@foldrun/core 4.0.0 → 6.0.0

package/src/tool-test.ts

@@ -19,7 +19,8 @@ import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
-import { resolveSecrets, materializeSecrets } from "./secrets.ts";
+import { resolveSecrets, materializeSecrets, secretSites } from "./secrets.ts";
+import { siteCovers } from "./network.ts";
 import { listAgents, workspaceDir, type ToolDef } from "./store.ts";
 import { libraryDir } from "./library.ts";
 import { secretsUsedByApi } from "./api-tools.ts";
@@ -96,6 +97,27 @@ export interface ToolTestInput {
   args?: Record<string, string>;
 }
 
+/**
+ * A script or a command-started MCP server is the tenant's own code. On an
+ * install that isolates runs (FOLDRUN_RUN_ISOLATION) that code only ever runs
+ * in a step's sandbox — the web pod that answers Test is not one: it holds
+ * the platform's keys and every account's files (29 Oct 2026, OWASP review;
+ * hooks' Test was already refused the same way).
+ */
+function hostCodeRefusal(transport: "script" | "mcp"): Omit<ToolTestResult, "ms"> | null {
+  if (!process.env.FOLDRUN_RUN_ISOLATION) return null;
+  return {
+    ok: false,
+    transport,
+    missingSecrets: [],
+    summary: "this tool runs your own code, which this install runs only inside a step's sandbox — not from here",
+    detail:
+      "Test it locally with\n  foldrun tool test <name>\n" +
+      "or with a test run of a flow whose agent has it under tools:, e.g.\n" +
+      "  foldrun invoke <flow> --to <workspace> --test --wait",
+  };
+}
+
 export async function testTool(
   tenant: string,
   workspace: string,
@@ -170,6 +192,19 @@ export async function testTool(
           detail: `base: ${api.base}\npath: ${probePath}`,
         });
       }
+      // A secret bound to sites is filled in a run only by the egress proxy,
+      // only for those sites. The tester fills secrets itself, so it must ask
+      // the same question — or any editor could write a tool whose base is
+      // their own server and "test" the account's Stripe key out to it.
+      const bound = secretSites(tenant, needed, workspace);
+      const offSite = Object.entries(bound).filter(([, sites]) => !sites.some((site) => siteCovers(site, url.hostname))).map(([n]) => n);
+      if (offSite.length) {
+        return done({
+          ok: false, transport: "http", missingSecrets: missing,
+          summary: `${offSite.join(", ")} ${offSite.length === 1 ? "is" : "are"} bound to other sites than ${url.hostname} — not sent`,
+          detail: offSite.map((n) => `${n}: ${bound[n].join(", ")}`).join("\n"),
+        });
+      }
       for (const [k, v] of Object.entries(api.query)) url.searchParams.set(k, substitute(v, env));
 
       const headers: Record<string, string> = {};
@@ -219,6 +254,8 @@ export async function testTool(
   }
 
   if (def.kind === "script") {
+    const refused = hostCodeRefusal("script");
+    if (refused) return done(refused);
     let run = String(def.spec.run ?? "");
     // A run's working directory is the calling AGENT's folder, not the
     // workspace root — and scripts rely on that. `path.resolve(cwd, "..",
@@ -404,6 +441,8 @@ export async function testTool(
       detail: "",
     });
   }
+  const refusedMcp = hostCodeRefusal("mcp");
+  if (refusedMcp) return done(refusedMcp);
 
   const named = Object.entries(spec.env ?? {})
     .map(([, v]) => String(v).match(/^\$\{([A-Z0-9_]+)\}$/)?.[1])

package/src/translator.ts

@@ -68,7 +68,11 @@ function usageBlock(u: { input: number; cached: number; output: number } | null)
   };
 }
 
-export type TranslatorWire = "chat" | "responses";
+/** `anthropic` is no translation at all: the host-side passthrough for an
+ *  endpoint that already speaks Messages, so the SDK on the host talks only
+ *  to loopback and every byte to the tenant's URL goes through the guard
+ *  (FOL-95). A step never gets it (translatorSpecFor returns null there). */
+export type TranslatorWire = "chat" | "responses" | "anthropic";
 
 export interface TranslatorSpec {
   /** The provider's base, e.g. https://api.openai.com/v1 — `/chat/completions`
@@ -76,8 +80,10 @@ export interface TranslatorSpec {
   upstreamBase: string;
   /** Which OpenAI shape the endpoint speaks. Default chat. */
   wire?: TranslatorWire;
-  /** Already resolved. Sent as `Authorization: Bearer`. */
+  /** Already resolved. Sent as `Authorization: Bearer`, or as `x-api-key`
+   *  where `upstreamAuth` says so (the anthropic wire only). */
   upstreamKey: string;
+  upstreamAuth?: "bearer" | "x-api-key";
   /** Extra headers the provider wants, already resolved. */
   headers?: Record<string, string>;
   maxTokensParam?: "max_tokens" | "max_completion_tokens";
@@ -943,6 +949,8 @@ export async function startTranslator(spec: TranslatorSpec): Promise<RunningTran
         req.on("error", reject);
       });
 
+      if (spec.wire === "anthropic") return await passthrough(spec, base, label, req, url, raw, res, log, started);
+
       if (req.method === "POST" && url.pathname === "/v1/messages/count_tokens") {
         // No endpoint on the other side counts for us; four characters a
         // token is the estimate every tokenizer lands near for English.
@@ -1105,6 +1113,79 @@ export async function startTranslator(spec: TranslatorSpec): Promise<RunningTran
   };
 }
 
+/** Request headers the SDK's own call carries that the endpoint is owed:
+ *  the content type, and Anthropic's version and beta flags. Its credential
+ *  (the translator's key) is not one of them. */
+const PASSED_HEADERS = /^(content-type|accept|anthropic-[a-z0-9-]+)$/;
+/** Response headers that describe the bytes as they came off the wire —
+ *  fetch has already decoded them, so they would lie on the way back. */
+const HOP_HEADERS = new Set(["content-encoding", "content-length", "transfer-encoding", "connection", "keep-alive"]);
+
+/**
+ * The anthropic wire: the SDK's request, as it is, to the same path under the
+ * tenant's base URL, with the tenant's key put on here — through
+ * fetchUntrusted, so no private or cluster address, no redirect that takes
+ * the key to another origin, and the answer read to UPSTREAM_MAX_BYTES. The
+ * answer streams back as it arrives, status and headers included.
+ */
+async function passthrough(
+  spec: TranslatorSpec,
+  base: string,
+  label: string,
+  req: http.IncomingMessage,
+  url: URL,
+  raw: string,
+  res: http.ServerResponse,
+  log: string[],
+  started: number,
+): Promise<void> {
+  // Lowercase keys, so a header named twice in different case is one header,
+  // and the provider's own headers last: one that carries its credential
+  // itself (an Authorization or x-api-key in `headers:`) wins over the key
+  // slot, as on the Chat Completions wire above.
+  const headers: Record<string, string> = {};
+  for (const [k, v] of Object.entries(req.headers)) if (PASSED_HEADERS.test(k) && typeof v === "string") headers[k] = v;
+  if (spec.upstreamKey) {
+    if (spec.upstreamAuth === "x-api-key") headers["x-api-key"] = spec.upstreamKey;
+    else headers.authorization = `Bearer ${spec.upstreamKey}`;
+  }
+  for (const [k, v] of Object.entries(spec.headers ?? {})) headers[k.toLowerCase()] = v;
+  const method = req.method ?? "GET";
+  const target = `${base}${url.pathname}${url.search}`;
+  let upstream: Response;
+  try {
+    upstream = await fetchUntrusted(target, { method, headers, body: method === "GET" || method === "HEAD" ? undefined : raw }, { sameOrigin: true, maxBytes: UPSTREAM_MAX_BYTES });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log.push(`${method} ${label}${url.pathname} → unreachable: ${message}`);
+    res.writeHead(502, { "content-type": "application/json" });
+    res.end(errorBody(502, `translator: could not reach ${label}: ${message}`));
+    return;
+  }
+  const out: Record<string, string> = {};
+  upstream.headers.forEach((v, k) => {
+    if (!HOP_HEADERS.has(k)) out[k] = v;
+  });
+  res.writeHead(upstream.status, out);
+  log.push(`${method} ${label}${url.pathname} → ${upstream.status} (${Date.now() - started}ms)`);
+  const reader = upstream.body?.getReader();
+  if (!reader) return void res.end();
+  try {
+    for (;;) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      res.write(value);
+    }
+    res.end();
+  } catch (err) {
+    // Mid-answer (the cap, a dropped connection): an Anthropic error event,
+    // so a stream reads as failed, not as a reply that merely stopped.
+    const message = err instanceof Error ? err.message : String(err);
+    log.push(`translator error: ${message}`);
+    res.end(`event: error\ndata: ${errorBody(500, `translator: ${message}`)}\n\n`);
+  }
+}
+
 /**
  * What a provider block needs from the translator, or null when the block
  * speaks Anthropic and needs none. Values only — this crosses into the run

package/src/webhook.ts

@@ -163,7 +163,7 @@ const KEEP_DELIVERIES = 500;
 export function recordDelivery(tenant: string, workspace: string, delivery: HookDelivery) {
   const file = deliveriesFile(tenant, workspace);
   if (!fs.existsSync(path.dirname(file))) return; // no workspace, nothing to log against
-  if (UNAUTHENTICATED.includes(delivery.outcome) && collapseInto(file, delivery)) return;
+  if (UNAUTHENTICATED.includes(delivery.outcome)) return recordRefusal(file, tenant, workspace, delivery);
   fs.appendFileSync(file, JSON.stringify(delivery) + "\n");
   // Bounded: compact to the newest KEEP when it doubles. Amortised cheap,
   // and a log that grows forever is a disk-full incident with a delay.
@@ -179,9 +179,42 @@ export function recordDelivery(tenant: string, workspace: string, delivery: Hook
   }
 }
 
+/**
+ * A refusal — anyone's to send — never changes the workspace's directory: no
+ * new file, no tmp file, no rename. The directory's mtime is the workspace's
+ * deployedAt (store.ts listWorkspaces), and a stranger posting a bad token
+ * moved it (FOL-102). So a refusal goes into a log that already exists, in
+ * place (an append, or the last line rewritten), and is never the write that
+ * compacts it; a workspace with no log yet gets a server log line instead,
+ * at most one a minute per workspace.
+ */
+function recordRefusal(file: string, tenant: string, workspace: string, delivery: HookDelivery) {
+  if (!fs.existsSync(file)) return noteRefusal(tenant, workspace, delivery);
+  if (collapseInto(file, delivery)) return;
+  fs.appendFileSync(file, JSON.stringify(delivery) + "\n");
+}
+
+const REFUSAL_NOTE_MS = 60_000;
+const refusalNotes = new Map<string, { at: number; since: number }>();
+
+function noteRefusal(tenant: string, workspace: string, delivery: HookDelivery) {
+  const key = `${tenant}/${workspace}`;
+  const now = Date.now();
+  const seen = refusalNotes.get(key);
+  if (seen && now - seen.at < REFUSAL_NOTE_MS) {
+    seen.since++;
+    return;
+  }
+  const more = seen?.since ? ` (and ${seen.since} more since the last note)` : "";
+  console.warn(`[hooks] refused a delivery to ${key}/${delivery.flow}: ${delivery.outcome}${more}`);
+  refusalNotes.set(key, { at: now, since: 0 });
+  if (refusalNotes.size > 10_000) refusalNotes.clear(); // bounded: a note lost beats memory
+}
+
 /** Fold a refusal into the log's last line when that line is a refusal
  *  too. The flow name is not part of the match: it comes from the URL, so
- *  a flood that varies it would otherwise never collapse. True when folded. */
+ *  a flood that varies it would otherwise never collapse. True when folded.
+ *  Rewritten in place, never through a rename (recordRefusal says why). */
 function collapseInto(file: string, delivery: HookDelivery): boolean {
   let text: string;
   try {
@@ -204,9 +237,15 @@ function collapseInto(file: string, delivery: HookDelivery): boolean {
     first: last.first ?? last.t,
     ...(last.detail === "more than one flow name" || last.flow !== delivery.flow ? { detail: "more than one flow name" } : {}),
   };
-  const tmp = `${file}.tmp`;
-  fs.writeFileSync(tmp, end.slice(0, cut) + JSON.stringify(merged) + "\n");
-  fs.renameSync(tmp, file);
+  const line = Buffer.from(JSON.stringify(merged) + "\n");
+  const at = Buffer.byteLength(end.slice(0, cut));
+  const fd = fs.openSync(file, "r+");
+  try {
+    fs.writeSync(fd, line, 0, line.length, at);
+    fs.ftruncateSync(fd, at + line.length);
+  } finally {
+    fs.closeSync(fd);
+  }
   return true;
 }