@foldrun/core 4.0.0 → 6.0.0

package/dist/src/bounded-match.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Does `text` match `pattern`? `*` matches within one path segment, `**`
+ * across segments; every other character is itself. O(pattern × text).
+ */
+export declare function globMatch(pattern: string, text: string): boolean;
+/** A regex test that gives up after `ms`: true, false, or "timeout". Throws
+ *  on a pattern that does not compile, as `new RegExp` would. */
+export declare function boundedRegexTest(source: string, flags: string, text: string, ms?: number): boolean | "timeout";

package/dist/src/bounded-match.js

@@ -0,0 +1,80 @@
+// Matching on the shared worker and web pod against tenant-written patterns.
+//
+// A regular expression or a glob a tenant writes runs here, not in their
+// sandbox (an eval's `matches:`, a gate's `preview:`). A pattern that
+// backtracks — `(a+)+$`, or `**a**a**a**b` turned into `.*a.*a.*a.*b` —
+// holds the one event loop every account shares. So: globs match in linear
+// time with no regex at all, and a regex runs under a time limit
+// (29 Oct 2026, OWASP review).
+import vm from "node:vm";
+/**
+ * Does `text` match `pattern`? `*` matches within one path segment, `**`
+ * across segments; every other character is itself. O(pattern × text).
+ */
+export function globMatch(pattern, text) {
+    const toks = [];
+    for (let i = 0; i < pattern.length;) {
+        if (pattern[i] === "*") {
+            if (pattern[i + 1] === "*") {
+                i += 2;
+                while (pattern[i] === "*")
+                    i++;
+                // "**" swallows a neighbouring "**" or "*": the same set either way.
+                if (toks[toks.length - 1] !== "**")
+                    toks.push("**");
+            }
+            else {
+                i++;
+                if (toks[toks.length - 1] !== "**" && toks[toks.length - 1] !== "*")
+                    toks.push("*");
+            }
+        }
+        else {
+            toks.push(pattern[i]);
+            i++;
+        }
+    }
+    const n = text.length;
+    let cur = new Array(n + 1).fill(false);
+    cur[0] = true;
+    for (const t of toks) {
+        const next = new Array(n + 1).fill(false);
+        if (t === "**") {
+            let on = false;
+            for (let j = 0; j <= n; j++) {
+                on = on || cur[j];
+                next[j] = on;
+            }
+        }
+        else if (t === "*") {
+            let on = false;
+            for (let j = 0; j <= n; j++) {
+                if (cur[j])
+                    on = true;
+                next[j] = on;
+                if (j < n && text[j] === "/")
+                    on = false;
+            }
+        }
+        else {
+            for (let j = 0; j < n; j++)
+                if (cur[j] && text[j] === t)
+                    next[j + 1] = true;
+        }
+        cur = next;
+    }
+    return cur[n];
+}
+/** A regex test that gives up after `ms`: true, false, or "timeout". Throws
+ *  on a pattern that does not compile, as `new RegExp` would. */
+export function boundedRegexTest(source, flags, text, ms = 250) {
+    new RegExp(source, flags); // compile here: a syntax error is the caller's to report
+    try {
+        return vm.runInNewContext("new RegExp(p, f).test(t)", { p: source, f: flags, t: text }, { timeout: ms }) === true;
+    }
+    catch (err) {
+        if (err.code === "ERR_SCRIPT_EXECUTION_TIMEOUT")
+            return "timeout";
+        throw err;
+    }
+}

package/dist/src/deploy.js

@@ -61,6 +61,10 @@ const IN_WORKSPACE_DIR = new RegExp(`^(${WORKSPACE_DIRS.join("|")})/`);
 export function isSourcePath(rel) {
     const norm = rel.replaceAll("\\", "/");
     const parts = norm.split("/");
+    // A path that climbs, is absolute or has an empty segment is never a
+    // workspace file — and `foldrun pull` writes what this accepts to disk.
+    if (norm.startsWith("/") || /^[a-zA-Z]:/.test(norm) || parts.some((p) => p === ".." || p === "." || p === ""))
+        return false;
     if (parts.some((p) => NOT_SOURCE.has(p)))
         return false;
     if (NOT_SOURCE_FILE.has(parts[parts.length - 1]))

package/dist/src/evals.js

@@ -30,7 +30,7 @@
 // Deterministic checks run first and cost nothing. The judge only runs if
 // they pass — no point paying a model to grade output already known to be
 // wrong.
-import { accountModelEnv, withModelEnv } from "./model-env.js";
+import { accountModelEnv, withModelEnv, ModelKeyError } from "./model-env.js";
 import { sdkEnv } from "./step-exec.js";
 import { platformModelEnv } from "./runner.js";
 import fs from "node:fs";
@@ -40,6 +40,8 @@ import { deployedCommit } from "./deploy.js";
 import { latestRevisionId } from "./history.js";
 import matter from "./matter.js";
 import { spawn } from "node:child_process";
+import { hostSafeEnv } from "./host-env.js";
+import { boundedRegexTest } from "./bounded-match.js";
 import { judgeVerdict, JUDGE_VERDICT_INSTRUCTION, parseJudge } from "./judge-verdict.js";
 import { readAgentsMdKeys } from "./agents-md.js";
 import { query } from "@anthropic-ai/claude-agent-sdk";
@@ -443,7 +445,8 @@ async function waitForRun(tenant, workspace, runId) {
 }
 function shell(command, cwd) {
     return new Promise((resolve) => {
-        const child = spawn("bash", ["-lc", command], { cwd });
+        // Never the platform's own environment: keys, database URL, tokens.
+        const child = spawn("bash", ["-lc", command], { cwd, env: hostSafeEnv() });
         let out = "";
         const append = (c) => {
             if (out.length < 2000)
@@ -540,7 +543,10 @@ export async function checkAssertion(assertion, output, agentDir, model, effort,
         }
         case "matches": {
             try {
-                const passed = new RegExp(assertion.value, "i").test(output);
+                // Bounded: the pattern is the tenant's, the process is shared.
+                const passed = boundedRegexTest(assertion.value, "i", output);
+                if (passed === "timeout")
+                    return { assertion, passed: false, detail: "the pattern took too long to match — simplify it" };
                 return { assertion, passed, detail: passed ? "matched" : "no match" };
             }
             catch {
@@ -549,13 +555,20 @@ export async function checkAssertion(assertion, output, agentDir, model, effort,
         }
         case "file": {
             const target = path.resolve(agentDir, assertion.value);
-            if (!target.startsWith(path.resolve(agentDir))) {
+            if (!target.startsWith(path.resolve(agentDir) + path.sep)) {
                 return { assertion, passed: false, detail: "path escapes the agent directory" };
             }
             const exists = fs.existsSync(target) && fs.statSync(target).size > 0;
             return { assertion, passed: exists, detail: exists ? "present and non-empty" : "missing or empty" };
         }
         case "run": {
+            // A `run:` is the tenant's own shell command. On an install that
+            // isolates runs it would execute here, on the web pod, beside the
+            // platform's keys and every account's files — so it is refused there,
+            // as a hook's Test is. A laptop runs every step in-process anyway.
+            if (process.env.FOLDRUN_RUN_ISOLATION) {
+                return { assertion, passed: false, detail: "run: assertions are not executed on this install — check the output with contains:/matches:/judge:, or a file with file:; `foldrun eval` runs them on your own machine" };
+            }
             const { code, out } = await shell(assertion.value, agentDir);
             return { assertion, passed: code === 0, detail: `exit ${code ?? "error"}${out ? ` — ${out.slice(0, 200)}` : ""}` };
         }
@@ -569,7 +582,16 @@ export async function checkAssertion(assertion, output, agentDir, model, effort,
             catch (err) {
                 return { assertion, passed: false, detail: `judge not run — ${err instanceof Error ? err.message : String(err)}` };
             }
-            const said = await withModelEnv(m, (env) => judgeCall(assertion.value, output, model, effort, env));
+            let said;
+            try {
+                said = await withModelEnv(m, (env) => judgeCall(assertion.value, output, model, effort, env));
+            }
+            catch (err) {
+                // The provider's URL refused on the host (FOL-95), like a missing key above.
+                if (!(err instanceof ModelKeyError))
+                    throw err;
+                return { assertion, passed: false, detail: `judge not run — ${err.message}` };
+            }
             const { passed, detail } = judgeVerdict(said.text);
             return { assertion, passed, detail, costUsd: said.costUsd };
         }

package/dist/src/mail.d.ts

@@ -79,10 +79,6 @@ export interface MailResult {
 }
 /** Does this person take this category of mail? Required mail: always. */
 export declare function mailWanted(tenant: string, email: string, category: MailCategory, workspace?: string | null): Promise<boolean>;
-/**
- * Send one message, honouring each recipient's preference for its
- * category. Optional mail is sent one recipient at a time so each copy
- * carries that reader's own unsubscribe token; required mail goes as one.
- * Never throws: a mail that fails is an `ok: false` with the reason.
- */
+/** Recipients this account may still send to today on the platform's key. */
+export declare function platformMailAllowance(tenant: string, category: string, key: string, now?: Date): number;
 export declare function sendMail(m: MailMessage): Promise<MailResult>;

package/dist/src/mail.js

@@ -188,7 +188,44 @@ export async function mailWanted(tenant, email, category, workspace = null) {
  * carries that reader's own unsubscribe token; required mail goes as one.
  * Never throws: a mail that fails is an `ok: false` with the reason.
  */
+// The platform's own sender is shared by every account, so its reputation
+// is everyone's. Mail an account can make the platform send to addresses it
+// typed (invites, notify:, approvals, low balance) is capped per account per
+// day on the platform's key; mail about the account's own sign-in, billing
+// and health is not. An account sending on its own key is its own business.
+// Counted in this process — a brake, not a ledger (29 Oct 2026: open signup
+// on dev let anyone send ~86k invites a day from hello@foldrun.io).
+const UNCAPPED = new Set(["security", "billing", "account"]);
+const PLATFORM_MAX_RECIPIENTS = 10;
+const platformDayCap = (category) => Number(process.env[category === "invites" ? "FOLDRUN_PLATFORM_INVITES_PER_DAY" : "FOLDRUN_PLATFORM_MAIL_PER_DAY"]) ||
+    (category === "invites" ? 25 : 200);
+const platformSent = new Map();
+/** Recipients this account may still send to today on the platform's key. */
+export function platformMailAllowance(tenant, category, key, now = new Date()) {
+    const platformKey = process.env.FOLDRUN_RESEND_API_KEY;
+    if (!platformKey || key !== platformKey || UNCAPPED.has(category))
+        return Infinity;
+    const used = platformSent.get(`${now.toISOString().slice(0, 10)}|${tenant}|${category === "invites" ? "invites" : "other"}`) ?? 0;
+    return Math.max(0, platformDayCap(category) - used);
+}
+function notePlatformSent(tenant, category, n, now = new Date()) {
+    const day = now.toISOString().slice(0, 10);
+    for (const k of platformSent.keys())
+        if (!k.startsWith(day))
+            platformSent.delete(k);
+    const k = `${day}|${tenant}|${category === "invites" ? "invites" : "other"}`;
+    platformSent.set(k, (platformSent.get(k) ?? 0) + n);
+}
 export async function sendMail(m) {
+    const allowance = platformMailAllowance(m.tenant, m.category, m.mail.key);
+    if (allowance !== Infinity) {
+        const n = recipients(m.to).length;
+        if (n > PLATFORM_MAX_RECIPIENTS) {
+            return { ok: false, error: `more than ${PLATFORM_MAX_RECIPIENTS} recipients on the platform's sender — set the account's own RESEND_API_KEY and EMAIL_FROM to send more`, sent: [], suppressed: [] };
+        }
+    }
+    const capped = allowance !== Infinity;
+    const overCap = `this account reached today's limit for ${m.category} mail on the platform's sender — set its own RESEND_API_KEY and EMAIL_FROM, or try tomorrow`;
     const all = recipients(m.to);
     const required = isRequiredCategory(m.category);
     const workspace = m.workspace ?? null;
@@ -225,6 +262,10 @@ export async function sendMail(m) {
         }
     };
     if (required) {
+        if (capped && all.length > allowance)
+            return { ok: false, error: overCap, sent: [], suppressed: [] };
+        if (capped)
+            notePlatformSent(m.tenant, m.category, all.length);
         if (all.length)
             await post(all, {}, "");
         return { ok: all.length > 0 && sent.length === all.length, status, error, sent, suppressed };
@@ -234,6 +275,15 @@ export async function sendMail(m) {
             suppressed.push(to);
             continue;
         }
+        // Counted only for someone who takes this mail: an opted-out recipient
+        // must not use up the day's allowance for the ones who want it.
+        if (capped) {
+            if (platformMailAllowance(m.tenant, m.category, m.mail.key) < 1) {
+                error = overCap;
+                continue;
+            }
+            notePlatformSent(m.tenant, m.category, 1);
+        }
         const claim = { tenant: m.tenant, email: to, category: m.category, workspace: mailCategory(m.category)?.perWorkspace ? workspace : null };
         const links = unsubscribeLinks(claim);
         const label = mailCategory(m.category)?.label.toLowerCase() ?? m.category;

package/dist/src/matter.js

@@ -72,8 +72,24 @@ function foldJobs(data) {
     Object.defineProperty(out, FOLD, { value: fold, enumerable: false });
     return out;
 }
+// gray-matter ships a `javascript` engine that eval()s a block opened with
+// `---js` or `---javascript` — with `process` and `require` in reach. Every
+// file it parses here was written by a tenant (or an agent), on the shared
+// web pod and worker. Only YAML is a language here; any other engine name
+// throws, which the readers already treat as frontmatter that does not parse.
+const refuse = (name) => () => {
+    throw new Error(`frontmatter opened with "---${name}" — only YAML frontmatter is read`);
+};
+const ENGINES = {
+    js: { parse: refuse("js"), stringify: refuse("js") },
+    javascript: { parse: refuse("javascript"), stringify: refuse("javascript") },
+    coffee: { parse: refuse("coffee"), stringify: refuse("coffee") },
+    coffeescript: { parse: refuse("coffeescript"), stringify: refuse("coffeescript") },
+    cson: { parse: refuse("cson"), stringify: refuse("cson") },
+};
+const safe = (options) => ({ ...(options ?? {}), engines: { ...(options?.engines ?? {}), ...ENGINES } });
 function matter(input, options) {
-    return grayMatter(input, options ?? {});
+    return grayMatter(input, safe(options));
 }
 matter.stringify = grayMatter.stringify;
 matter.test = grayMatter.test;
@@ -85,7 +101,7 @@ matter.test = grayMatter.test;
  * note's own `governance:` is its own (Codex debate, 21 Oct 2026).
  */
 export function configMatter(input, options) {
-    const file = grayMatter(input, options ?? {});
+    const file = grayMatter(input, safe(options));
     if (file.data && typeof file.data === "object" && !Array.isArray(file.data)) {
         file.data = foldJobs(file.data);
     }

package/dist/src/model-env.d.ts

@@ -19,11 +19,20 @@ export declare function accountModelEnv(tenant: string, workspace: string, platf
     translator: TranslatorSpec | null;
 };
 /**
- * Run `fn` with the model env, through a translator on this host when the
- * provider speaks Chat Completions or Responses — the same one a step uses
- * (runner.ts), started for this call and closed after it.
+ * Run `fn` with the model env, through a translator on this host — the one a
+ * step uses (runner.ts) when the provider speaks Chat Completions or
+ * Responses, and a passthrough when it speaks Anthropic's Messages (FOL-95):
+ * either way the SDK talks only to loopback, and the tenant's endpoint is
+ * reached through fetchUntrusted, after the platform's check of its URL.
+ * The platform's own credential (`supply: "platform"`) goes as it always did.
+ * Started for this call and closed after it.
  */
 export declare function withModelEnv<T>(m: {
     env: Record<string, string | undefined>;
     translator?: TranslatorSpec | null;
+    supply?: "provider" | "platform";
 }, fn: (env: Record<string, string | undefined>) => Promise<T>): Promise<T>;
+/** The passthrough for an Anthropic-format provider, read back from the env
+ *  providerEnvFor (store.ts) built for it: the base URL, the key in the slot
+ *  that names its header, and ANTHROPIC_CUSTOM_HEADERS. Null with no base. */
+export declare function anthropicPassthrough(env: Record<string, string | undefined>): TranslatorSpec | null;

package/dist/src/model-env.js

@@ -8,7 +8,7 @@
 import { accountDir, workspaceDir, parseProvider, providerEnvFor } from "./store.js";
 import { readAgentsMd } from "./runner.js";
 import { getSecret } from "./secrets.js";
-import { platform } from "./platform.js";
+import { platform, hostUrlProblem } from "./platform.js";
 import { accountModelBlock, isClaudeLoginToken } from "./model-credential.js";
 import { providerPreset } from "./providers.js";
 import { startTranslator, translatorSpecFor } from "./translator.js";
@@ -39,6 +39,13 @@ export function accountModelEnv(tenant, workspace, platformEnv) {
             throw new ModelKeyError(NO_MODEL_KEY);
         return { env: platformEnv(), supply: "platform", format: "anthropic", translator: null };
     }
+    // A host-side call to a URL the tenant wrote: on a platform, https only
+    // (platform.ts hostUrlProblem); withModelEnv asks the platform's own check
+    // too, and the guard sees every byte (FOL-95). A step resolves its
+    // provider elsewhere (runner.ts) and is not touched by this.
+    const refused = hostUrlProblem(spec.baseUrl);
+    if (refused)
+        throw new ModelKeyError(`provider base_url refused: ${refused}`, 422);
     const sub = (text) => text.replace(/\$\{([A-Z][A-Z0-9_]*)\}/g, (whole, name) => getSecret(tenant, name, workspace)?.value ?? whole);
     const token = sub(spec.token);
     if (token.includes("${"))
@@ -65,14 +72,22 @@ export function accountModelEnv(tenant, workspace, platformEnv) {
     };
 }
 /**
- * Run `fn` with the model env, through a translator on this host when the
- * provider speaks Chat Completions or Responses — the same one a step uses
- * (runner.ts), started for this call and closed after it.
+ * Run `fn` with the model env, through a translator on this host — the one a
+ * step uses (runner.ts) when the provider speaks Chat Completions or
+ * Responses, and a passthrough when it speaks Anthropic's Messages (FOL-95):
+ * either way the SDK talks only to loopback, and the tenant's endpoint is
+ * reached through fetchUntrusted, after the platform's check of its URL.
+ * The platform's own credential (`supply: "platform"`) goes as it always did.
+ * Started for this call and closed after it.
  */
 export async function withModelEnv(m, fn) {
-    if (!m.translator)
+    const spec = m.translator ?? (m.supply === "provider" ? anthropicPassthrough(m.env) : null);
+    if (!spec)
         return fn(m.env);
-    const t = await startTranslator(m.translator);
+    const why = await platform.checkUntrustedUrl(spec.upstreamBase);
+    if (why)
+        throw new ModelKeyError(`provider base_url refused: ${why}`, 422);
+    const t = await startTranslator(spec);
     try {
         return await fn({ ...m.env, ...t.env });
     }
@@ -80,3 +95,26 @@ export async function withModelEnv(m, fn) {
         await t.close();
     }
 }
+/** The passthrough for an Anthropic-format provider, read back from the env
+ *  providerEnvFor (store.ts) built for it: the base URL, the key in the slot
+ *  that names its header, and ANTHROPIC_CUSTOM_HEADERS. Null with no base. */
+export function anthropicPassthrough(env) {
+    const base = env.ANTHROPIC_BASE_URL;
+    if (!base)
+        return null;
+    const apiKey = env.ANTHROPIC_API_KEY ?? "";
+    const headers = {};
+    for (const line of (env.ANTHROPIC_CUSTOM_HEADERS ?? "").split("\n")) {
+        const at = line.indexOf(":");
+        if (at > 0)
+            headers[line.slice(0, at).trim()] = line.slice(at + 1).trim();
+    }
+    return {
+        wire: "anthropic",
+        upstreamBase: base,
+        upstreamKey: apiKey || (env.ANTHROPIC_AUTH_TOKEN ?? ""),
+        upstreamAuth: apiKey ? "x-api-key" : "bearer",
+        headers,
+        label: base,
+    };
+}

package/dist/src/platform.d.ts

@@ -175,6 +175,16 @@ export interface PlatformHooks {
     fetchUntrusted(url: string, init?: RequestInit, opts?: {
         maxBytes?: number;
     }): Promise<Response>;
+    /**
+     * May the host call this URL a tenant chose — a provider's base_url,
+     * before an eval's judge or a dashboard draft talks to it? A reason it may
+     * not, or null. This is the early refusal people can read; the guarantee
+     * is that every byte of such a call goes through fetchUntrusted (FOL-95).
+     * Default: hostUrlProblem below — https on an install that guards
+     * untrusted fetches, anything on a laptop (its own localhost included).
+     * A platform may bind a stricter check (the addresses a name resolves to).
+     */
+    checkUntrustedUrl(url: string): Promise<string | null>;
     /**
      * Hand a notify: webhook to whatever delivers it. The platform records
      * the delivery, makes the first attempt now and retries on a backoff from
@@ -207,6 +217,20 @@ export interface WebhookDeliveryOutcome {
     retrying?: boolean;
 }
 export declare const platform: PlatformHooks;
+/** True when this process fetches tenant-chosen URLs through a guard: a
+ *  platform bound fetchUntrusted. A laptop has not, and calls its own LAN on
+ *  purpose. */
+export declare function guardsUntrustedUrls(): boolean;
+/**
+ * Why the host may not call a tenant's model endpoint at this URL, or null.
+ * On an install that guards untrusted fetches the endpoint must be https: the
+ * key rides in every request, and a plain-http base is also how a tenant
+ * names a cluster service. Private and internal addresses are refused by the
+ * guard itself, on every hop. FOLDRUN_EGRESS_ALLOW_PRIVATE=1 — the operator's
+ * own install calling its own network — lifts this as it lifts the guard. A
+ * laptop: always null.
+ */
+export declare function hostUrlProblem(url: string): string | null;
 /** Install the platform's implementations. Partial: what is not given keeps its local default. */
 export declare function registerPlatform(hooks: Partial<PlatformHooks>): void;
 /**

package/dist/src/platform.js

@@ -12,6 +12,10 @@
 // and calls registerPlatform() once at boot. A process that forgets to is a
 // local install — which is exactly the failure that is safe.
 import { matchFilter } from "./trigger-filter.js";
+/** Marks the laptop's fetchUntrusted. A symbol from the global registry, not
+ *  the function itself: every bundle has its own copy of this module (see
+ *  KEY below), and only the shared object says which one was registered. */
+const LAPTOP_FETCH = Symbol.for("foldrun.laptop-fetch");
 const local = {
     edition: () => "self-hosted",
     async enqueueFlowRun(tenant, workspace, steps, flowName, modelOverride, tags = [], startedBy = null, opts = {}) {
@@ -40,7 +44,8 @@ const local = {
     platformKeyAllowed: () => true,
     galleryDir: () => null,
     noteOAuthRefresh: async () => undefined,
-    fetchUntrusted: (url, init) => fetch(url, init),
+    fetchUntrusted: Object.assign((url, init) => fetch(url, init), { [LAPTOP_FETCH]: true }),
+    checkUntrustedUrl: async (url) => hostUrlProblem(url),
     async deliverWebhook(tenant, workspace, delivery) {
         const { attemptWebhook, newDeliveryId } = await import("./notify.js");
         const deliveryId = newDeliveryId();
@@ -60,6 +65,35 @@ const local = {
 const KEY = Symbol.for("foldrun.platform");
 const g = globalThis;
 export const platform = (g[KEY] ??= { ...local });
+/** True when this process fetches tenant-chosen URLs through a guard: a
+ *  platform bound fetchUntrusted. A laptop has not, and calls its own LAN on
+ *  purpose. */
+export function guardsUntrustedUrls() {
+    return !platform.fetchUntrusted[LAPTOP_FETCH];
+}
+/**
+ * Why the host may not call a tenant's model endpoint at this URL, or null.
+ * On an install that guards untrusted fetches the endpoint must be https: the
+ * key rides in every request, and a plain-http base is also how a tenant
+ * names a cluster service. Private and internal addresses are refused by the
+ * guard itself, on every hop. FOLDRUN_EGRESS_ALLOW_PRIVATE=1 — the operator's
+ * own install calling its own network — lifts this as it lifts the guard. A
+ * laptop: always null.
+ */
+export function hostUrlProblem(url) {
+    if (!guardsUntrustedUrls() || process.env.FOLDRUN_EGRESS_ALLOW_PRIVATE === "1")
+        return null;
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return `${url} is not a URL`;
+    }
+    if (u.protocol !== "https:")
+        return `${u.origin} is not https — this platform calls a model endpoint only over https`;
+    return null;
+}
 /** Install the platform's implementations. Partial: what is not given keeps its local default. */
 export function registerPlatform(hooks) {
     Object.assign(platform, hooks, {

package/dist/src/runner.d.ts

@@ -387,6 +387,7 @@ grantsOnly?: boolean): {
         upstreamBase: string;
         wire?: import("./translator.ts").TranslatorWire;
         upstreamKey: string;
+        upstreamAuth?: "bearer" | "x-api-key";
         headers?: Record<string, string>;
         maxTokensParam?: "max_tokens" | "max_completion_tokens";
         reasoningEffort?: boolean;
@@ -400,6 +401,7 @@ grantsOnly?: boolean): {
         upstreamBase: string;
         wire?: import("./translator.ts").TranslatorWire;
         upstreamKey: string;
+        upstreamAuth?: "bearer" | "x-api-key";
         headers?: Record<string, string>;
         maxTokensParam?: "max_tokens" | "max_completion_tokens";
         reasoningEffort?: boolean;

package/dist/src/runner.js

@@ -2,6 +2,7 @@
 // group receives every prior result, labeled per agent. Optional steps ("2?")
 // fail without failing the flow. A direct agent run is a one-step ad-hoc
 // flow, so there is a single execution path.
+import { globMatch } from "./bounded-match.js";
 import { latestRevisionId } from "./history.js";
 import { recordCallIo, redactionsFor } from "./capture.js";
 import { AUTH_REFUSAL, platformCause } from "./issues.js";
@@ -4074,14 +4075,18 @@ export function startFlowRun(tenant, workspace, steps, flowName, modelOverride,
 export function resolvePreview(storageDir, patterns, cap = 12) {
     const out = new Set();
     for (const pattern of patterns) {
+        // Inside storage/ only: no climbing, no absolute paths.
+        const parts = pattern.replaceAll("\\", "/").split("/");
+        if (pattern.startsWith("/") || parts.includes("..") || pattern.length > 400)
+            continue;
         if (!/[*?]/.test(pattern)) {
             if (fs.existsSync(path.join(storageDir, pattern)))
                 out.add(pattern);
             continue;
         }
-        const re = new RegExp("^" + pattern
-            .split("**").map((part) => part.split("*").map((x) => x.replace(/[.+^${}()|[\]\\?]/g, "\\$&")).join("[^/]*"))
-            .join(".*") + "$");
+        // Matched in linear time: this runs on the worker every account shares,
+        // and a regex built from "**a**a**a**b" backtracks for seconds.
+        const re = { test: (r) => globMatch(pattern, r) };
         const walk = (dir, rel) => {
             let entries;
             try {

package/dist/src/tool-test.js

@@ -17,7 +17,8 @@
 import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import { resolveSecrets, materializeSecrets } from "./secrets.js";
+import { resolveSecrets, materializeSecrets, secretSites } from "./secrets.js";
+import { siteCovers } from "./network.js";
 import { listAgents, workspaceDir } from "./store.js";
 import { libraryDir } from "./library.js";
 import { secretsUsedByApi } from "./api-tools.js";
@@ -62,6 +63,26 @@ function matchesTemplate(op, concrete) {
     const re = new RegExp("^" + op.path.split(/\{[^/}]+\}/).map((part) => part.replace(/[.*+?^$()|[\]\\]/g, "\\$&")).join("[^/]+") + "$");
     return re.test(concrete);
 }
+/**
+ * A script or a command-started MCP server is the tenant's own code. On an
+ * install that isolates runs (FOLDRUN_RUN_ISOLATION) that code only ever runs
+ * in a step's sandbox — the web pod that answers Test is not one: it holds
+ * the platform's keys and every account's files (29 Oct 2026, OWASP review;
+ * hooks' Test was already refused the same way).
+ */
+function hostCodeRefusal(transport) {
+    if (!process.env.FOLDRUN_RUN_ISOLATION)
+        return null;
+    return {
+        ok: false,
+        transport,
+        missingSecrets: [],
+        summary: "this tool runs your own code, which this install runs only inside a step's sandbox — not from here",
+        detail: "Test it locally with\n  foldrun tool test <name>\n" +
+            "or with a test run of a flow whose agent has it under tools:, e.g.\n" +
+            "  foldrun invoke <flow> --to <workspace> --test --wait",
+    };
+}
 export async function testTool(tenant, workspace, def, input = {}) {
     const probePath = input.path ?? "";
     const started = Date.now();
@@ -128,6 +149,19 @@ export async function testTool(tenant, workspace, def, input = {}) {
                     detail: `base: ${api.base}\npath: ${probePath}`,
                 });
             }
+            // A secret bound to sites is filled in a run only by the egress proxy,
+            // only for those sites. The tester fills secrets itself, so it must ask
+            // the same question — or any editor could write a tool whose base is
+            // their own server and "test" the account's Stripe key out to it.
+            const bound = secretSites(tenant, needed, workspace);
+            const offSite = Object.entries(bound).filter(([, sites]) => !sites.some((site) => siteCovers(site, url.hostname))).map(([n]) => n);
+            if (offSite.length) {
+                return done({
+                    ok: false, transport: "http", missingSecrets: missing,
+                    summary: `${offSite.join(", ")} ${offSite.length === 1 ? "is" : "are"} bound to other sites than ${url.hostname} — not sent`,
+                    detail: offSite.map((n) => `${n}: ${bound[n].join(", ")}`).join("\n"),
+                });
+            }
             for (const [k, v] of Object.entries(api.query))
                 url.searchParams.set(k, substitute(v, env));
             const headers = {};
@@ -173,6 +207,9 @@ export async function testTool(tenant, workspace, def, input = {}) {
         }
     }
     if (def.kind === "script") {
+        const refused = hostCodeRefusal("script");
+        if (refused)
+            return done(refused);
         let run = String(def.spec.run ?? "");
         // A run's working directory is the calling AGENT's folder, not the
         // workspace root — and scripts rely on that. `path.resolve(cwd, "..",
@@ -344,6 +381,9 @@ export async function testTool(tenant, workspace, def, input = {}) {
             detail: "",
         });
     }
+    const refusedMcp = hostCodeRefusal("mcp");
+    if (refusedMcp)
+        return done(refusedMcp);
     const named = Object.entries(spec.env ?? {})
         .map(([, v]) => String(v).match(/^\$\{([A-Z0-9_]+)\}$/)?.[1])
         .filter((n) => Boolean(n));

package/dist/src/translator.d.ts

@@ -11,15 +11,21 @@ export declare function anthropicUsage(u: Json | undefined, wire: TranslatorWire
     cached: number;
     output: number;
 };
-export type TranslatorWire = "chat" | "responses";
+/** `anthropic` is no translation at all: the host-side passthrough for an
+ *  endpoint that already speaks Messages, so the SDK on the host talks only
+ *  to loopback and every byte to the tenant's URL goes through the guard
+ *  (FOL-95). A step never gets it (translatorSpecFor returns null there). */
+export type TranslatorWire = "chat" | "responses" | "anthropic";
 export interface TranslatorSpec {
     /** The provider's base, e.g. https://api.openai.com/v1 — `/chat/completions`
      *  or `/responses` is appended, by `wire`. */
     upstreamBase: string;
     /** Which OpenAI shape the endpoint speaks. Default chat. */
     wire?: TranslatorWire;
-    /** Already resolved. Sent as `Authorization: Bearer`. */
+    /** Already resolved. Sent as `Authorization: Bearer`, or as `x-api-key`
+     *  where `upstreamAuth` says so (the anthropic wire only). */
     upstreamKey: string;
+    upstreamAuth?: "bearer" | "x-api-key";
     /** Extra headers the provider wants, already resolved. */
     headers?: Record<string, string>;
     maxTokensParam?: "max_tokens" | "max_completion_tokens";