@foldrun/core 5.0.0 → 6.0.0

package/dist/src/evals.js

@@ -30,7 +30,7 @@
 // Deterministic checks run first and cost nothing. The judge only runs if
 // they pass — no point paying a model to grade output already known to be
 // wrong.
-import { accountModelEnv, withModelEnv } from "./model-env.js";
+import { accountModelEnv, withModelEnv, ModelKeyError } from "./model-env.js";
 import { sdkEnv } from "./step-exec.js";
 import { platformModelEnv } from "./runner.js";
 import fs from "node:fs";
@@ -582,7 +582,16 @@ export async function checkAssertion(assertion, output, agentDir, model, effort,
             catch (err) {
                 return { assertion, passed: false, detail: `judge not run — ${err instanceof Error ? err.message : String(err)}` };
             }
-            const said = await withModelEnv(m, (env) => judgeCall(assertion.value, output, model, effort, env));
+            let said;
+            try {
+                said = await withModelEnv(m, (env) => judgeCall(assertion.value, output, model, effort, env));
+            }
+            catch (err) {
+                // The provider's URL refused on the host (FOL-95), like a missing key above.
+                if (!(err instanceof ModelKeyError))
+                    throw err;
+                return { assertion, passed: false, detail: `judge not run — ${err.message}` };
+            }
             const { passed, detail } = judgeVerdict(said.text);
             return { assertion, passed, detail, costUsd: said.costUsd };
         }

package/dist/src/model-env.d.ts

@@ -19,11 +19,20 @@ export declare function accountModelEnv(tenant: string, workspace: string, platf
     translator: TranslatorSpec | null;
 };
 /**
- * Run `fn` with the model env, through a translator on this host when the
- * provider speaks Chat Completions or Responses — the same one a step uses
- * (runner.ts), started for this call and closed after it.
+ * Run `fn` with the model env, through a translator on this host — the one a
+ * step uses (runner.ts) when the provider speaks Chat Completions or
+ * Responses, and a passthrough when it speaks Anthropic's Messages (FOL-95):
+ * either way the SDK talks only to loopback, and the tenant's endpoint is
+ * reached through fetchUntrusted, after the platform's check of its URL.
+ * The platform's own credential (`supply: "platform"`) goes as it always did.
+ * Started for this call and closed after it.
  */
 export declare function withModelEnv<T>(m: {
     env: Record<string, string | undefined>;
     translator?: TranslatorSpec | null;
+    supply?: "provider" | "platform";
 }, fn: (env: Record<string, string | undefined>) => Promise<T>): Promise<T>;
+/** The passthrough for an Anthropic-format provider, read back from the env
+ *  providerEnvFor (store.ts) built for it: the base URL, the key in the slot
+ *  that names its header, and ANTHROPIC_CUSTOM_HEADERS. Null with no base. */
+export declare function anthropicPassthrough(env: Record<string, string | undefined>): TranslatorSpec | null;

package/dist/src/model-env.js

@@ -8,7 +8,7 @@
 import { accountDir, workspaceDir, parseProvider, providerEnvFor } from "./store.js";
 import { readAgentsMd } from "./runner.js";
 import { getSecret } from "./secrets.js";
-import { platform } from "./platform.js";
+import { platform, hostUrlProblem } from "./platform.js";
 import { accountModelBlock, isClaudeLoginToken } from "./model-credential.js";
 import { providerPreset } from "./providers.js";
 import { startTranslator, translatorSpecFor } from "./translator.js";
@@ -39,6 +39,13 @@ export function accountModelEnv(tenant, workspace, platformEnv) {
             throw new ModelKeyError(NO_MODEL_KEY);
         return { env: platformEnv(), supply: "platform", format: "anthropic", translator: null };
     }
+    // A host-side call to a URL the tenant wrote: on a platform, https only
+    // (platform.ts hostUrlProblem); withModelEnv asks the platform's own check
+    // too, and the guard sees every byte (FOL-95). A step resolves its
+    // provider elsewhere (runner.ts) and is not touched by this.
+    const refused = hostUrlProblem(spec.baseUrl);
+    if (refused)
+        throw new ModelKeyError(`provider base_url refused: ${refused}`, 422);
     const sub = (text) => text.replace(/\$\{([A-Z][A-Z0-9_]*)\}/g, (whole, name) => getSecret(tenant, name, workspace)?.value ?? whole);
     const token = sub(spec.token);
     if (token.includes("${"))
@@ -65,14 +72,22 @@ export function accountModelEnv(tenant, workspace, platformEnv) {
     };
 }
 /**
- * Run `fn` with the model env, through a translator on this host when the
- * provider speaks Chat Completions or Responses — the same one a step uses
- * (runner.ts), started for this call and closed after it.
+ * Run `fn` with the model env, through a translator on this host — the one a
+ * step uses (runner.ts) when the provider speaks Chat Completions or
+ * Responses, and a passthrough when it speaks Anthropic's Messages (FOL-95):
+ * either way the SDK talks only to loopback, and the tenant's endpoint is
+ * reached through fetchUntrusted, after the platform's check of its URL.
+ * The platform's own credential (`supply: "platform"`) goes as it always did.
+ * Started for this call and closed after it.
  */
 export async function withModelEnv(m, fn) {
-    if (!m.translator)
+    const spec = m.translator ?? (m.supply === "provider" ? anthropicPassthrough(m.env) : null);
+    if (!spec)
         return fn(m.env);
-    const t = await startTranslator(m.translator);
+    const why = await platform.checkUntrustedUrl(spec.upstreamBase);
+    if (why)
+        throw new ModelKeyError(`provider base_url refused: ${why}`, 422);
+    const t = await startTranslator(spec);
     try {
         return await fn({ ...m.env, ...t.env });
     }
@@ -80,3 +95,26 @@ export async function withModelEnv(m, fn) {
         await t.close();
     }
 }
+/** The passthrough for an Anthropic-format provider, read back from the env
+ *  providerEnvFor (store.ts) built for it: the base URL, the key in the slot
+ *  that names its header, and ANTHROPIC_CUSTOM_HEADERS. Null with no base. */
+export function anthropicPassthrough(env) {
+    const base = env.ANTHROPIC_BASE_URL;
+    if (!base)
+        return null;
+    const apiKey = env.ANTHROPIC_API_KEY ?? "";
+    const headers = {};
+    for (const line of (env.ANTHROPIC_CUSTOM_HEADERS ?? "").split("\n")) {
+        const at = line.indexOf(":");
+        if (at > 0)
+            headers[line.slice(0, at).trim()] = line.slice(at + 1).trim();
+    }
+    return {
+        wire: "anthropic",
+        upstreamBase: base,
+        upstreamKey: apiKey || (env.ANTHROPIC_AUTH_TOKEN ?? ""),
+        upstreamAuth: apiKey ? "x-api-key" : "bearer",
+        headers,
+        label: base,
+    };
+}

package/dist/src/platform.d.ts

@@ -175,6 +175,16 @@ export interface PlatformHooks {
     fetchUntrusted(url: string, init?: RequestInit, opts?: {
         maxBytes?: number;
     }): Promise<Response>;
+    /**
+     * May the host call this URL a tenant chose — a provider's base_url,
+     * before an eval's judge or a dashboard draft talks to it? A reason it may
+     * not, or null. This is the early refusal people can read; the guarantee
+     * is that every byte of such a call goes through fetchUntrusted (FOL-95).
+     * Default: hostUrlProblem below — https on an install that guards
+     * untrusted fetches, anything on a laptop (its own localhost included).
+     * A platform may bind a stricter check (the addresses a name resolves to).
+     */
+    checkUntrustedUrl(url: string): Promise<string | null>;
     /**
      * Hand a notify: webhook to whatever delivers it. The platform records
      * the delivery, makes the first attempt now and retries on a backoff from
@@ -207,6 +217,20 @@ export interface WebhookDeliveryOutcome {
     retrying?: boolean;
 }
 export declare const platform: PlatformHooks;
+/** True when this process fetches tenant-chosen URLs through a guard: a
+ *  platform bound fetchUntrusted. A laptop has not, and calls its own LAN on
+ *  purpose. */
+export declare function guardsUntrustedUrls(): boolean;
+/**
+ * Why the host may not call a tenant's model endpoint at this URL, or null.
+ * On an install that guards untrusted fetches the endpoint must be https: the
+ * key rides in every request, and a plain-http base is also how a tenant
+ * names a cluster service. Private and internal addresses are refused by the
+ * guard itself, on every hop. FOLDRUN_EGRESS_ALLOW_PRIVATE=1 — the operator's
+ * own install calling its own network — lifts this as it lifts the guard. A
+ * laptop: always null.
+ */
+export declare function hostUrlProblem(url: string): string | null;
 /** Install the platform's implementations. Partial: what is not given keeps its local default. */
 export declare function registerPlatform(hooks: Partial<PlatformHooks>): void;
 /**

package/dist/src/platform.js

@@ -12,6 +12,10 @@
 // and calls registerPlatform() once at boot. A process that forgets to is a
 // local install — which is exactly the failure that is safe.
 import { matchFilter } from "./trigger-filter.js";
+/** Marks the laptop's fetchUntrusted. A symbol from the global registry, not
+ *  the function itself: every bundle has its own copy of this module (see
+ *  KEY below), and only the shared object says which one was registered. */
+const LAPTOP_FETCH = Symbol.for("foldrun.laptop-fetch");
 const local = {
     edition: () => "self-hosted",
     async enqueueFlowRun(tenant, workspace, steps, flowName, modelOverride, tags = [], startedBy = null, opts = {}) {
@@ -40,7 +44,8 @@ const local = {
     platformKeyAllowed: () => true,
     galleryDir: () => null,
     noteOAuthRefresh: async () => undefined,
-    fetchUntrusted: (url, init) => fetch(url, init),
+    fetchUntrusted: Object.assign((url, init) => fetch(url, init), { [LAPTOP_FETCH]: true }),
+    checkUntrustedUrl: async (url) => hostUrlProblem(url),
     async deliverWebhook(tenant, workspace, delivery) {
         const { attemptWebhook, newDeliveryId } = await import("./notify.js");
         const deliveryId = newDeliveryId();
@@ -60,6 +65,35 @@ const local = {
 const KEY = Symbol.for("foldrun.platform");
 const g = globalThis;
 export const platform = (g[KEY] ??= { ...local });
+/** True when this process fetches tenant-chosen URLs through a guard: a
+ *  platform bound fetchUntrusted. A laptop has not, and calls its own LAN on
+ *  purpose. */
+export function guardsUntrustedUrls() {
+    return !platform.fetchUntrusted[LAPTOP_FETCH];
+}
+/**
+ * Why the host may not call a tenant's model endpoint at this URL, or null.
+ * On an install that guards untrusted fetches the endpoint must be https: the
+ * key rides in every request, and a plain-http base is also how a tenant
+ * names a cluster service. Private and internal addresses are refused by the
+ * guard itself, on every hop. FOLDRUN_EGRESS_ALLOW_PRIVATE=1 — the operator's
+ * own install calling its own network — lifts this as it lifts the guard. A
+ * laptop: always null.
+ */
+export function hostUrlProblem(url) {
+    if (!guardsUntrustedUrls() || process.env.FOLDRUN_EGRESS_ALLOW_PRIVATE === "1")
+        return null;
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return `${url} is not a URL`;
+    }
+    if (u.protocol !== "https:")
+        return `${u.origin} is not https — this platform calls a model endpoint only over https`;
+    return null;
+}
 /** Install the platform's implementations. Partial: what is not given keeps its local default. */
 export function registerPlatform(hooks) {
     Object.assign(platform, hooks, {

package/dist/src/runner.d.ts

@@ -387,6 +387,7 @@ grantsOnly?: boolean): {
         upstreamBase: string;
         wire?: import("./translator.ts").TranslatorWire;
         upstreamKey: string;
+        upstreamAuth?: "bearer" | "x-api-key";
         headers?: Record<string, string>;
         maxTokensParam?: "max_tokens" | "max_completion_tokens";
         reasoningEffort?: boolean;
@@ -400,6 +401,7 @@ grantsOnly?: boolean): {
         upstreamBase: string;
         wire?: import("./translator.ts").TranslatorWire;
         upstreamKey: string;
+        upstreamAuth?: "bearer" | "x-api-key";
         headers?: Record<string, string>;
         maxTokensParam?: "max_tokens" | "max_completion_tokens";
         reasoningEffort?: boolean;

package/dist/src/translator.d.ts

@@ -11,15 +11,21 @@ export declare function anthropicUsage(u: Json | undefined, wire: TranslatorWire
     cached: number;
     output: number;
 };
-export type TranslatorWire = "chat" | "responses";
+/** `anthropic` is no translation at all: the host-side passthrough for an
+ *  endpoint that already speaks Messages, so the SDK on the host talks only
+ *  to loopback and every byte to the tenant's URL goes through the guard
+ *  (FOL-95). A step never gets it (translatorSpecFor returns null there). */
+export type TranslatorWire = "chat" | "responses" | "anthropic";
 export interface TranslatorSpec {
     /** The provider's base, e.g. https://api.openai.com/v1 — `/chat/completions`
      *  or `/responses` is appended, by `wire`. */
     upstreamBase: string;
     /** Which OpenAI shape the endpoint speaks. Default chat. */
     wire?: TranslatorWire;
-    /** Already resolved. Sent as `Authorization: Bearer`. */
+    /** Already resolved. Sent as `Authorization: Bearer`, or as `x-api-key`
+     *  where `upstreamAuth` says so (the anthropic wire only). */
     upstreamKey: string;
+    upstreamAuth?: "bearer" | "x-api-key";
     /** Extra headers the provider wants, already resolved. */
     headers?: Record<string, string>;
     maxTokensParam?: "max_tokens" | "max_completion_tokens";

package/dist/src/translator.js

@@ -893,6 +893,8 @@ export async function startTranslator(spec) {
                 req.on("end", () => resolve(body));
                 req.on("error", reject);
             });
+            if (spec.wire === "anthropic")
+                return await passthrough(spec, base, label, req, url, raw, res, log, started);
             if (req.method === "POST" && url.pathname === "/v1/messages/count_tokens") {
                 // No endpoint on the other side counts for us; four characters a
                 // token is the estimate every tokenizer lands near for English.
@@ -1058,6 +1060,77 @@ export async function startTranslator(spec) {
         }),
     };
 }
+/** Request headers the SDK's own call carries that the endpoint is owed:
+ *  the content type, and Anthropic's version and beta flags. Its credential
+ *  (the translator's key) is not one of them. */
+const PASSED_HEADERS = /^(content-type|accept|anthropic-[a-z0-9-]+)$/;
+/** Response headers that describe the bytes as they came off the wire —
+ *  fetch has already decoded them, so they would lie on the way back. */
+const HOP_HEADERS = new Set(["content-encoding", "content-length", "transfer-encoding", "connection", "keep-alive"]);
+/**
+ * The anthropic wire: the SDK's request, as it is, to the same path under the
+ * tenant's base URL, with the tenant's key put on here — through
+ * fetchUntrusted, so no private or cluster address, no redirect that takes
+ * the key to another origin, and the answer read to UPSTREAM_MAX_BYTES. The
+ * answer streams back as it arrives, status and headers included.
+ */
+async function passthrough(spec, base, label, req, url, raw, res, log, started) {
+    // Lowercase keys, so a header named twice in different case is one header,
+    // and the provider's own headers last: one that carries its credential
+    // itself (an Authorization or x-api-key in `headers:`) wins over the key
+    // slot, as on the Chat Completions wire above.
+    const headers = {};
+    for (const [k, v] of Object.entries(req.headers))
+        if (PASSED_HEADERS.test(k) && typeof v === "string")
+            headers[k] = v;
+    if (spec.upstreamKey) {
+        if (spec.upstreamAuth === "x-api-key")
+            headers["x-api-key"] = spec.upstreamKey;
+        else
+            headers.authorization = `Bearer ${spec.upstreamKey}`;
+    }
+    for (const [k, v] of Object.entries(spec.headers ?? {}))
+        headers[k.toLowerCase()] = v;
+    const method = req.method ?? "GET";
+    const target = `${base}${url.pathname}${url.search}`;
+    let upstream;
+    try {
+        upstream = await fetchUntrusted(target, { method, headers, body: method === "GET" || method === "HEAD" ? undefined : raw }, { sameOrigin: true, maxBytes: UPSTREAM_MAX_BYTES });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        log.push(`${method} ${label}${url.pathname} → unreachable: ${message}`);
+        res.writeHead(502, { "content-type": "application/json" });
+        res.end(errorBody(502, `translator: could not reach ${label}: ${message}`));
+        return;
+    }
+    const out = {};
+    upstream.headers.forEach((v, k) => {
+        if (!HOP_HEADERS.has(k))
+            out[k] = v;
+    });
+    res.writeHead(upstream.status, out);
+    log.push(`${method} ${label}${url.pathname} → ${upstream.status} (${Date.now() - started}ms)`);
+    const reader = upstream.body?.getReader();
+    if (!reader)
+        return void res.end();
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            res.write(value);
+        }
+        res.end();
+    }
+    catch (err) {
+        // Mid-answer (the cap, a dropped connection): an Anthropic error event,
+        // so a stream reads as failed, not as a reply that merely stopped.
+        const message = err instanceof Error ? err.message : String(err);
+        log.push(`translator error: ${message}`);
+        res.end(`event: error\ndata: ${errorBody(500, `translator: ${message}`)}\n\n`);
+    }
+}
 /**
  * What a provider block needs from the translator, or null when the block
  * speaks Anthropic and needs none. Values only — this crosses into the run

package/dist/src/webhook.js

@@ -115,8 +115,8 @@ export function recordDelivery(tenant, workspace, delivery) {
     const file = deliveriesFile(tenant, workspace);
     if (!fs.existsSync(path.dirname(file)))
         return; // no workspace, nothing to log against
-    if (UNAUTHENTICATED.includes(delivery.outcome) && collapseInto(file, delivery))
-        return;
+    if (UNAUTHENTICATED.includes(delivery.outcome))
+        return recordRefusal(file, tenant, workspace, delivery);
     fs.appendFileSync(file, JSON.stringify(delivery) + "\n");
     // Bounded: compact to the newest KEEP when it doubles. Amortised cheap,
     // and a log that grows forever is a disk-full incident with a delay.
@@ -132,9 +132,42 @@ export function recordDelivery(tenant, workspace, delivery) {
         // compaction is best-effort; the append already landed
     }
 }
+/**
+ * A refusal — anyone's to send — never changes the workspace's directory: no
+ * new file, no tmp file, no rename. The directory's mtime is the workspace's
+ * deployedAt (store.ts listWorkspaces), and a stranger posting a bad token
+ * moved it (FOL-102). So a refusal goes into a log that already exists, in
+ * place (an append, or the last line rewritten), and is never the write that
+ * compacts it; a workspace with no log yet gets a server log line instead,
+ * at most one a minute per workspace.
+ */
+function recordRefusal(file, tenant, workspace, delivery) {
+    if (!fs.existsSync(file))
+        return noteRefusal(tenant, workspace, delivery);
+    if (collapseInto(file, delivery))
+        return;
+    fs.appendFileSync(file, JSON.stringify(delivery) + "\n");
+}
+const REFUSAL_NOTE_MS = 60_000;
+const refusalNotes = new Map();
+function noteRefusal(tenant, workspace, delivery) {
+    const key = `${tenant}/${workspace}`;
+    const now = Date.now();
+    const seen = refusalNotes.get(key);
+    if (seen && now - seen.at < REFUSAL_NOTE_MS) {
+        seen.since++;
+        return;
+    }
+    const more = seen?.since ? ` (and ${seen.since} more since the last note)` : "";
+    console.warn(`[hooks] refused a delivery to ${key}/${delivery.flow}: ${delivery.outcome}${more}`);
+    refusalNotes.set(key, { at: now, since: 0 });
+    if (refusalNotes.size > 10_000)
+        refusalNotes.clear(); // bounded: a note lost beats memory
+}
 /** Fold a refusal into the log's last line when that line is a refusal
  *  too. The flow name is not part of the match: it comes from the URL, so
- *  a flood that varies it would otherwise never collapse. True when folded. */
+ *  a flood that varies it would otherwise never collapse. True when folded.
+ *  Rewritten in place, never through a rename (recordRefusal says why). */
 function collapseInto(file, delivery) {
     let text;
     try {
@@ -160,9 +193,16 @@ function collapseInto(file, delivery) {
         first: last.first ?? last.t,
         ...(last.detail === "more than one flow name" || last.flow !== delivery.flow ? { detail: "more than one flow name" } : {}),
     };
-    const tmp = `${file}.tmp`;
-    fs.writeFileSync(tmp, end.slice(0, cut) + JSON.stringify(merged) + "\n");
-    fs.renameSync(tmp, file);
+    const line = Buffer.from(JSON.stringify(merged) + "\n");
+    const at = Buffer.byteLength(end.slice(0, cut));
+    const fd = fs.openSync(file, "r+");
+    try {
+        fs.writeSync(fd, line, 0, line.length, at);
+        fs.ftruncateSync(fd, at + line.length);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
     return true;
 }
 export function readDeliveries(tenant, workspace, limit = 20) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldrun/core",
-  "version": "5.0.0",
+  "version": "6.0.0",
   "description": "Agents are just folders. The format, the runner, the checks.",
   "license": "FSL-1.1-ALv2",
   "type": "module",

package/src/evals.ts

@@ -31,7 +31,7 @@
 // they pass — no point paying a model to grade output already known to be
 // wrong.
 
-import { accountModelEnv, withModelEnv } from "./model-env.ts";
+import { accountModelEnv, withModelEnv, ModelKeyError } from "./model-env.ts";
 import type { TranslatorSpec } from "./translator.ts";
 import { sdkEnv } from "./step-exec.ts";
 import { platformModelEnv } from "./runner.ts";
@@ -746,7 +746,14 @@ export async function checkAssertion(
       } catch (err) {
         return { assertion, passed: false, detail: `judge not run — ${err instanceof Error ? err.message : String(err)}` };
       }
-      const said = await withModelEnv(m, (env) => judgeCall(assertion.value, output, model, effort, env));
+      let said: Awaited<ReturnType<typeof judgeCall>>;
+      try {
+        said = await withModelEnv(m, (env) => judgeCall(assertion.value, output, model, effort, env));
+      } catch (err) {
+        // The provider's URL refused on the host (FOL-95), like a missing key above.
+        if (!(err instanceof ModelKeyError)) throw err;
+        return { assertion, passed: false, detail: `judge not run — ${err.message}` };
+      }
       const { passed, detail } = judgeVerdict(said.text);
       return { assertion, passed, detail, costUsd: said.costUsd };
     }

package/src/model-env.ts

@@ -9,7 +9,7 @@
 import { accountDir, workspaceDir, parseProvider, providerEnvFor } from "./store.ts";
 import { readAgentsMd } from "./runner.ts";
 import { getSecret } from "./secrets.ts";
-import { platform } from "./platform.ts";
+import { platform, hostUrlProblem } from "./platform.ts";
 import { accountModelBlock, isClaudeLoginToken } from "./model-credential.ts";
 import { providerPreset } from "./providers.ts";
 import { startTranslator, translatorSpecFor, type TranslatorSpec } from "./translator.ts";
@@ -53,6 +53,12 @@ export function accountModelEnv(
     if (!platform.platformKeyAllowed(tenant)) throw new ModelKeyError(NO_MODEL_KEY);
     return { env: platformEnv(), supply: "platform", format: "anthropic", translator: null };
   }
+  // A host-side call to a URL the tenant wrote: on a platform, https only
+  // (platform.ts hostUrlProblem); withModelEnv asks the platform's own check
+  // too, and the guard sees every byte (FOL-95). A step resolves its
+  // provider elsewhere (runner.ts) and is not touched by this.
+  const refused = hostUrlProblem(spec.baseUrl);
+  if (refused) throw new ModelKeyError(`provider base_url refused: ${refused}`, 422);
   const sub = (text: string) =>
     text.replace(/\$\{([A-Z][A-Z0-9_]*)\}/g, (whole, name) => getSecret(tenant, name, workspace)?.value ?? whole);
   const token = sub(spec.token);
@@ -80,19 +86,48 @@ export function accountModelEnv(
 }
 
 /**
- * Run `fn` with the model env, through a translator on this host when the
- * provider speaks Chat Completions or Responses — the same one a step uses
- * (runner.ts), started for this call and closed after it.
+ * Run `fn` with the model env, through a translator on this host — the one a
+ * step uses (runner.ts) when the provider speaks Chat Completions or
+ * Responses, and a passthrough when it speaks Anthropic's Messages (FOL-95):
+ * either way the SDK talks only to loopback, and the tenant's endpoint is
+ * reached through fetchUntrusted, after the platform's check of its URL.
+ * The platform's own credential (`supply: "platform"`) goes as it always did.
+ * Started for this call and closed after it.
  */
 export async function withModelEnv<T>(
-  m: { env: Record<string, string | undefined>; translator?: TranslatorSpec | null },
+  m: { env: Record<string, string | undefined>; translator?: TranslatorSpec | null; supply?: "provider" | "platform" },
   fn: (env: Record<string, string | undefined>) => Promise<T>,
 ): Promise<T> {
-  if (!m.translator) return fn(m.env);
-  const t = await startTranslator(m.translator);
+  const spec = m.translator ?? (m.supply === "provider" ? anthropicPassthrough(m.env) : null);
+  if (!spec) return fn(m.env);
+  const why = await platform.checkUntrustedUrl(spec.upstreamBase);
+  if (why) throw new ModelKeyError(`provider base_url refused: ${why}`, 422);
+  const t = await startTranslator(spec);
   try {
     return await fn({ ...m.env, ...t.env });
   } finally {
     await t.close();
   }
 }
+
+/** The passthrough for an Anthropic-format provider, read back from the env
+ *  providerEnvFor (store.ts) built for it: the base URL, the key in the slot
+ *  that names its header, and ANTHROPIC_CUSTOM_HEADERS. Null with no base. */
+export function anthropicPassthrough(env: Record<string, string | undefined>): TranslatorSpec | null {
+  const base = env.ANTHROPIC_BASE_URL;
+  if (!base) return null;
+  const apiKey = env.ANTHROPIC_API_KEY ?? "";
+  const headers: Record<string, string> = {};
+  for (const line of (env.ANTHROPIC_CUSTOM_HEADERS ?? "").split("\n")) {
+    const at = line.indexOf(":");
+    if (at > 0) headers[line.slice(0, at).trim()] = line.slice(at + 1).trim();
+  }
+  return {
+    wire: "anthropic",
+    upstreamBase: base,
+    upstreamKey: apiKey || (env.ANTHROPIC_AUTH_TOKEN ?? ""),
+    upstreamAuth: apiKey ? "x-api-key" : "bearer",
+    headers,
+    label: base,
+  };
+}

package/src/platform.ts

@@ -177,6 +177,16 @@ export interface PlatformHooks {
    * caps it again, so a laptop's plain fetch may ignore it).
    */
   fetchUntrusted(url: string, init?: RequestInit, opts?: { maxBytes?: number }): Promise<Response>;
+  /**
+   * May the host call this URL a tenant chose — a provider's base_url,
+   * before an eval's judge or a dashboard draft talks to it? A reason it may
+   * not, or null. This is the early refusal people can read; the guarantee
+   * is that every byte of such a call goes through fetchUntrusted (FOL-95).
+   * Default: hostUrlProblem below — https on an install that guards
+   * untrusted fetches, anything on a laptop (its own localhost included).
+   * A platform may bind a stricter check (the addresses a name resolves to).
+   */
+  checkUntrustedUrl(url: string): Promise<string | null>;
   /**
    * Hand a notify: webhook to whatever delivers it. The platform records
    * the delivery, makes the first attempt now and retries on a backoff from
@@ -210,6 +220,11 @@ export interface WebhookDeliveryOutcome {
   retrying?: boolean;
 }
 
+/** Marks the laptop's fetchUntrusted. A symbol from the global registry, not
+ *  the function itself: every bundle has its own copy of this module (see
+ *  KEY below), and only the shared object says which one was registered. */
+const LAPTOP_FETCH = Symbol.for("foldrun.laptop-fetch");
+
 const local: PlatformHooks = {
   edition: () => "self-hosted",
   async enqueueFlowRun(tenant, workspace, steps, flowName, modelOverride, tags = [], startedBy = null, opts = {}) {
@@ -237,7 +252,8 @@ const local: PlatformHooks = {
   platformKeyAllowed: () => true,
   galleryDir: () => null,
   noteOAuthRefresh: async () => undefined,
-  fetchUntrusted: (url, init) => fetch(url, init),
+  fetchUntrusted: Object.assign((url: string, init?: RequestInit) => fetch(url, init), { [LAPTOP_FETCH]: true }),
+  checkUntrustedUrl: async (url) => hostUrlProblem(url),
   async deliverWebhook(tenant, workspace, delivery) {
     const { attemptWebhook, newDeliveryId } = await import("./notify.ts");
     const deliveryId = newDeliveryId();
@@ -259,6 +275,34 @@ const KEY = Symbol.for("foldrun.platform");
 const g = globalThis as unknown as Record<symbol, PlatformHooks | undefined>;
 export const platform: PlatformHooks = (g[KEY] ??= { ...local });
 
+/** True when this process fetches tenant-chosen URLs through a guard: a
+ *  platform bound fetchUntrusted. A laptop has not, and calls its own LAN on
+ *  purpose. */
+export function guardsUntrustedUrls(): boolean {
+  return !(platform.fetchUntrusted as unknown as Record<symbol, unknown>)[LAPTOP_FETCH];
+}
+
+/**
+ * Why the host may not call a tenant's model endpoint at this URL, or null.
+ * On an install that guards untrusted fetches the endpoint must be https: the
+ * key rides in every request, and a plain-http base is also how a tenant
+ * names a cluster service. Private and internal addresses are refused by the
+ * guard itself, on every hop. FOLDRUN_EGRESS_ALLOW_PRIVATE=1 — the operator's
+ * own install calling its own network — lifts this as it lifts the guard. A
+ * laptop: always null.
+ */
+export function hostUrlProblem(url: string): string | null {
+  if (!guardsUntrustedUrls() || process.env.FOLDRUN_EGRESS_ALLOW_PRIVATE === "1") return null;
+  let u: URL;
+  try {
+    u = new URL(url);
+  } catch {
+    return `${url} is not a URL`;
+  }
+  if (u.protocol !== "https:") return `${u.origin} is not https — this platform calls a model endpoint only over https`;
+  return null;
+}
+
 /** Install the platform's implementations. Partial: what is not given keeps its local default. */
 export function registerPlatform(hooks: Partial<PlatformHooks>): void {
   Object.assign(platform, hooks, {

package/src/translator.ts

@@ -68,7 +68,11 @@ function usageBlock(u: { input: number; cached: number; output: number } | null)
   };
 }
 
-export type TranslatorWire = "chat" | "responses";
+/** `anthropic` is no translation at all: the host-side passthrough for an
+ *  endpoint that already speaks Messages, so the SDK on the host talks only
+ *  to loopback and every byte to the tenant's URL goes through the guard
+ *  (FOL-95). A step never gets it (translatorSpecFor returns null there). */
+export type TranslatorWire = "chat" | "responses" | "anthropic";
 
 export interface TranslatorSpec {
   /** The provider's base, e.g. https://api.openai.com/v1 — `/chat/completions`
@@ -76,8 +80,10 @@ export interface TranslatorSpec {
   upstreamBase: string;
   /** Which OpenAI shape the endpoint speaks. Default chat. */
   wire?: TranslatorWire;
-  /** Already resolved. Sent as `Authorization: Bearer`. */
+  /** Already resolved. Sent as `Authorization: Bearer`, or as `x-api-key`
+   *  where `upstreamAuth` says so (the anthropic wire only). */
   upstreamKey: string;
+  upstreamAuth?: "bearer" | "x-api-key";
   /** Extra headers the provider wants, already resolved. */
   headers?: Record<string, string>;
   maxTokensParam?: "max_tokens" | "max_completion_tokens";
@@ -943,6 +949,8 @@ export async function startTranslator(spec: TranslatorSpec): Promise<RunningTran
         req.on("error", reject);
       });
 
+      if (spec.wire === "anthropic") return await passthrough(spec, base, label, req, url, raw, res, log, started);
+
       if (req.method === "POST" && url.pathname === "/v1/messages/count_tokens") {
         // No endpoint on the other side counts for us; four characters a
         // token is the estimate every tokenizer lands near for English.
@@ -1105,6 +1113,79 @@ export async function startTranslator(spec: TranslatorSpec): Promise<RunningTran
   };
 }
 
+/** Request headers the SDK's own call carries that the endpoint is owed:
+ *  the content type, and Anthropic's version and beta flags. Its credential
+ *  (the translator's key) is not one of them. */
+const PASSED_HEADERS = /^(content-type|accept|anthropic-[a-z0-9-]+)$/;
+/** Response headers that describe the bytes as they came off the wire —
+ *  fetch has already decoded them, so they would lie on the way back. */
+const HOP_HEADERS = new Set(["content-encoding", "content-length", "transfer-encoding", "connection", "keep-alive"]);
+
+/**
+ * The anthropic wire: the SDK's request, as it is, to the same path under the
+ * tenant's base URL, with the tenant's key put on here — through
+ * fetchUntrusted, so no private or cluster address, no redirect that takes
+ * the key to another origin, and the answer read to UPSTREAM_MAX_BYTES. The
+ * answer streams back as it arrives, status and headers included.
+ */
+async function passthrough(
+  spec: TranslatorSpec,
+  base: string,
+  label: string,
+  req: http.IncomingMessage,
+  url: URL,
+  raw: string,
+  res: http.ServerResponse,
+  log: string[],
+  started: number,
+): Promise<void> {
+  // Lowercase keys, so a header named twice in different case is one header,
+  // and the provider's own headers last: one that carries its credential
+  // itself (an Authorization or x-api-key in `headers:`) wins over the key
+  // slot, as on the Chat Completions wire above.
+  const headers: Record<string, string> = {};
+  for (const [k, v] of Object.entries(req.headers)) if (PASSED_HEADERS.test(k) && typeof v === "string") headers[k] = v;
+  if (spec.upstreamKey) {
+    if (spec.upstreamAuth === "x-api-key") headers["x-api-key"] = spec.upstreamKey;
+    else headers.authorization = `Bearer ${spec.upstreamKey}`;
+  }
+  for (const [k, v] of Object.entries(spec.headers ?? {})) headers[k.toLowerCase()] = v;
+  const method = req.method ?? "GET";
+  const target = `${base}${url.pathname}${url.search}`;
+  let upstream: Response;
+  try {
+    upstream = await fetchUntrusted(target, { method, headers, body: method === "GET" || method === "HEAD" ? undefined : raw }, { sameOrigin: true, maxBytes: UPSTREAM_MAX_BYTES });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log.push(`${method} ${label}${url.pathname} → unreachable: ${message}`);
+    res.writeHead(502, { "content-type": "application/json" });
+    res.end(errorBody(502, `translator: could not reach ${label}: ${message}`));
+    return;
+  }
+  const out: Record<string, string> = {};
+  upstream.headers.forEach((v, k) => {
+    if (!HOP_HEADERS.has(k)) out[k] = v;
+  });
+  res.writeHead(upstream.status, out);
+  log.push(`${method} ${label}${url.pathname} → ${upstream.status} (${Date.now() - started}ms)`);
+  const reader = upstream.body?.getReader();
+  if (!reader) return void res.end();
+  try {
+    for (;;) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      res.write(value);
+    }
+    res.end();
+  } catch (err) {
+    // Mid-answer (the cap, a dropped connection): an Anthropic error event,
+    // so a stream reads as failed, not as a reply that merely stopped.
+    const message = err instanceof Error ? err.message : String(err);
+    log.push(`translator error: ${message}`);
+    res.end(`event: error\ndata: ${errorBody(500, `translator: ${message}`)}\n\n`);
+  }
+}
+
 /**
  * What a provider block needs from the translator, or null when the block
  * speaks Anthropic and needs none. Values only — this crosses into the run

package/src/webhook.ts

@@ -163,7 +163,7 @@ const KEEP_DELIVERIES = 500;
 export function recordDelivery(tenant: string, workspace: string, delivery: HookDelivery) {
   const file = deliveriesFile(tenant, workspace);
   if (!fs.existsSync(path.dirname(file))) return; // no workspace, nothing to log against
-  if (UNAUTHENTICATED.includes(delivery.outcome) && collapseInto(file, delivery)) return;
+  if (UNAUTHENTICATED.includes(delivery.outcome)) return recordRefusal(file, tenant, workspace, delivery);
   fs.appendFileSync(file, JSON.stringify(delivery) + "\n");
   // Bounded: compact to the newest KEEP when it doubles. Amortised cheap,
   // and a log that grows forever is a disk-full incident with a delay.
@@ -179,9 +179,42 @@ export function recordDelivery(tenant: string, workspace: string, delivery: Hook
   }
 }
 
+/**
+ * A refusal — anyone's to send — never changes the workspace's directory: no
+ * new file, no tmp file, no rename. The directory's mtime is the workspace's
+ * deployedAt (store.ts listWorkspaces), and a stranger posting a bad token
+ * moved it (FOL-102). So a refusal goes into a log that already exists, in
+ * place (an append, or the last line rewritten), and is never the write that
+ * compacts it; a workspace with no log yet gets a server log line instead,
+ * at most one a minute per workspace.
+ */
+function recordRefusal(file: string, tenant: string, workspace: string, delivery: HookDelivery) {
+  if (!fs.existsSync(file)) return noteRefusal(tenant, workspace, delivery);
+  if (collapseInto(file, delivery)) return;
+  fs.appendFileSync(file, JSON.stringify(delivery) + "\n");
+}
+
+const REFUSAL_NOTE_MS = 60_000;
+const refusalNotes = new Map<string, { at: number; since: number }>();
+
+function noteRefusal(tenant: string, workspace: string, delivery: HookDelivery) {
+  const key = `${tenant}/${workspace}`;
+  const now = Date.now();
+  const seen = refusalNotes.get(key);
+  if (seen && now - seen.at < REFUSAL_NOTE_MS) {
+    seen.since++;
+    return;
+  }
+  const more = seen?.since ? ` (and ${seen.since} more since the last note)` : "";
+  console.warn(`[hooks] refused a delivery to ${key}/${delivery.flow}: ${delivery.outcome}${more}`);
+  refusalNotes.set(key, { at: now, since: 0 });
+  if (refusalNotes.size > 10_000) refusalNotes.clear(); // bounded: a note lost beats memory
+}
+
 /** Fold a refusal into the log's last line when that line is a refusal
  *  too. The flow name is not part of the match: it comes from the URL, so
- *  a flood that varies it would otherwise never collapse. True when folded. */
+ *  a flood that varies it would otherwise never collapse. True when folded.
+ *  Rewritten in place, never through a rename (recordRefusal says why). */
 function collapseInto(file: string, delivery: HookDelivery): boolean {
   let text: string;
   try {
@@ -204,9 +237,15 @@ function collapseInto(file: string, delivery: HookDelivery): boolean {
     first: last.first ?? last.t,
     ...(last.detail === "more than one flow name" || last.flow !== delivery.flow ? { detail: "more than one flow name" } : {}),
   };
-  const tmp = `${file}.tmp`;
-  fs.writeFileSync(tmp, end.slice(0, cut) + JSON.stringify(merged) + "\n");
-  fs.renameSync(tmp, file);
+  const line = Buffer.from(JSON.stringify(merged) + "\n");
+  const at = Buffer.byteLength(end.slice(0, cut));
+  const fd = fs.openSync(file, "r+");
+  try {
+    fs.writeSync(fd, line, 0, line.length, at);
+    fs.ftruncateSync(fd, at + line.length);
+  } finally {
+    fs.closeSync(fd);
+  }
   return true;
 }