@foldrun/core 4.0.0 → 6.0.0

package/dist/src/translator.js

@@ -893,6 +893,8 @@ export async function startTranslator(spec) {
                 req.on("end", () => resolve(body));
                 req.on("error", reject);
             });
+            if (spec.wire === "anthropic")
+                return await passthrough(spec, base, label, req, url, raw, res, log, started);
             if (req.method === "POST" && url.pathname === "/v1/messages/count_tokens") {
                 // No endpoint on the other side counts for us; four characters a
                 // token is the estimate every tokenizer lands near for English.
@@ -1058,6 +1060,77 @@ export async function startTranslator(spec) {
         }),
     };
 }
+/** Request headers the SDK's own call carries that the endpoint is owed:
+ *  the content type, and Anthropic's version and beta flags. Its credential
+ *  (the translator's key) is not one of them. */
+const PASSED_HEADERS = /^(content-type|accept|anthropic-[a-z0-9-]+)$/;
+/** Response headers that describe the bytes as they came off the wire —
+ *  fetch has already decoded them, so they would lie on the way back. */
+const HOP_HEADERS = new Set(["content-encoding", "content-length", "transfer-encoding", "connection", "keep-alive"]);
+/**
+ * The anthropic wire: the SDK's request, as it is, to the same path under the
+ * tenant's base URL, with the tenant's key put on here — through
+ * fetchUntrusted, so no private or cluster address, no redirect that takes
+ * the key to another origin, and the answer read to UPSTREAM_MAX_BYTES. The
+ * answer streams back as it arrives, status and headers included.
+ */
+async function passthrough(spec, base, label, req, url, raw, res, log, started) {
+    // Lowercase keys, so a header named twice in different case is one header,
+    // and the provider's own headers last: one that carries its credential
+    // itself (an Authorization or x-api-key in `headers:`) wins over the key
+    // slot, as on the Chat Completions wire above.
+    const headers = {};
+    for (const [k, v] of Object.entries(req.headers))
+        if (PASSED_HEADERS.test(k) && typeof v === "string")
+            headers[k] = v;
+    if (spec.upstreamKey) {
+        if (spec.upstreamAuth === "x-api-key")
+            headers["x-api-key"] = spec.upstreamKey;
+        else
+            headers.authorization = `Bearer ${spec.upstreamKey}`;
+    }
+    for (const [k, v] of Object.entries(spec.headers ?? {}))
+        headers[k.toLowerCase()] = v;
+    const method = req.method ?? "GET";
+    const target = `${base}${url.pathname}${url.search}`;
+    let upstream;
+    try {
+        upstream = await fetchUntrusted(target, { method, headers, body: method === "GET" || method === "HEAD" ? undefined : raw }, { sameOrigin: true, maxBytes: UPSTREAM_MAX_BYTES });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        log.push(`${method} ${label}${url.pathname} → unreachable: ${message}`);
+        res.writeHead(502, { "content-type": "application/json" });
+        res.end(errorBody(502, `translator: could not reach ${label}: ${message}`));
+        return;
+    }
+    const out = {};
+    upstream.headers.forEach((v, k) => {
+        if (!HOP_HEADERS.has(k))
+            out[k] = v;
+    });
+    res.writeHead(upstream.status, out);
+    log.push(`${method} ${label}${url.pathname} → ${upstream.status} (${Date.now() - started}ms)`);
+    const reader = upstream.body?.getReader();
+    if (!reader)
+        return void res.end();
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            res.write(value);
+        }
+        res.end();
+    }
+    catch (err) {
+        // Mid-answer (the cap, a dropped connection): an Anthropic error event,
+        // so a stream reads as failed, not as a reply that merely stopped.
+        const message = err instanceof Error ? err.message : String(err);
+        log.push(`translator error: ${message}`);
+        res.end(`event: error\ndata: ${errorBody(500, `translator: ${message}`)}\n\n`);
+    }
+}
 /**
  * What a provider block needs from the translator, or null when the block
  * speaks Anthropic and needs none. Values only — this crosses into the run

package/dist/src/webhook.js

@@ -115,8 +115,8 @@ export function recordDelivery(tenant, workspace, delivery) {
     const file = deliveriesFile(tenant, workspace);
     if (!fs.existsSync(path.dirname(file)))
         return; // no workspace, nothing to log against
-    if (UNAUTHENTICATED.includes(delivery.outcome) && collapseInto(file, delivery))
-        return;
+    if (UNAUTHENTICATED.includes(delivery.outcome))
+        return recordRefusal(file, tenant, workspace, delivery);
     fs.appendFileSync(file, JSON.stringify(delivery) + "\n");
     // Bounded: compact to the newest KEEP when it doubles. Amortised cheap,
     // and a log that grows forever is a disk-full incident with a delay.
@@ -132,9 +132,42 @@ export function recordDelivery(tenant, workspace, delivery) {
         // compaction is best-effort; the append already landed
     }
 }
+/**
+ * A refusal — anyone's to send — never changes the workspace's directory: no
+ * new file, no tmp file, no rename. The directory's mtime is the workspace's
+ * deployedAt (store.ts listWorkspaces), and a stranger posting a bad token
+ * moved it (FOL-102). So a refusal goes into a log that already exists, in
+ * place (an append, or the last line rewritten), and is never the write that
+ * compacts it; a workspace with no log yet gets a server log line instead,
+ * at most one a minute per workspace.
+ */
+function recordRefusal(file, tenant, workspace, delivery) {
+    if (!fs.existsSync(file))
+        return noteRefusal(tenant, workspace, delivery);
+    if (collapseInto(file, delivery))
+        return;
+    fs.appendFileSync(file, JSON.stringify(delivery) + "\n");
+}
+const REFUSAL_NOTE_MS = 60_000;
+const refusalNotes = new Map();
+function noteRefusal(tenant, workspace, delivery) {
+    const key = `${tenant}/${workspace}`;
+    const now = Date.now();
+    const seen = refusalNotes.get(key);
+    if (seen && now - seen.at < REFUSAL_NOTE_MS) {
+        seen.since++;
+        return;
+    }
+    const more = seen?.since ? ` (and ${seen.since} more since the last note)` : "";
+    console.warn(`[hooks] refused a delivery to ${key}/${delivery.flow}: ${delivery.outcome}${more}`);
+    refusalNotes.set(key, { at: now, since: 0 });
+    if (refusalNotes.size > 10_000)
+        refusalNotes.clear(); // bounded: a note lost beats memory
+}
 /** Fold a refusal into the log's last line when that line is a refusal
  *  too. The flow name is not part of the match: it comes from the URL, so
- *  a flood that varies it would otherwise never collapse. True when folded. */
+ *  a flood that varies it would otherwise never collapse. True when folded.
+ *  Rewritten in place, never through a rename (recordRefusal says why). */
 function collapseInto(file, delivery) {
     let text;
     try {
@@ -160,9 +193,16 @@ function collapseInto(file, delivery) {
         first: last.first ?? last.t,
         ...(last.detail === "more than one flow name" || last.flow !== delivery.flow ? { detail: "more than one flow name" } : {}),
     };
-    const tmp = `${file}.tmp`;
-    fs.writeFileSync(tmp, end.slice(0, cut) + JSON.stringify(merged) + "\n");
-    fs.renameSync(tmp, file);
+    const line = Buffer.from(JSON.stringify(merged) + "\n");
+    const at = Buffer.byteLength(end.slice(0, cut));
+    const fd = fs.openSync(file, "r+");
+    try {
+        fs.writeSync(fd, line, 0, line.length, at);
+        fs.ftruncateSync(fd, at + line.length);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
     return true;
 }
 export function readDeliveries(tenant, workspace, limit = 20) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldrun/core",
-  "version": "4.0.0",
+  "version": "6.0.0",
   "description": "Agents are just folders. The format, the runner, the checks.",
   "license": "FSL-1.1-ALv2",
   "type": "module",

package/src/bounded-match.ts

@@ -0,0 +1,70 @@
+// Matching on the shared worker and web pod against tenant-written patterns.
+//
+// A regular expression or a glob a tenant writes runs here, not in their
+// sandbox (an eval's `matches:`, a gate's `preview:`). A pattern that
+// backtracks — `(a+)+$`, or `**a**a**a**b` turned into `.*a.*a.*a.*b` —
+// holds the one event loop every account shares. So: globs match in linear
+// time with no regex at all, and a regex runs under a time limit
+// (29 Oct 2026, OWASP review).
+
+import vm from "node:vm";
+
+/**
+ * Does `text` match `pattern`? `*` matches within one path segment, `**`
+ * across segments; every other character is itself. O(pattern × text).
+ */
+export function globMatch(pattern: string, text: string): boolean {
+  const toks: string[] = [];
+  for (let i = 0; i < pattern.length; ) {
+    if (pattern[i] === "*") {
+      if (pattern[i + 1] === "*") {
+        i += 2;
+        while (pattern[i] === "*") i++;
+        // "**" swallows a neighbouring "**" or "*": the same set either way.
+        if (toks[toks.length - 1] !== "**") toks.push("**");
+      } else {
+        i++;
+        if (toks[toks.length - 1] !== "**" && toks[toks.length - 1] !== "*") toks.push("*");
+      }
+    } else {
+      toks.push(pattern[i]);
+      i++;
+    }
+  }
+  const n = text.length;
+  let cur: boolean[] = new Array(n + 1).fill(false);
+  cur[0] = true;
+  for (const t of toks) {
+    const next: boolean[] = new Array(n + 1).fill(false);
+    if (t === "**") {
+      let on = false;
+      for (let j = 0; j <= n; j++) {
+        on = on || cur[j];
+        next[j] = on;
+      }
+    } else if (t === "*") {
+      let on = false;
+      for (let j = 0; j <= n; j++) {
+        if (cur[j]) on = true;
+        next[j] = on;
+        if (j < n && text[j] === "/") on = false;
+      }
+    } else {
+      for (let j = 0; j < n; j++) if (cur[j] && text[j] === t) next[j + 1] = true;
+    }
+    cur = next;
+  }
+  return cur[n];
+}
+
+/** A regex test that gives up after `ms`: true, false, or "timeout". Throws
+ *  on a pattern that does not compile, as `new RegExp` would. */
+export function boundedRegexTest(source: string, flags: string, text: string, ms = 250): boolean | "timeout" {
+  new RegExp(source, flags); // compile here: a syntax error is the caller's to report
+  try {
+    return vm.runInNewContext("new RegExp(p, f).test(t)", { p: source, f: flags, t: text }, { timeout: ms }) === true;
+  } catch (err) {
+    if ((err as { code?: string }).code === "ERR_SCRIPT_EXECUTION_TIMEOUT") return "timeout";
+    throw err;
+  }
+}

package/src/deploy.ts

@@ -80,6 +80,9 @@ const IN_WORKSPACE_DIR = new RegExp(`^(${WORKSPACE_DIRS.join("|")})/`);
 export function isSourcePath(rel: string): boolean {
   const norm = rel.replaceAll("\\", "/");
   const parts = norm.split("/");
+  // A path that climbs, is absolute or has an empty segment is never a
+  // workspace file — and `foldrun pull` writes what this accepts to disk.
+  if (norm.startsWith("/") || /^[a-zA-Z]:/.test(norm) || parts.some((p) => p === ".." || p === "." || p === "")) return false;
   if (parts.some((p) => NOT_SOURCE.has(p))) return false;
   if (NOT_SOURCE_FILE.has(parts[parts.length - 1])) return false;
   return norm === "AGENTS.md" || norm === "project.md" || IN_WORKSPACE_DIR.test(norm);

package/src/evals.ts

@@ -31,7 +31,7 @@
 // they pass — no point paying a model to grade output already known to be
 // wrong.
 
-import { accountModelEnv, withModelEnv } from "./model-env.ts";
+import { accountModelEnv, withModelEnv, ModelKeyError } from "./model-env.ts";
 import type { TranslatorSpec } from "./translator.ts";
 import { sdkEnv } from "./step-exec.ts";
 import { platformModelEnv } from "./runner.ts";
@@ -42,6 +42,8 @@ import { deployedCommit } from "./deploy.ts";
 import { latestRevisionId } from "./history.ts";
 import matter from "./matter.ts";
 import { spawn } from "node:child_process";
+import { hostSafeEnv } from "./host-env.ts";
+import { boundedRegexTest } from "./bounded-match.ts";
 import { judgeVerdict, JUDGE_VERDICT_INSTRUCTION, parseJudge } from "./judge-verdict.ts";
 import { readAgentsMdKeys } from "./agents-md.ts";
 import { query } from "@anthropic-ai/claude-agent-sdk";
@@ -596,7 +598,8 @@ async function waitForRun(tenant: string, workspace: string, runId: string) {
 
 function shell(command: string, cwd: string): Promise<{ code: number | null; out: string }> {
   return new Promise((resolve) => {
-    const child = spawn("bash", ["-lc", command], { cwd });
+    // Never the platform's own environment: keys, database URL, tokens.
+    const child = spawn("bash", ["-lc", command], { cwd, env: hostSafeEnv() });
     let out = "";
     const append = (c: Buffer) => {
       if (out.length < 2000) out += c.toString();
@@ -707,7 +710,9 @@ export async function checkAssertion(
     }
     case "matches": {
       try {
-        const passed = new RegExp(assertion.value, "i").test(output);
+        // Bounded: the pattern is the tenant's, the process is shared.
+        const passed = boundedRegexTest(assertion.value, "i", output);
+        if (passed === "timeout") return { assertion, passed: false, detail: "the pattern took too long to match — simplify it" };
         return { assertion, passed, detail: passed ? "matched" : "no match" };
       } catch {
         return { assertion, passed: false, detail: "invalid regular expression" };
@@ -715,13 +720,20 @@ export async function checkAssertion(
     }
     case "file": {
       const target = path.resolve(agentDir, assertion.value);
-      if (!target.startsWith(path.resolve(agentDir))) {
+      if (!target.startsWith(path.resolve(agentDir) + path.sep)) {
         return { assertion, passed: false, detail: "path escapes the agent directory" };
       }
       const exists = fs.existsSync(target) && fs.statSync(target).size > 0;
       return { assertion, passed: exists, detail: exists ? "present and non-empty" : "missing or empty" };
     }
     case "run": {
+      // A `run:` is the tenant's own shell command. On an install that
+      // isolates runs it would execute here, on the web pod, beside the
+      // platform's keys and every account's files — so it is refused there,
+      // as a hook's Test is. A laptop runs every step in-process anyway.
+      if (process.env.FOLDRUN_RUN_ISOLATION) {
+        return { assertion, passed: false, detail: "run: assertions are not executed on this install — check the output with contains:/matches:/judge:, or a file with file:; `foldrun eval` runs them on your own machine" };
+      }
       const { code, out } = await shell(assertion.value, agentDir);
       return { assertion, passed: code === 0, detail: `exit ${code ?? "error"}${out ? ` — ${out.slice(0, 200)}` : ""}` };
     }
@@ -734,7 +746,14 @@ export async function checkAssertion(
       } catch (err) {
         return { assertion, passed: false, detail: `judge not run — ${err instanceof Error ? err.message : String(err)}` };
       }
-      const said = await withModelEnv(m, (env) => judgeCall(assertion.value, output, model, effort, env));
+      let said: Awaited<ReturnType<typeof judgeCall>>;
+      try {
+        said = await withModelEnv(m, (env) => judgeCall(assertion.value, output, model, effort, env));
+      } catch (err) {
+        // The provider's URL refused on the host (FOL-95), like a missing key above.
+        if (!(err instanceof ModelKeyError)) throw err;
+        return { assertion, passed: false, detail: `judge not run — ${err.message}` };
+      }
       const { passed, detail } = judgeVerdict(said.text);
       return { assertion, passed, detail, costUsd: said.costUsd };
     }

package/src/mail.ts

@@ -258,7 +258,45 @@ export async function mailWanted(tenant: string, email: string, category: MailCa
  * carries that reader's own unsubscribe token; required mail goes as one.
  * Never throws: a mail that fails is an `ok: false` with the reason.
  */
+// The platform's own sender is shared by every account, so its reputation
+// is everyone's. Mail an account can make the platform send to addresses it
+// typed (invites, notify:, approvals, low balance) is capped per account per
+// day on the platform's key; mail about the account's own sign-in, billing
+// and health is not. An account sending on its own key is its own business.
+// Counted in this process — a brake, not a ledger (29 Oct 2026: open signup
+// on dev let anyone send ~86k invites a day from hello@foldrun.io).
+const UNCAPPED = new Set<string>(["security", "billing", "account"]);
+const PLATFORM_MAX_RECIPIENTS = 10;
+const platformDayCap = (category: string) =>
+  Number(process.env[category === "invites" ? "FOLDRUN_PLATFORM_INVITES_PER_DAY" : "FOLDRUN_PLATFORM_MAIL_PER_DAY"]) ||
+  (category === "invites" ? 25 : 200);
+const platformSent = new Map<string, number>();
+
+/** Recipients this account may still send to today on the platform's key. */
+export function platformMailAllowance(tenant: string, category: string, key: string, now = new Date()): number {
+  const platformKey = process.env.FOLDRUN_RESEND_API_KEY;
+  if (!platformKey || key !== platformKey || UNCAPPED.has(category)) return Infinity;
+  const used = platformSent.get(`${now.toISOString().slice(0, 10)}|${tenant}|${category === "invites" ? "invites" : "other"}`) ?? 0;
+  return Math.max(0, platformDayCap(category) - used);
+}
+
+function notePlatformSent(tenant: string, category: string, n: number, now = new Date()): void {
+  const day = now.toISOString().slice(0, 10);
+  for (const k of platformSent.keys()) if (!k.startsWith(day)) platformSent.delete(k);
+  const k = `${day}|${tenant}|${category === "invites" ? "invites" : "other"}`;
+  platformSent.set(k, (platformSent.get(k) ?? 0) + n);
+}
+
 export async function sendMail(m: MailMessage): Promise<MailResult> {
+  const allowance = platformMailAllowance(m.tenant, m.category, m.mail.key);
+  if (allowance !== Infinity) {
+    const n = recipients(m.to).length;
+    if (n > PLATFORM_MAX_RECIPIENTS) {
+      return { ok: false, error: `more than ${PLATFORM_MAX_RECIPIENTS} recipients on the platform's sender — set the account's own RESEND_API_KEY and EMAIL_FROM to send more`, sent: [], suppressed: [] };
+    }
+  }
+  const capped = allowance !== Infinity;
+  const overCap = `this account reached today's limit for ${m.category} mail on the platform's sender — set its own RESEND_API_KEY and EMAIL_FROM, or try tomorrow`;
   const all = recipients(m.to);
   const required = isRequiredCategory(m.category);
   const workspace = m.workspace ?? null;
@@ -296,6 +334,8 @@ export async function sendMail(m: MailMessage): Promise<MailResult> {
   };
 
   if (required) {
+    if (capped && all.length > allowance) return { ok: false, error: overCap, sent: [], suppressed: [] };
+    if (capped) notePlatformSent(m.tenant, m.category, all.length);
     if (all.length) await post(all, {}, "");
     return { ok: all.length > 0 && sent.length === all.length, status, error, sent, suppressed };
   }
@@ -305,6 +345,15 @@ export async function sendMail(m: MailMessage): Promise<MailResult> {
       suppressed.push(to);
       continue;
     }
+    // Counted only for someone who takes this mail: an opted-out recipient
+    // must not use up the day's allowance for the ones who want it.
+    if (capped) {
+      if (platformMailAllowance(m.tenant, m.category, m.mail.key) < 1) {
+        error = overCap;
+        continue;
+      }
+      notePlatformSent(m.tenant, m.category, 1);
+    }
     const claim = { tenant: m.tenant, email: to, category: m.category, workspace: mailCategory(m.category)?.perWorkspace ? workspace : null };
     const links = unsubscribeLinks(claim);
     const label = mailCategory(m.category)?.label.toLowerCase() ?? m.category;

package/src/matter.ts

@@ -79,8 +79,25 @@ function foldJobs(data: Record<string, unknown>): Record<string, unknown> {
   return out;
 }
 
+// gray-matter ships a `javascript` engine that eval()s a block opened with
+// `---js` or `---javascript` — with `process` and `require` in reach. Every
+// file it parses here was written by a tenant (or an agent), on the shared
+// web pod and worker. Only YAML is a language here; any other engine name
+// throws, which the readers already treat as frontmatter that does not parse.
+const refuse = (name: string) => () => {
+  throw new Error(`frontmatter opened with "---${name}" — only YAML frontmatter is read`);
+};
+const ENGINES = {
+  js: { parse: refuse("js"), stringify: refuse("js") },
+  javascript: { parse: refuse("javascript"), stringify: refuse("javascript") },
+  coffee: { parse: refuse("coffee"), stringify: refuse("coffee") },
+  coffeescript: { parse: refuse("coffeescript"), stringify: refuse("coffeescript") },
+  cson: { parse: refuse("cson"), stringify: refuse("cson") },
+};
+const safe = (options?: Options): Options => ({ ...(options ?? {}), engines: { ...(options?.engines ?? {}), ...ENGINES } as Options["engines"] });
+
 function matter(input: string, options?: Options) {
-  return grayMatter(input, options ?? {});
+  return grayMatter(input, safe(options));
 }
 matter.stringify = grayMatter.stringify;
 matter.test = grayMatter.test;
@@ -93,7 +110,7 @@ matter.test = grayMatter.test;
  * note's own `governance:` is its own (Codex debate, 21 Oct 2026).
  */
 export function configMatter(input: string, options?: Options) {
-  const file = grayMatter(input, options ?? {});
+  const file = grayMatter(input, safe(options));
   if (file.data && typeof file.data === "object" && !Array.isArray(file.data)) {
     (file as { data: Record<string, unknown> }).data = foldJobs(file.data as Record<string, unknown>);
   }

package/src/model-env.ts

@@ -9,7 +9,7 @@
 import { accountDir, workspaceDir, parseProvider, providerEnvFor } from "./store.ts";
 import { readAgentsMd } from "./runner.ts";
 import { getSecret } from "./secrets.ts";
-import { platform } from "./platform.ts";
+import { platform, hostUrlProblem } from "./platform.ts";
 import { accountModelBlock, isClaudeLoginToken } from "./model-credential.ts";
 import { providerPreset } from "./providers.ts";
 import { startTranslator, translatorSpecFor, type TranslatorSpec } from "./translator.ts";
@@ -53,6 +53,12 @@ export function accountModelEnv(
     if (!platform.platformKeyAllowed(tenant)) throw new ModelKeyError(NO_MODEL_KEY);
     return { env: platformEnv(), supply: "platform", format: "anthropic", translator: null };
   }
+  // A host-side call to a URL the tenant wrote: on a platform, https only
+  // (platform.ts hostUrlProblem); withModelEnv asks the platform's own check
+  // too, and the guard sees every byte (FOL-95). A step resolves its
+  // provider elsewhere (runner.ts) and is not touched by this.
+  const refused = hostUrlProblem(spec.baseUrl);
+  if (refused) throw new ModelKeyError(`provider base_url refused: ${refused}`, 422);
   const sub = (text: string) =>
     text.replace(/\$\{([A-Z][A-Z0-9_]*)\}/g, (whole, name) => getSecret(tenant, name, workspace)?.value ?? whole);
   const token = sub(spec.token);
@@ -80,19 +86,48 @@ export function accountModelEnv(
 }
 
 /**
- * Run `fn` with the model env, through a translator on this host when the
- * provider speaks Chat Completions or Responses — the same one a step uses
- * (runner.ts), started for this call and closed after it.
+ * Run `fn` with the model env, through a translator on this host — the one a
+ * step uses (runner.ts) when the provider speaks Chat Completions or
+ * Responses, and a passthrough when it speaks Anthropic's Messages (FOL-95):
+ * either way the SDK talks only to loopback, and the tenant's endpoint is
+ * reached through fetchUntrusted, after the platform's check of its URL.
+ * The platform's own credential (`supply: "platform"`) goes as it always did.
+ * Started for this call and closed after it.
  */
 export async function withModelEnv<T>(
-  m: { env: Record<string, string | undefined>; translator?: TranslatorSpec | null },
+  m: { env: Record<string, string | undefined>; translator?: TranslatorSpec | null; supply?: "provider" | "platform" },
   fn: (env: Record<string, string | undefined>) => Promise<T>,
 ): Promise<T> {
-  if (!m.translator) return fn(m.env);
-  const t = await startTranslator(m.translator);
+  const spec = m.translator ?? (m.supply === "provider" ? anthropicPassthrough(m.env) : null);
+  if (!spec) return fn(m.env);
+  const why = await platform.checkUntrustedUrl(spec.upstreamBase);
+  if (why) throw new ModelKeyError(`provider base_url refused: ${why}`, 422);
+  const t = await startTranslator(spec);
   try {
     return await fn({ ...m.env, ...t.env });
   } finally {
     await t.close();
   }
 }
+
+/** The passthrough for an Anthropic-format provider, read back from the env
+ *  providerEnvFor (store.ts) built for it: the base URL, the key in the slot
+ *  that names its header, and ANTHROPIC_CUSTOM_HEADERS. Null with no base. */
+export function anthropicPassthrough(env: Record<string, string | undefined>): TranslatorSpec | null {
+  const base = env.ANTHROPIC_BASE_URL;
+  if (!base) return null;
+  const apiKey = env.ANTHROPIC_API_KEY ?? "";
+  const headers: Record<string, string> = {};
+  for (const line of (env.ANTHROPIC_CUSTOM_HEADERS ?? "").split("\n")) {
+    const at = line.indexOf(":");
+    if (at > 0) headers[line.slice(0, at).trim()] = line.slice(at + 1).trim();
+  }
+  return {
+    wire: "anthropic",
+    upstreamBase: base,
+    upstreamKey: apiKey || (env.ANTHROPIC_AUTH_TOKEN ?? ""),
+    upstreamAuth: apiKey ? "x-api-key" : "bearer",
+    headers,
+    label: base,
+  };
+}

package/src/platform.ts

@@ -177,6 +177,16 @@ export interface PlatformHooks {
    * caps it again, so a laptop's plain fetch may ignore it).
    */
   fetchUntrusted(url: string, init?: RequestInit, opts?: { maxBytes?: number }): Promise<Response>;
+  /**
+   * May the host call this URL a tenant chose — a provider's base_url,
+   * before an eval's judge or a dashboard draft talks to it? A reason it may
+   * not, or null. This is the early refusal people can read; the guarantee
+   * is that every byte of such a call goes through fetchUntrusted (FOL-95).
+   * Default: hostUrlProblem below — https on an install that guards
+   * untrusted fetches, anything on a laptop (its own localhost included).
+   * A platform may bind a stricter check (the addresses a name resolves to).
+   */
+  checkUntrustedUrl(url: string): Promise<string | null>;
   /**
    * Hand a notify: webhook to whatever delivers it. The platform records
    * the delivery, makes the first attempt now and retries on a backoff from
@@ -210,6 +220,11 @@ export interface WebhookDeliveryOutcome {
   retrying?: boolean;
 }
 
+/** Marks the laptop's fetchUntrusted. A symbol from the global registry, not
+ *  the function itself: every bundle has its own copy of this module (see
+ *  KEY below), and only the shared object says which one was registered. */
+const LAPTOP_FETCH = Symbol.for("foldrun.laptop-fetch");
+
 const local: PlatformHooks = {
   edition: () => "self-hosted",
   async enqueueFlowRun(tenant, workspace, steps, flowName, modelOverride, tags = [], startedBy = null, opts = {}) {
@@ -237,7 +252,8 @@ const local: PlatformHooks = {
   platformKeyAllowed: () => true,
   galleryDir: () => null,
   noteOAuthRefresh: async () => undefined,
-  fetchUntrusted: (url, init) => fetch(url, init),
+  fetchUntrusted: Object.assign((url: string, init?: RequestInit) => fetch(url, init), { [LAPTOP_FETCH]: true }),
+  checkUntrustedUrl: async (url) => hostUrlProblem(url),
   async deliverWebhook(tenant, workspace, delivery) {
     const { attemptWebhook, newDeliveryId } = await import("./notify.ts");
     const deliveryId = newDeliveryId();
@@ -259,6 +275,34 @@ const KEY = Symbol.for("foldrun.platform");
 const g = globalThis as unknown as Record<symbol, PlatformHooks | undefined>;
 export const platform: PlatformHooks = (g[KEY] ??= { ...local });
 
+/** True when this process fetches tenant-chosen URLs through a guard: a
+ *  platform bound fetchUntrusted. A laptop has not, and calls its own LAN on
+ *  purpose. */
+export function guardsUntrustedUrls(): boolean {
+  return !(platform.fetchUntrusted as unknown as Record<symbol, unknown>)[LAPTOP_FETCH];
+}
+
+/**
+ * Why the host may not call a tenant's model endpoint at this URL, or null.
+ * On an install that guards untrusted fetches the endpoint must be https: the
+ * key rides in every request, and a plain-http base is also how a tenant
+ * names a cluster service. Private and internal addresses are refused by the
+ * guard itself, on every hop. FOLDRUN_EGRESS_ALLOW_PRIVATE=1 — the operator's
+ * own install calling its own network — lifts this as it lifts the guard. A
+ * laptop: always null.
+ */
+export function hostUrlProblem(url: string): string | null {
+  if (!guardsUntrustedUrls() || process.env.FOLDRUN_EGRESS_ALLOW_PRIVATE === "1") return null;
+  let u: URL;
+  try {
+    u = new URL(url);
+  } catch {
+    return `${url} is not a URL`;
+  }
+  if (u.protocol !== "https:") return `${u.origin} is not https — this platform calls a model endpoint only over https`;
+  return null;
+}
+
 /** Install the platform's implementations. Partial: what is not given keeps its local default. */
 export function registerPlatform(hooks: Partial<PlatformHooks>): void {
   Object.assign(platform, hooks, {

package/src/runner.ts

@@ -3,6 +3,7 @@
 // fail without failing the flow. A direct agent run is a one-step ad-hoc
 // flow, so there is a single execution path.
 
+import { globMatch } from "./bounded-match.ts";
 import { latestRevisionId } from "./history.ts";
 import { recordCallIo, redactionsFor } from "./capture.ts";
 import { AUTH_REFUSAL, platformCause } from "./issues.ts";
@@ -4308,15 +4309,16 @@ export function startFlowRun(
 export function resolvePreview(storageDir: string, patterns: string[], cap = 12): string[] {
   const out = new Set<string>();
   for (const pattern of patterns) {
+    // Inside storage/ only: no climbing, no absolute paths.
+    const parts = pattern.replaceAll("\\", "/").split("/");
+    if (pattern.startsWith("/") || parts.includes("..") || pattern.length > 400) continue;
     if (!/[*?]/.test(pattern)) {
       if (fs.existsSync(path.join(storageDir, pattern))) out.add(pattern);
       continue;
     }
-    const re = new RegExp(
-      "^" + pattern
-        .split("**").map((part) => part.split("*").map((x) => x.replace(/[.+^${}()|[\]\\?]/g, "\\$&")).join("[^/]*"))
-        .join(".*") + "$",
-    );
+    // Matched in linear time: this runs on the worker every account shares,
+    // and a regex built from "**a**a**a**b" backtracks for seconds.
+    const re = { test: (r: string) => globMatch(pattern, r) };
     const walk = (dir: string, rel: string) => {
       let entries: fs.Dirent[];
       try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }