }
+        else {
+            toks.push(pattern[i]);
+            i++;
+        }
+    }
+    const n = text.length;
+    let cur = new Array(n + 1).fill(false);
+    cur[0] = true;
+    for (const t of toks) {
+        const next = new Array(n + 1).fill(false);
+        if (t === "**") {
+            let on = false;
+            for (let j = 0; j <= n; j++) {
+                on = on || cur[j];
+                next[j] = on;
+            }
+        }
+        else if (t === "*") {
+            let on = false;
+            for (let j = 0; j <= n; j++) {
+                if (cur[j])
+                    on = true;
+                next[j] = on;
+                if (j < n && text[j] === "/")
+                    on = false;
+            }
+        }
+        else {
+            for (let j = 0; j < n; j++)
+                if (cur[j] && text[j] === t)
+                    next[j + 1] = true;
+        }
+        cur = next;
+    }
+    return cur[n];
+}
+/** A regex test that gives up after `ms`: true, false, or "timeout". Throws
+ *  on a pattern that does not compile, as `new RegExp` would. */
+export function boundedRegexTest(source, flags, text, ms = 250) {
+    new RegExp(source, flags); // compile here: a syntax error is the caller's to report
+    try {
+        return vm.runInNewContext("new RegExp(p, f).test(t)", { p: source, f: flags, t: text }, { timeout: ms }) === true;
+    }
+    catch (err) {
+        if (err.code === "ERR_SCRIPT_EXECUTION_TIMEOUT")
+            return "timeout";
+        throw err;
+    }
+}

package/dist/src/deploy.js

@@ -61,6 +61,10 @@ const IN_WORKSPACE_DIR = new RegExp(`^(${WORKSPACE_DIRS.join("|")})/`);
 export function isSourcePath(rel) {
     const norm = rel.replaceAll("\\", "/");
     const parts = norm.split("/");
+    // A path that climbs, is absolute or has an empty segment is never a
+    // workspace file — and `foldrun pull` writes what this accepts to disk.
+    if (norm.startsWith("/") || /^[a-zA-Z]:/.test(norm) || parts.some((p) => p === ".." || p === "." || p === ""))
+        return false;
     if (parts.some((p) => NOT_SOURCE.has(p)))
         return false;
     if (NOT_SOURCE_FILE.has(parts[parts.length - 1]))

package/dist/src/evals.js

@@ -40,6 +40,8 @@ import { deployedCommit } from "./deploy.js";
 import { latestRevisionId } from "./history.js";
 import matter from "./matter.js";
 import { spawn } from "node:child_process";
+import { hostSafeEnv } from "./host-env.js";
+import { boundedRegexTest } from "./bounded-match.js";
 import { judgeVerdict, JUDGE_VERDICT_INSTRUCTION, parseJudge } from "./judge-verdict.js";
 import { readAgentsMdKeys } from "./agents-md.js";
 import { query } from "@anthropic-ai/claude-agent-sdk";
@@ -443,7 +445,8 @@ async function waitForRun(tenant, workspace, runId) {
 }
 function shell(command, cwd) {
     return new Promise((resolve) => {
-        const child = spawn("bash", ["-lc", command], { cwd });
+        // Never the platform's own environment: keys, database URL, tokens.
+        const child = spawn("bash", ["-lc", command], { cwd, env: hostSafeEnv() });
         let out = "";
         const append = (c) => {
             if (out.length < 2000)
@@ -540,7 +543,10 @@ export async function checkAssertion(assertion, output, agentDir, model, effort,
         }
         case "matches": {
             try {
-                const passed = new RegExp(assertion.value, "i").test(output);
+                // Bounded: the pattern is the tenant's, the process is shared.
+                const passed = boundedRegexTest(assertion.value, "i", output);
+                if (passed === "timeout")
+                    return { assertion, passed: false, detail: "the pattern took too long to match — simplify it" };
                 return { assertion, passed, detail: passed ? "matched" : "no match" };
             }
             catch {
@@ -549,13 +555,20 @@ export async function checkAssertion(assertion, output, agentDir, model, effort,
         }
         case "file": {
             const target = path.resolve(agentDir, assertion.value);
-            if (!target.startsWith(path.resolve(agentDir))) {
+            if (!target.startsWith(path.resolve(agentDir) + path.sep)) {
                 return { assertion, passed: false, detail: "path escapes the agent directory" };
             }
             const exists = fs.existsSync(target) && fs.statSync(target).size > 0;
             return { assertion, passed: exists, detail: exists ? "present and non-empty" : "missing or empty" };
         }
         case "run": {
+            // A `run:` is the tenant's own shell command. On an install that
+            // isolates runs it would execute here, on the web pod, beside the
+            // platform's keys and every account's files — so it is refused there,
+            // as a hook's Test is. A laptop runs every step in-process anyway.
+            if (process.env.FOLDRUN_RUN_ISOLATION) {
+                return { assertion, passed: false, detail: "run: assertions are not executed on this install — check the output with contains:/matches:/judge:, or a file with file:; `foldrun eval` runs them on your own machine" };
+            }
             const { code, out } = await shell(assertion.value, agentDir);
             return { assertion, passed: code === 0, detail: `exit ${code ?? "error"}${out ? ` — ${out.slice(0, 200)}` : ""}` };
         }

package/dist/src/install-tool.js

@@ -12,7 +12,13 @@
 // pip and npm need no root and run here, as the agent, into a per-step
 // directory already on PATH / PYTHONPATH / NODE_PATH (stepInstallEnv), so the
 // next command finds what this one installed. Inside a run container all of
-// it goes when the container does. Every install is logged with the line to
+// it goes when the container does.
+//
+// No package runs its own code on the way in (FOL-98, 28 Oct 2026): npm
+// installs with --ignore-scripts (no preinstall/postinstall), and pip takes
+// built wheels only (--only-binary :all:) — an sdist's setup.py is code. A
+// package that has no wheel says so, and `runtime: packages:` builds it
+// before the step instead, where the build is declared, cached and seen. Every install is logged with the line to
 // add to the agent's `runtime:` to have it before the step starts next time.
 import fs from "node:fs";
 import net from "node:net";
@@ -86,27 +92,30 @@ export function buildInstallTool(opts) {
             fs.mkdirSync(target, { recursive: true });
             const uv = findUv();
             const res = uv
-                ? spawnSync(uv, ["pip", "install", "-q", "--python", opts.python, "--target", target, ...names], {
+                ? spawnSync(uv, ["pip", "install", "-q", "--only-binary", ":all:", "--python", opts.python, "--target", target, ...names], {
                     env: { ...opts.env, UV_CACHE_DIR: path.join(opts.cacheRoot, ".uv-cache"), UV_LINK_MODE: "copy", UV_NO_PROGRESS: "1" },
                     encoding: "utf8",
                     timeout: 600_000,
                 })
-                : spawnSync(opts.python, ["-m", "pip", "install", "-q", "--disable-pip-version-check", "--target", target, ...names], {
+                : spawnSync(opts.python, ["-m", "pip", "install", "-q", "--disable-pip-version-check", "--only-binary", ":all:", "--target", target, ...names], {
                     env: opts.env,
                     encoding: "utf8",
                     timeout: 600_000,
                 });
             if (res.status !== 0) {
-                const msg = summarizeInstallFailure(uv ? "uv pip install" : "pip install", `${res.stdout ?? ""}${res.stderr ?? ""}${res.error ? res.error.message : ""}`);
+                const raw = `${res.stdout ?? ""}${res.stderr ?? ""}${res.error ? res.error.message : ""}`;
+                const msg = summarizeInstallFailure(uv ? "uv pip install" : "pip install", raw);
                 opts.emit("error", `install: pip ${names.join(" ")} — ${msg.split("\n")[0]}`);
-                return text(msg, true);
+                // Wheels only: one that exists only as source is not built here.
+                const noWheel = /no matching distribution|only-binary|no wheels? (?:with|for)|binary.*not available|doesn't have a wheel|has no wheel/i.test(raw);
+                return text(noWheel ? `${msg}\n\nOnly built wheels are installed mid-step — a source package's build runs its own code. Declare it in the agent's runtime: packages: [${names.join(", ")}] to have it built before the step.` : msg, true);
             }
             how = `pip, ${Math.round((Date.now() - t0) / 1000)}s`;
         }
         else {
             const prefix = path.join(opts.dir, "npm");
             fs.mkdirSync(prefix, { recursive: true });
-            const res = spawnSync("npm", ["install", "--no-fund", "--no-audit", "--no-progress", "--prefix", prefix, ...names], {
+            const res = spawnSync("npm", ["install", "--ignore-scripts", "--no-fund", "--no-audit", "--no-progress", "--prefix", prefix, ...names], {
                 env: { ...opts.env, npm_config_cache: path.join(opts.cacheRoot, ".npm-cache") },
                 encoding: "utf8",
                 timeout: 600_000,

package/dist/src/mail.d.ts

@@ -79,10 +79,6 @@ export interface MailResult {
 }
 /** Does this person take this category of mail? Required mail: always. */
 export declare function mailWanted(tenant: string, email: string, category: MailCategory, workspace?: string | null): Promise<boolean>;
-/**
- * Send one message, honouring each recipient's preference for its
- * category. Optional mail is sent one recipient at a time so each copy
- * carries that reader's own unsubscribe token; required mail goes as one.
- * Never throws: a mail that fails is an `ok: false` with the reason.
- */
+/** Recipients this account may still send to today on the platform's key. */
+export declare function platformMailAllowance(tenant: string, category: string, key: string, now?: Date): number;
 export declare function sendMail(m: MailMessage): Promise<MailResult>;

package/dist/src/mail.js

@@ -188,7 +188,44 @@ export async function mailWanted(tenant, email, category, workspace = null) {
  * carries that reader's own unsubscribe token; required mail goes as one.
  * Never throws: a mail that fails is an `ok: false` with the reason.
  */
+// The platform's own sender is shared by every account, so its reputation
+// is everyone's. Mail an account can make the platform send to addresses it
+// typed (invites, notify:, approvals, low balance) is capped per account per
+// day on the platform's key; mail about the account's own sign-in, billing
+// and health is not. An account sending on its own key is its own business.
+// Counted in this process — a brake, not a ledger (29 Oct 2026: open signup
+// on dev let anyone send ~86k invites a day from hello@foldrun.io).
+const UNCAPPED = new Set(["security", "billing", "account"]);
+const PLATFORM_MAX_RECIPIENTS = 10;
+const platformDayCap = (category) => Number(process.env[category === "invites" ? "FOLDRUN_PLATFORM_INVITES_PER_DAY" : "FOLDRUN_PLATFORM_MAIL_PER_DAY"]) ||
+    (category === "invites" ? 25 : 200);
+const platformSent = new Map();
+/** Recipients this account may still send to today on the platform's key. */
+export function platformMailAllowance(tenant, category, key, now = new Date()) {
+    const platformKey = process.env.FOLDRUN_RESEND_API_KEY;
+    if (!platformKey || key !== platformKey || UNCAPPED.has(category))
+        return Infinity;
+    const used = platformSent.get(`${now.toISOString().slice(0, 10)}|${tenant}|${category === "invites" ? "invites" : "other"}`) ?? 0;
+    return Math.max(0, platformDayCap(category) - used);
+}
+function notePlatformSent(tenant, category, n, now = new Date()) {
+    const day = now.toISOString().slice(0, 10);
+    for (const k of platformSent.keys())
+        if (!k.startsWith(day))
+            platformSent.delete(k);
+    const k = `${day}|${tenant}|${category === "invites" ? "invites" : "other"}`;
+    platformSent.set(k, (platformSent.get(k) ?? 0) + n);
+}
 export async function sendMail(m) {
+    const allowance = platformMailAllowance(m.tenant, m.category, m.mail.key);
+    if (allowance !== Infinity) {
+        const n = recipients(m.to).length;
+        if (n > PLATFORM_MAX_RECIPIENTS) {
+            return { ok: false, error: `more than ${PLATFORM_MAX_RECIPIENTS} recipients on the platform's sender — set the account's own RESEND_API_KEY and EMAIL_FROM to send more`, sent: [], suppressed: [] };
+        }
+    }
+    const capped = allowance !== Infinity;
+    const overCap = `this account reached today's limit for ${m.category} mail on the platform's sender — set its own RESEND_API_KEY and EMAIL_FROM, or try tomorrow`;
     const all = recipients(m.to);
     const required = isRequiredCategory(m.category);
     const workspace = m.workspace ?? null;
@@ -225,6 +262,10 @@ export async function sendMail(m) {
         }
     };
     if (required) {
+        if (capped && all.length > allowance)
+            return { ok: false, error: overCap, sent: [], suppressed: [] };
+        if (capped)
+            notePlatformSent(m.tenant, m.category, all.length);
         if (all.length)
             await post(all, {}, "");
         return { ok: all.length > 0 && sent.length === all.length, status, error, sent, suppressed };
@@ -234,6 +275,15 @@ export async function sendMail(m) {
             suppressed.push(to);
             continue;
         }
+        // Counted only for someone who takes this mail: an opted-out recipient
+        // must not use up the day's allowance for the ones who want it.
+        if (capped) {
+            if (platformMailAllowance(m.tenant, m.category, m.mail.key) < 1) {
+                error = overCap;
+                continue;
+            }
+            notePlatformSent(m.tenant, m.category, 1);
+        }
         const claim = { tenant: m.tenant, email: to, category: m.category, workspace: mailCategory(m.category)?.perWorkspace ? workspace : null };
         const links = unsubscribeLinks(claim);
         const label = mailCategory(m.category)?.label.toLowerCase() ?? m.category;

package/dist/src/matter.js

@@ -72,8 +72,24 @@ function foldJobs(data) {
     Object.defineProperty(out, FOLD, { value: fold, enumerable: false });
     return out;
 }
+// gray-matter ships a `javascript` engine that eval()s a block opened with
+// `---js` or `---javascript` — with `process` and `require` in reach. Every
+// file it parses here was written by a tenant (or an agent), on the shared
+// web pod and worker. Only YAML is a language here; any other engine name
+// throws, which the readers already treat as frontmatter that does not parse.
+const refuse = (name) => () => {
+    throw new Error(`frontmatter opened with "---${name}" — only YAML frontmatter is read`);
+};
+const ENGINES = {
+    js: { parse: refuse("js"), stringify: refuse("js") },
+    javascript: { parse: refuse("javascript"), stringify: refuse("javascript") },
+    coffee: { parse: refuse("coffee"), stringify: refuse("coffee") },
+    coffeescript: { parse: refuse("coffeescript"), stringify: refuse("coffeescript") },
+    cson: { parse: refuse("cson"), stringify: refuse("cson") },
+};
+const safe = (options) => ({ ...(options ?? {}), engines: { ...(options?.engines ?? {}), ...ENGINES } });
 function matter(input, options) {
-    return grayMatter(input, options ?? {});
+    return grayMatter(input, safe(options));
 }
 matter.stringify = grayMatter.stringify;
 matter.test = grayMatter.test;
@@ -85,7 +101,7 @@ matter.test = grayMatter.test;
  * note's own `governance:` is its own (Codex debate, 21 Oct 2026).
  */
 export function configMatter(input, options) {
-    const file = grayMatter(input, options ?? {});
+    const file = grayMatter(input, safe(options));
     if (file.data && typeof file.data === "object" && !Array.isArray(file.data)) {
         file.data = foldJobs(file.data);
     }

package/dist/src/runner.js

@@ -2,6 +2,7 @@
 // group receives every prior result, labeled per agent. Optional steps ("2?")
 // fail without failing the flow. A direct agent run is a one-step ad-hoc
 // flow, so there is a single execution path.
+import { globMatch } from "./bounded-match.js";
 import { latestRevisionId } from "./history.js";
 import { recordCallIo, redactionsFor } from "./capture.js";
 import { AUTH_REFUSAL, platformCause } from "./issues.js";
@@ -4074,14 +4075,18 @@ export function startFlowRun(tenant, workspace, steps, flowName, modelOverride,
 export function resolvePreview(storageDir, patterns, cap = 12) {
     const out = new Set();
     for (const pattern of patterns) {
+        // Inside storage/ only: no climbing, no absolute paths.
+        const parts = pattern.replaceAll("\\", "/").split("/");
+        if (pattern.startsWith("/") || parts.includes("..") || pattern.length > 400)
+            continue;
         if (!/[*?]/.test(pattern)) {
             if (fs.existsSync(path.join(storageDir, pattern)))
                 out.add(pattern);
             continue;
         }
-        const re = new RegExp("^" + pattern
-            .split("**").map((part) => part.split("*").map((x) => x.replace(/[.+^${}()|[\]\\?]/g, "\\$&")).join("[^/]*"))
-            .join(".*") + "$");
+        // Matched in linear time: this runs on the worker every account shares,
+        // and a regex built from "**a**a**a**b" backtracks for seconds.
+        const re = { test: (r) => globMatch(pattern, r) };
         const walk = (dir, rel) => {
             let entries;
             try {

package/dist/src/tool-test.js

@@ -17,7 +17,8 @@
 import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import { resolveSecrets, materializeSecrets } from "./secrets.js";
+import { resolveSecrets, materializeSecrets, secretSites } from "./secrets.js";
+import { siteCovers } from "./network.js";
 import { listAgents, workspaceDir } from "./store.js";
 import { libraryDir } from "./library.js";
 import { secretsUsedByApi } from "./api-tools.js";
@@ -62,6 +63,26 @@ function matchesTemplate(op, concrete) {
     const re = new RegExp("^" + op.path.split(/\{[^/}]+\}/).map((part) => part.replace(/[.*+?^$()|[\]\\]/g, "\\$&")).join("[^/]+") + "$");
     return re.test(concrete);
 }
+/**
+ * A script or a command-started MCP server is the tenant's own code. On an
+ * install that isolates runs (FOLDRUN_RUN_ISOLATION) that code only ever runs
+ * in a step's sandbox — the web pod that answers Test is not one: it holds
+ * the platform's keys and every account's files (29 Oct 2026, OWASP review;
+ * hooks' Test was already refused the same way).
+ */
+function hostCodeRefusal(transport) {
+    if (!process.env.FOLDRUN_RUN_ISOLATION)
+        return null;
+    return {
+        ok: false,
+        transport,
+        missingSecrets: [],
+        summary: "this tool runs your own code, which this install runs only inside a step's sandbox — not from here",
+        detail: "Test it locally with\n  foldrun tool test <name>\n" +
+            "or with a test run of a flow whose agent has it under tools:, e.g.\n" +
+            "  foldrun invoke <flow> --to <workspace> --test --wait",
+    };
+}
 export async function testTool(tenant, workspace, def, input = {}) {
     const probePath = input.path ?? "";
     const started = Date.now();
@@ -128,6 +149,19 @@ export async function testTool(tenant, workspace, def, input = {}) {
                     detail: `base: ${api.base}\npath: ${probePath}`,
                 });
             }
+            // A secret bound to sites is filled in a run only by the egress proxy,
+            // only for those sites. The tester fills secrets itself, so it must ask
+            // the same question — or any editor could write a tool whose base is
+            // their own server and "test" the account's Stripe key out to it.
+            const bound = secretSites(tenant, needed, workspace);
+            const offSite = Object.entries(bound).filter(([, sites]) => !sites.some((site) => siteCovers(site, url.hostname))).map(([n]) => n);
+            if (offSite.length) {
+                return done({
+                    ok: false, transport: "http", missingSecrets: missing,
+                    summary: `${offSite.join(", ")} ${offSite.length === 1 ? "is" : "are"} bound to other sites than ${url.hostname} — not sent`,
+                    detail: offSite.map((n) => `${n}: ${bound[n].join(", ")}`).join("\n"),
+                });
+            }
             for (const [k, v] of Object.entries(api.query))
                 url.searchParams.set(k, substitute(v, env));
             const headers = {};
@@ -173,6 +207,9 @@ export async function testTool(tenant, workspace, def, input = {}) {
         }
     }
     if (def.kind === "script") {
+        const refused = hostCodeRefusal("script");
+        if (refused)
+            return done(refused);
         let run = String(def.spec.run ?? "");
         // A run's working directory is the calling AGENT's folder, not the
         // workspace root — and scripts rely on that. `path.resolve(cwd, "..",
@@ -344,6 +381,9 @@ export async function testTool(tenant, workspace, def, input = {}) {
             detail: "",
         });
     }
+    const refusedMcp = hostCodeRefusal("mcp");
+    if (refusedMcp)
+        return done(refusedMcp);
     const named = Object.entries(spec.env ?? {})
         .map(([, v]) => String(v).match(/^\$\{([A-Z0-9_]+)\}$/)?.[1])
         .filter((n) => Boolean(n));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldrun/core",
-  "version": "3.0.0",
+  "version": "5.0.0",
   "description": "Agents are just folders. The format, the runner, the checks.",
   "license": "FSL-1.1-ALv2",
   "type": "module",

package/src/bounded-match.ts

@@ -0,0 +1,70 @@
+// Matching on the shared worker and web pod against tenant-written patterns.
+//
+// A regular expression or a glob a tenant writes runs here, not in their
+// sandbox (an eval's `matches:`, a gate's `preview:`). A pattern that
+// backtracks — `(a+)+$`, or `**a**a**a**b` turned into `.*a.*a.*a.*b` —
+// holds the one event loop every account shares. So: globs match in linear
+// time with no regex at all, and a regex runs under a time limit
+// (29 Oct 2026, OWASP review).
+
+import vm from "node:vm";
+
+/**
+ * Does `text` match `pattern`? `*` matches within one path segment, `**`
+ * across segments; every other character is itself. O(pattern × text).
+ */
+export function globMatch(pattern: string, text: string): boolean {
+  const toks: string[] = [];
+  for (let i = 0; i < pattern.length; ) {
+    if (pattern[i] === "*") {
+      if (pattern[i + 1] === "*") {
+        i += 2;
+        while (pattern[i] === "*") i++;
+        // "**" swallows a neighbouring "**" or "*": the same set either way.
+        if (toks[toks.length - 1] !== "**") toks.push("**");
+      } else {
+        i++;
+        if (toks[toks.length - 1] !== "**" && toks[toks.length - 1] !== "*") toks.push("*");
+      }
+    } else {
+      toks.push(pattern[i]);
+      i++;
+    }
+  }
+  const n = text.length;
+  let cur: boolean[] = new Array(n + 1).fill(false);
+  cur[0] = true;
+  for (const t of toks) {
+    const next: boolean[] = new Array(n + 1).fill(false);
+    if (t === "**") {
+      let on = false;
+      for (let j = 0; j <= n; j++) {
+        on = on || cur[j];
+        next[j] = on;
+      }
+    } else if (t === "*") {
+      let on = false;
+      for (let j = 0; j <= n; j++) {
+        if (cur[j]) on = true;
+        next[j] = on;
+        if (j < n && text[j] === "/") on = false;
+      }
+    } else {
+      for (let j = 0; j < n; j++) if (cur[j] && text[j] === t) next[j + 1] = true;
+    }
+    cur = next;
+  }
+  return cur[n];
+}
+
+/** A regex test that gives up after `ms`: true, false, or "timeout". Throws
+ *  on a pattern that does not compile, as `new RegExp` would. */
+export function boundedRegexTest(source: string, flags: string, text: string, ms = 250): boolean | "timeout" {
+  new RegExp(source, flags); // compile here: a syntax error is the caller's to report
+  try {
+    return vm.runInNewContext("new RegExp(p, f).test(t)", { p: source, f: flags, t: text }, { timeout: ms }) === true;
+  } catch (err) {
+    if ((err as { code?: string }).code === "ERR_SCRIPT_EXECUTION_TIMEOUT") return "timeout";
+    throw err;
+  }
+}

package/src/deploy.ts

@@ -80,6 +80,9 @@ const IN_WORKSPACE_DIR = new RegExp(`^(${WORKSPACE_DIRS.join("|")})/`);
 export function isSourcePath(rel: string): boolean {
   const norm = rel.replaceAll("\\", "/");
   const parts = norm.split("/");
+  // A path that climbs, is absolute or has an empty segment is never a
+  // workspace file — and `foldrun pull` writes what this accepts to disk.
+  if (norm.startsWith("/") || /^[a-zA-Z]:/.test(norm) || parts.some((p) => p === ".." || p === "." || p === "")) return false;
   if (parts.some((p) => NOT_SOURCE.has(p))) return false;
   if (NOT_SOURCE_FILE.has(parts[parts.length - 1])) return false;
   return norm === "AGENTS.md" || norm === "project.md" || IN_WORKSPACE_DIR.test(norm);

package/src/evals.ts

@@ -42,6 +42,8 @@ import { deployedCommit } from "./deploy.ts";
 import { latestRevisionId } from "./history.ts";
 import matter from "./matter.ts";
 import { spawn } from "node:child_process";
+import { hostSafeEnv } from "./host-env.ts";
+import { boundedRegexTest } from "./bounded-match.ts";
 import { judgeVerdict, JUDGE_VERDICT_INSTRUCTION, parseJudge } from "./judge-verdict.ts";
 import { readAgentsMdKeys } from "./agents-md.ts";
 import { query } from "@anthropic-ai/claude-agent-sdk";
@@ -596,7 +598,8 @@ async function waitForRun(tenant: string, workspace: string, runId: string) {
 
 function shell(command: string, cwd: string): Promise<{ code: number | null; out: string }> {
   return new Promise((resolve) => {
-    const child = spawn("bash", ["-lc", command], { cwd });
+    // Never the platform's own environment: keys, database URL, tokens.
+    const child = spawn("bash", ["-lc", command], { cwd, env: hostSafeEnv() });
     let out = "";
     const append = (c: Buffer) => {
       if (out.length < 2000) out += c.toString();
@@ -707,7 +710,9 @@ export async function checkAssertion(
     }
     case "matches": {
       try {
-        const passed = new RegExp(assertion.value, "i").test(output);
+        // Bounded: the pattern is the tenant's, the process is shared.
+        const passed = boundedRegexTest(assertion.value, "i", output);
+        if (passed === "timeout") return { assertion, passed: false, detail: "the pattern took too long to match — simplify it" };
         return { assertion, passed, detail: passed ? "matched" : "no match" };
       } catch {
         return { assertion, passed: false, detail: "invalid regular expression" };
@@ -715,13 +720,20 @@ export async function checkAssertion(
     }
     case "file": {
       const target = path.resolve(agentDir, assertion.value);
-      if (!target.startsWith(path.resolve(agentDir))) {
+      if (!target.startsWith(path.resolve(agentDir) + path.sep)) {
         return { assertion, passed: false, detail: "path escapes the agent directory" };
       }
       const exists = fs.existsSync(target) && fs.statSync(target).size > 0;
       return { assertion, passed: exists, detail: exists ? "present and non-empty" : "missing or empty" };
     }
     case "run": {
+      // A `run:` is the tenant's own shell command. On an install that
+      // isolates runs it would execute here, on the web pod, beside the
+      // platform's keys and every account's files — so it is refused there,
+      // as a hook's Test is. A laptop runs every step in-process anyway.
+      if (process.env.FOLDRUN_RUN_ISOLATION) {
+        return { assertion, passed: false, detail: "run: assertions are not executed on this install — check the output with contains:/matches:/judge:, or a file with file:; `foldrun eval` runs them on your own machine" };
+      }
       const { code, out } = await shell(assertion.value, agentDir);
       return { assertion, passed: code === 0, detail: `exit ${code ?? "error"}${out ? ` — ${out.slice(0, 200)}` : ""}` };
     }

package/src/install-tool.ts

@@ -12,7 +12,13 @@
 // pip and npm need no root and run here, as the agent, into a per-step
 // directory already on PATH / PYTHONPATH / NODE_PATH (stepInstallEnv), so the
 // next command finds what this one installed. Inside a run container all of
-// it goes when the container does. Every install is logged with the line to
+// it goes when the container does.
+//
+// No package runs its own code on the way in (FOL-98, 28 Oct 2026): npm
+// installs with --ignore-scripts (no preinstall/postinstall), and pip takes
+// built wheels only (--only-binary :all:) — an sdist's setup.py is code. A
+// package that has no wheel says so, and `runtime: packages:` builds it
+// before the step instead, where the build is declared, cached and seen. Every install is logged with the line to
 // add to the agent's `runtime:` to have it before the step starts next time.
 
 import fs from "node:fs";
@@ -106,26 +112,29 @@ export function buildInstallTool(opts: {
         fs.mkdirSync(target, { recursive: true });
         const uv = findUv();
         const res = uv
-          ? spawnSync(uv, ["pip", "install", "-q", "--python", opts.python, "--target", target, ...names], {
+          ? spawnSync(uv, ["pip", "install", "-q", "--only-binary", ":all:", "--python", opts.python, "--target", target, ...names], {
               env: { ...opts.env, UV_CACHE_DIR: path.join(opts.cacheRoot, ".uv-cache"), UV_LINK_MODE: "copy", UV_NO_PROGRESS: "1" } as unknown as NodeJS.ProcessEnv,
               encoding: "utf8",
               timeout: 600_000,
             })
-          : spawnSync(opts.python, ["-m", "pip", "install", "-q", "--disable-pip-version-check", "--target", target, ...names], {
+          : spawnSync(opts.python, ["-m", "pip", "install", "-q", "--disable-pip-version-check", "--only-binary", ":all:", "--target", target, ...names], {
               env: opts.env as unknown as NodeJS.ProcessEnv,
               encoding: "utf8",
               timeout: 600_000,
             });
         if (res.status !== 0) {
-          const msg = summarizeInstallFailure(uv ? "uv pip install" : "pip install", `${res.stdout ?? ""}${res.stderr ?? ""}${res.error ? res.error.message : ""}`);
+          const raw = `${res.stdout ?? ""}${res.stderr ?? ""}${res.error ? res.error.message : ""}`;
+          const msg = summarizeInstallFailure(uv ? "uv pip install" : "pip install", raw);
           opts.emit("error", `install: pip ${names.join(" ")} — ${msg.split("\n")[0]}`);
-          return text(msg, true);
+          // Wheels only: one that exists only as source is not built here.
+          const noWheel = /no matching distribution|only-binary|no wheels? (?:with|for)|binary.*not available|doesn't have a wheel|has no wheel/i.test(raw);
+          return text(noWheel ? `${msg}\n\nOnly built wheels are installed mid-step — a source package's build runs its own code. Declare it in the agent's runtime: packages: [${names.join(", ")}] to have it built before the step.` : msg, true);
         }
         how = `pip, ${Math.round((Date.now() - t0) / 1000)}s`;
       } else {
         const prefix = path.join(opts.dir, "npm");
         fs.mkdirSync(prefix, { recursive: true });
-        const res = spawnSync("npm", ["install", "--no-fund", "--no-audit", "--no-progress", "--prefix", prefix, ...names], {
+        const res = spawnSync("npm", ["install", "--ignore-scripts", "--no-fund", "--no-audit", "--no-progress", "--prefix", prefix, ...names], {
           env: { ...opts.env, npm_config_cache: path.join(opts.cacheRoot, ".npm-cache") } as unknown as NodeJS.ProcessEnv,
           encoding: "utf8",
           timeout: 600_000,

package/src/mail.ts

@@ -258,7 +258,45 @@ export async function mailWanted(tenant: string, email: string, category: MailCa
  * carries that reader's own unsubscribe token; required mail goes as one.
  * Never throws: a mail that fails is an `ok: false` with the reason.
  */
+// The platform's own sender is shared by every account, so its reputation
+// is everyone's. Mail an account can make the platform send to addresses it
+// typed (invites, notify:, approvals, low balance) is capped per account per
+// day on the platform's key; mail about the account's own sign-in, billing
+// and health is not. An account sending on its own key is its own business.
+// Counted in this process — a brake, not a ledger (29 Oct 2026: open signup
+// on dev let anyone send ~86k invites a day from hello@foldrun.io).
+const UNCAPPED = new Set<string>(["security", "billing", "account"]);
+const PLATFORM_MAX_RECIPIENTS = 10;
+const platformDayCap = (category: string) =>
+  Number(process.env[category === "invites" ? "FOLDRUN_PLATFORM_INVITES_PER_DAY" : "FOLDRUN_PLATFORM_MAIL_PER_DAY"]) ||
+  (category === "invites" ? 25 : 200);
+const platformSent = new Map<string, number>();
+
+/** Recipients this account may still send to today on the platform's key. */
+export function platformMailAllowance(tenant: string, category: string, key: string, now = new Date()): number {
+  const platformKey = process.env.FOLDRUN_RESEND_API_KEY;
+  if (!platformKey || key !== platformKey || UNCAPPED.has(category)) return Infinity;
+  const used = platformSent.get(`${now.toISOString().slice(0, 10)}|${tenant}|${category === "invites" ? "invites" : "other"}`) ?? 0;
+  return Math.max(0, platformDayCap(category) - used);
+}
+
+function notePlatformSent(tenant: string, category: string, n: number, now = new Date()): void {
+  const day = now.toISOString().slice(0, 10);
+  for (const k of platformSent.keys()) if (!k.startsWith(day)) platformSent.delete(k);
+  const k = `${day}|${tenant}|${category === "invites" ? "invites" : "other"}`;
+  platformSent.set(k, (platformSent.get(k) ?? 0) + n);
+}
+
 export async function sendMail(m: MailMessage): Promise<MailResult> {
+  const allowance = platformMailAllowance(m.tenant, m.category, m.mail.key);
+  if (allowance !== Infinity) {
+    const n = recipients(m.to).length;
+    if (n > PLATFORM_MAX_RECIPIENTS) {
+      return { ok: false, error: `more than ${PLATFORM_MAX_RECIPIENTS} recipients on the platform's sender — set the account's own RESEND_API_KEY and EMAIL_FROM to send more`, sent: [], suppressed: [] };
+    }
+  }
+  const capped = allowance !== Infinity;
+  const overCap = `this account reached today's limit for ${m.category} mail on the platform's sender — set its own RESEND_API_KEY and EMAIL_FROM, or try tomorrow`;
   const all = recipients(m.to);
   const required = isRequiredCategory(m.category);
   const workspace = m.workspace ?? null;
@@ -296,6 +334,8 @@ export async function sendMail(m: MailMessage): Promise<MailResult> {
   };
 
   if (required) {
+    if (capped && all.length > allowance) return { ok: false, error: overCap, sent: [], suppressed: [] };
+    if (capped) notePlatformSent(m.tenant, m.category, all.length);
     if (all.length) await post(all, {}, "");
     return { ok: all.length > 0 && sent.length === all.length, status, error, sent, suppressed };
   }
@@ -305,6 +345,15 @@ export async function sendMail(m: MailMessage): Promise<MailResult> {
       suppressed.push(to);
       continue;
     }
+    // Counted only for someone who takes this mail: an opted-out recipient
+    // must not use up the day's allowance for the ones who want it.
+    if (capped) {
+      if (platformMailAllowance(m.tenant, m.category, m.mail.key) < 1) {
+        error = overCap;
+        continue;
+      }
+      notePlatformSent(m.tenant, m.category, 1);
+    }
     const claim = { tenant: m.tenant, email: to, category: m.category, workspace: mailCategory(m.category)?.perWorkspace ? workspace : null };
     const links = unsubscribeLinks(claim);
     const label = mailCategory(m.category)?.label.toLowerCase() ?? m.category;

package/src/matter.ts

@@ -79,8 +79,25 @@ function foldJobs(data: Record<string, unknown>): Record<string, unknown> {
   return out;
 }
 
+// gray-matter ships a `javascript` engine that eval()s a block opened with
+// `---js` or `---javascript` — with `process` and `require` in reach. Every
+// file it parses here was written by a tenant (or an agent), on the shared
+// web pod and worker. Only YAML is a language here; any other engine name
+// throws, which the readers already treat as frontmatter that does not parse.
+const refuse = (name: string) => () => {
+  throw new Error(`frontmatter opened with "---${name}" — only YAML frontmatter is read`);
+};
+const ENGINES = {
+  js: { parse: refuse("js"), stringify: refuse("js") },
+  javascript: { parse: refuse("javascript"), stringify: refuse("javascript") },
+  coffee: { parse: refuse("coffee"), stringify: refuse("coffee") },
+  coffeescript: { parse: refuse("coffeescript"), stringify: refuse("coffeescript") },
+  cson: { parse: refuse("cson"), stringify: refuse("cson") },
+};
+const safe = (options?: Options): Options => ({ ...(options ?? {}), engines: { ...(options?.engines ?? {}), ...ENGINES } as Options["engines"] });
+
 function matter(input: string, options?: Options) {
-  return grayMatter(input, options ?? {});
+  return grayMatter(input, safe(options));
 }
 matter.stringify = grayMatter.stringify;
 matter.test = grayMatter.test;
@@ -93,7 +110,7 @@ matter.test = grayMatter.test;
  * note's own `governance:` is its own (Codex debate, 21 Oct 2026).
  */
 export function configMatter(input: string, options?: Options) {
-  const file = grayMatter(input, options ?? {});
+  const file = grayMatter(input, safe(options));
   if (file.data && typeof file.data === "object" && !Array.isArray(file.data)) {
     (file as { data: Record<string, unknown> }).data = foldJobs(file.data as Record<string, unknown>);
   }

package/src/runner.ts

@@ -3,6 +3,7 @@
 // fail without failing the flow. A direct agent run is a one-step ad-hoc
 // flow, so there is a single execution path.
 
+import { globMatch } from "./bounded-match.ts";
 import { latestRevisionId } from "./history.ts";
 import { recordCallIo, redactionsFor } from "./capture.ts";
 import { AUTH_REFUSAL, platformCause } from "./issues.ts";
@@ -4308,15 +4309,16 @@ export function startFlowRun(
 export function resolvePreview(storageDir: string, patterns: string[], cap = 12): string[] {
   const out = new Set<string>();
   for (const pattern of patterns) {
+    // Inside storage/ only: no climbing, no absolute paths.
+    const parts = pattern.replaceAll("\\", "/").split("/");
+    if (pattern.startsWith("/") || parts.includes("..") || pattern.length > 400) continue;
     if (!/[*?]/.test(pattern)) {
       if (fs.existsSync(path.join(storageDir, pattern))) out.add(pattern);
       continue;
     }
-    const re = new RegExp(
-      "^" + pattern
-        .split("**").map((part) => part.split("*").map((x) => x.replace(/[.+^${}()|[\]\\?]/g, "\\$&")).join("[^/]*"))
-        .join(".*") + "$",
-    );
+    // Matched in linear time: this runs on the worker every account shares,
+    // and a regex built from "**a**a**a**b" backtracks for seconds.
+    const re = { test: (r: string) => globMatch(pattern, r) };
     const walk = (dir: string, rel: string) => {
       let entries: fs.Dirent[];
       try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }

package/src/tool-test.ts

@@ -19,7 +19,8 @@ import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
-import { resolveSecrets, materializeSecrets } from "./secrets.ts";
+import { resolveSecrets, materializeSecrets, secretSites } from "./secrets.ts";
+import { siteCovers } from "./network.ts";
 import { listAgents, workspaceDir, type ToolDef } from "./store.ts";
 import { libraryDir } from "./library.ts";
 import { secretsUsedByApi } from "./api-tools.ts";
@@ -96,6 +97,27 @@ export interface ToolTestInput {
   args?: Record<string, string>;
 }
 
+/**
+ * A script or a command-started MCP server is the tenant's own code. On an
+ * install that isolates runs (FOLDRUN_RUN_ISOLATION) that code only ever runs
+ * in a step's sandbox — the web pod that answers Test is not one: it holds
+ * the platform's keys and every account's files (29 Oct 2026, OWASP review;
+ * hooks' Test was already refused the same way).
+ */
+function hostCodeRefusal(transport: "script" | "mcp"): Omit<ToolTestResult, "ms"> | null {
+  if (!process.env.FOLDRUN_RUN_ISOLATION) return null;
+  return {
+    ok: false,
+    transport,
+    missingSecrets: [],
+    summary: "this tool runs your own code, which this install runs only inside a step's sandbox — not from here",
+    detail:
+      "Test it locally with\n  foldrun tool test <name>\n" +
+      "or with a test run of a flow whose agent has it under tools:, e.g.\n" +
+      "  foldrun invoke <flow> --to <workspace> --test --wait",
+  };
+}
+
 export async function testTool(
   tenant: string,
   workspace: string,
@@ -170,6 +192,19 @@ export async function testTool(
           detail: `base: ${api.base}\npath: ${probePath}`,
         });
       }
+      // A secret bound to sites is filled in a run only by the egress proxy,
+      // only for those sites. The tester fills secrets itself, so it must ask
+      // the same question — or any editor could write a tool whose base is
+      // their own server and "test" the account's Stripe key out to it.
+      const bound = secretSites(tenant, needed, workspace);
+      const offSite = Object.entries(bound).filter(([, sites]) => !sites.some((site) => siteCovers(site, url.hostname))).map(([n]) => n);
+      if (offSite.length) {
+        return done({
+          ok: false, transport: "http", missingSecrets: missing,
+          summary: `${offSite.join(", ")} ${offSite.length === 1 ? "is" : "are"} bound to other sites than ${url.hostname} — not sent`,
+          detail: offSite.map((n) => `${n}: ${bound[n].join(", ")}`).join("\n"),
+        });
+      }
       for (const [k, v] of Object.entries(api.query)) url.searchParams.set(k, substitute(v, env));
 
       const headers: Record<string, string> = {};
@@ -219,6 +254,8 @@ export async function testTool(
   }
 
   if (def.kind === "script") {
+    const refused = hostCodeRefusal("script");
+    if (refused) return done(refused);
     let run = String(def.spec.run ?? "");
     // A run's working directory is the calling AGENT's folder, not the
     // workspace root — and scripts rely on that. `path.resolve(cwd, "..",
@@ -404,6 +441,8 @@ export async function testTool(
       detail: "",
     });
   }
+  const refusedMcp = hostCodeRefusal("mcp");
+  if (refusedMcp) return done(refusedMcp);
 
   const named = Object.entries(spec.env ?? {})
     .map(([, v]) => String(v).match(/^\$\{([A-Z0-9_]+)\}$/)?.[1])