@foldrun/core 8.0.1 → 9.1.0

package/src/approvals.ts

@@ -13,7 +13,7 @@
 import crypto from "node:crypto";
 import { readRun, writeRun, readFlow, mayApprove, type FlowInfo, type RunRecord } from "./store.ts";
 import { platform } from "./platform.ts";
-import { approveToken, installKey } from "./webhook.ts";
+import { approveToken, eventToken, installKey } from "./webhook.ts";
 
 export interface ApprovalDecision {
   decision: "approve" | "reject";
@@ -361,6 +361,60 @@ export async function expireStaleGate(
  * key through the dashboard's approve route — and `step` releases one
  * waiting step rather than all of them.
  */
+const EVENT_WAIT_LINE = "waiting for an external event — release it with POST ";
+
+/**
+ * What a presented event token opens on a run (30 Oct 2026): `known` when
+ * it is a real token of this run — one of its parks, or the old per-run
+ * form — and `steps`, the waiting steps it releases now (none: a 409, the
+ * gate it was for is no longer waiting).
+ *
+ * With `step` (the `&step=` every URL printed since carries), the token is
+ * that step's, bound to the moment it parked: the `t` of its "waiting for an
+ * external event" line. It releases that step only while that park is the
+ * step's current one — a released step is no longer waiting, and a step
+ * parked again (a loop) has a new `t` — so a URL handed out for one gate
+ * opens neither a later gate nor a later park.
+ *
+ * Without `step`, the per-run token URLs carried before then. It releases
+ * only a step still waiting under such a URL — its park line has no
+ * `step=` — so a run parked when this shipped can still be released, and
+ * nothing parked since can be released by the old form.
+ */
+export function eventGatesFor(
+  tenant: string,
+  workspace: string,
+  run: RunRecord,
+  presented: string,
+  step: number | null,
+): { known: boolean; steps: number[] } {
+  const none = { known: false, steps: [] as number[] };
+  if (!presented) return none;
+  const same = (want: string) => {
+    const a = Buffer.from(presented), b = Buffer.from(want);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+  };
+  const parks = (i: number) => (run.steps[i]?.events ?? []).filter((e) => e?.text?.startsWith(EVENT_WAIT_LINE));
+  const waiting = (i: number) => {
+    const s = run.steps[i];
+    return !!s && s.status === "awaiting-approval" && s.waitFor === "event";
+  };
+  if (step !== null) {
+    const lines = parks(step);
+    const hit = lines.findIndex((e) => same(eventToken(tenant, workspace, run.id, { step, at: e.t })));
+    if (hit < 0) return none;
+    // Only the step's latest park is open, and only while it waits.
+    return { known: true, steps: hit === lines.length - 1 && waiting(step) ? [step] : [] };
+  }
+  if (!same(eventToken(tenant, workspace, run.id))) return none;
+  const legacy: number[] = [];
+  for (let i = 0; i < run.steps.length; i++) {
+    const last = parks(i).at(-1);
+    if (last && waiting(i) && !/[?&]step=\d/.test(last.text)) legacy.push(i);
+  }
+  return { known: true, steps: legacy };
+}
+
 export async function deliverEvent(
   tenant: string,
   workspace: string,

package/src/catalog.ts

@@ -155,6 +155,33 @@ export async function loadCatalog(baseUrl: string): Promise<Catalog | null> {
   }
 }
 
+/** How long after an attempt a background refresh of the same gateway is
+ *  not tried again, whether it worked or not. */
+export const CATALOG_RETRY_MS = 5 * 60_000;
+const lastTried = new Map<string, number>();
+
+/**
+ * Refresh a gateway's catalogue behind the caller, at most once per
+ * CATALOG_RETRY_MS per gateway (30 Oct 2026). For the editor's completions and
+ * the flows page, which ask on every request: a stale or missing catalogue
+ * used to start a fresh outbound fetch each time — a 10 s one per keystroke
+ * against an unreachable gateway, nothing remembering that it had just
+ * failed. The attempt is noted before it starts, so callers arriving while
+ * one is in flight do not start another. True when one was started. A run's
+ * own read (loadCatalog) is untouched.
+ */
+export function refreshCatalogSoon(baseUrl: string, load: (baseUrl: string) => Promise<unknown> = loadCatalog, now = Date.now()): boolean {
+  const cached = readCatalog(baseUrl);
+  if (cached && now - Date.parse(cached.fetchedAt) < TTL_MS) return false; // fresh: nothing to fetch
+  const last = lastTried.get(baseUrl);
+  if (last !== undefined && now - last < CATALOG_RETRY_MS) return false;
+  lastTried.delete(baseUrl);
+  lastTried.set(baseUrl, now);
+  if (lastTried.size > 1000) lastTried.delete(lastTried.keys().next().value as string);
+  void load(baseUrl).catch(() => null);
+  return true;
+}
+
 /** A preset reference — settings live in the gateway's dashboard, opaque to
  *  us on purpose. The catalogue offers no opinion on one. */
 export const isPresetRef = (model: string) => model.startsWith("@preset/");

package/src/cron.ts

@@ -118,3 +118,22 @@ export function cronProblem(expr: unknown): string | null {
     ? `schedule: "${expr}" has ${fields} field${fields === 1 ? "" : "s"}; cron has five — minute hour day-of-month month day-of-week ("0 9 * * MON"), or @hourly, @daily, @weekly, @monthly. As written the flow never fires`
     : `schedule: "${expr}" is not a cron the scheduler can read — a field is out of range or not a number (minute 0-59, hour 0-23, day 1-31, month 1-12, weekday 0-7 or sun-sat). As written the flow never fires`;
 }
+
+/** Days in each month, February at its leap-year 29: a cron naming the 29th
+ *  of February does fire, every fourth year. */
+const MONTH_DAYS = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+
+/**
+ * Whether the calendar has any day this cron names (30 Oct 2026). `0 0 30 2 *`
+ * parses — every field is in range — yet no February has a 30th, so a search
+ * for its next fire walked the whole window every time it was asked (the
+ * schedule page did, 57,600 minutes per flow per request). Answered from the
+ * fields alone: only a day of the month with no weekday beside it can miss,
+ * since with a weekday either may match and every month has every weekday.
+ */
+export function cronCanFire(cron: Cron): boolean {
+  if (!cron.domRestricted || cron.dowRestricted) return true;
+  const firstDay = Math.min(...cron.dom);
+  for (const m of cron.month) if (firstDay <= MONTH_DAYS[m - 1]!) return true;
+  return false;
+}

package/src/frontmatter-fields.ts

@@ -156,7 +156,7 @@ const FLOW: FieldSpec[] = [
   { key: "catchup", type: "string", validated: true, help: "last | none" },
   { key: "on", type: "string", validated: true, help: "trigger: flow — completed | failed | blocked | any" },
   { key: "signature", type: "string", validated: true, help: "github | stripe | slack | hmac" },
-  { key: "signing_secret", type: "string", help: "the secret a webhook's signature is checked with" },
+  { key: "signing_secret", type: "string", help: "the NAME of the vault secret a webhook's signature is checked with — never the value" },
   { key: "after", type: ["string", "list"], help: "trigger: flow — the flow this one follows" },
   { key: "at", type: "string", help: "trigger: once — when" },
   { key: "url", type: "string", help: "trigger: watch — the page watched" },

package/src/frontmatter-schema.ts

@@ -6,7 +6,8 @@ import { FRONTMATTER, JOBS, type FieldType, type SchemaKind } from "./frontmatte
 import { jobFold } from "./matter.ts";
 import { resolveEffort, parseDuration, parseInstant, parseRate, STEP_OPTION_KEYS } from "./store.ts";
 import { budgetProblem } from "./budget.ts";
-import { cronProblem } from "./cron.ts";
+import { cronProblem, parseCron, cronCanFire } from "./cron.ts";
+import { SECRET_NAME } from "./secrets.ts";
 import { modelSecretCollision } from "./model-credential.ts";
 import { resourcesProblem, computeProblem } from "./resources.ts";
 
@@ -70,7 +71,7 @@ const CHECKS: Partial<Record<SchemaKind, Record<string, (value: unknown) => stri
 
 export interface FieldProblem {
   key: string;
-  rule: "config/unknown-field" | "config/wrong-type" | "config/invalid-value" | "config/missing-field" | "config/conflict" | "config/misplaced";
+  rule: "config/unknown-field" | "config/wrong-type" | "config/invalid-value" | "config/missing-field" | "config/conflict" | "config/misplaced" | "config/cron-never-fires" | "secret/signing-secret-value";
   level: "error" | "warn" | "info";
   message: string;
 }
@@ -172,12 +173,47 @@ export function frontmatterProblems(
         : null;
     if (why) out.push({ key, rule: "config/invalid-value", level: "warn", message: `\`${key}:\` ${why.replace(/^\w+: /, "")}` });
   }
+  // A cron every field of which is in range, on a day no month has —
+  // `0 0 30 2 *`. The scheduler's own cronCanFire decides (30 Oct 2026), so
+  // check and the scheduler say the same about it: it never fires.
+  if (kind === "flow" && typeof data.schedule === "string") {
+    const cron = parseCron(data.schedule);
+    if (cron && !cronCanFire(cron)) {
+      out.push({ key: "schedule", rule: "config/cron-never-fires", level: "warn", message: `\`schedule: "${data.schedule}"\` names a day no month it allows has — the flow never fires. Pick a day every named month has, or add a weekday` });
+    }
+  }
+  // A signing secret is the NAME of a vault entry (30 Oct 2026): a flow's
+  // `signing_secret:` and notify's `signing_secret:` are looked up with
+  // getSecret, so a literal value there is a secret written into a
+  // versioned, deployed file — and never matches anything in the vault.
+  // The message never repeats the value.
+  if (kind === "flow" && data.signing_secret !== undefined) {
+    const why = signingSecretProblem(data.signing_secret);
+    if (why) out.push({ key: "signing_secret", rule: "secret/signing-secret-value", level: "warn", message: `\`signing_secret:\` ${why}` });
+  }
+  if (kind === "agents-md" && data.notify && typeof data.notify === "object" && !Array.isArray(data.notify)) {
+    const raw = (data.notify as { signing_secret?: unknown }).signing_secret;
+    const why = raw === undefined ? null : signingSecretProblem(raw);
+    if (why) out.push({ key: "notify", rule: "secret/signing-secret-value", level: "warn", message: `\`notify: signing_secret:\` ${why}` });
+  }
   if (kind === "skill" && !(typeof data.description === "string" && data.description.trim())) {
     out.push({ key: "description", rule: "config/missing-field", level: "warn", message: "no `description:` — a skill without one is never loaded; the model chooses a skill by it" });
   }
   return out;
 }
 
+/** Why a `signing_secret:` value is not a vault secret's name, or null. The
+ *  runtime reads `NAME` and `${NAME}` alike (notify.ts, store.ts). Never
+ *  says what the value is: it may be the secret itself. */
+export function signingSecretProblem(v: unknown): string | null {
+  if (typeof v !== "string") return null; // config/wrong-type says so
+  const name = v.trim().replace(/^\$\{|\}$/g, "");
+  if (!name) return null;
+  return SECRET_NAME.test(name)
+    ? null
+    : "holds something that is not a secret's name (UPPER_SNAKE_CASE, like WEBHOOK_SIGNING_KEY) — it is looked up in the vault by name, so a value written here is never found, and is deployed and versioned in plain text. Put the value in the vault (`foldrun secrets set NAME`), write the name here, and rotate it";
+}
+
 function askProblem(v: unknown): string | null {
   const t = (v as { timeout?: unknown } | null)?.timeout;
   return t === undefined ? null : DURATION(30, 86400, "30s to 24h")(t);

package/src/history.ts

@@ -98,6 +98,16 @@ const historyDir = (tenant: string, scope: string) => {
   return path.join(dataRoot(), tenant, ".history", scope);
 };
 
+/** Refuse (400) a deploy's `commit` that cannot be a revision id. A writer
+ *  calls this BEFORE it writes: checked only in recordRevision, after the
+ *  files were replaced, a bad commit left the new source live with no
+ *  revision, no snapshot and no audit entry (30 Oct 2026). */
+export function assertCommitId(commit: string) {
+  if (typeof commit !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._@-]{0,120}$/.test(commit)) {
+    throw Object.assign(new Error(`commit "${String(commit).slice(0, 130)}" is not a commit id — letters, digits and . _ @ -, at most 121 characters`), { status: 400 });
+  }
+}
+
 /** A local revision id: sortable by time, unique enough, visibly not a sha. */
 export function newRevisionId(now = new Date()): string {
   return `r-${now.getTime().toString(36)}-${crypto.randomBytes(3).toString("hex")}`;
@@ -121,8 +131,16 @@ export function recordRevision(
 
   const dir = historyDir(tenant, scope);
   fs.mkdirSync(dir, { recursive: true });
+  // A commit is the revision's id only the first time it is recorded. A
+  // second deploy of one commit (a CI re-run after a dashboard edit), or a
+  // `commit` that names a revision already here, overwrote that revision's
+  // record and its snapshot (30 Oct 2026) — History could no longer restore
+  // to it. It gets its own id now; `commit` still says which one it was,
+  // and a restore by commit (resolveRevision) still finds it.
+  if (meta.commit) assertCommitId(meta.commit);
+  const commitId = meta.commit && !fs.existsSync(path.join(dir, `${meta.commit}.json`)) ? meta.commit : null;
   const rev: Revision = {
-    id: meta.id ?? meta.commit ?? newRevisionId(),
+    id: meta.id ?? commitId ?? newRevisionId(),
     at: new Date().toISOString(),
     by: meta.by ?? "system",
     message: meta.message ?? describe(changed),
@@ -301,7 +319,11 @@ export function resolveRevision(
     hit = all.find((r) => Date.parse(r.at) <= moment);
   } else {
     if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,120}$/.test(t)) throw Object.assign(new Error(`not a revision or a time: ${to}`), { status: 400 });
-    hit = all.find((r) => r.id === t || r.commit === t || (t.length >= 7 && r.commit?.startsWith(t)));
+    // An exact id first, then a commit: a commit deployed twice is recorded
+    // once under its own id and again under a fresh one naming it (30 Oct
+    // 2026, recordRevision), and newest-first with one predicate answered
+    // the first revision's id with the second's snapshot.
+    hit = all.find((r) => r.id === t) ?? all.find((r) => r.commit === t || (t.length >= 7 && r.commit?.startsWith(t)));
   }
   return hit ? { id: hit.id, at: hit.at, by: hit.by, message: hit.message } : null;
 }
@@ -409,8 +431,13 @@ export function changedPathsBetween(tenant: string, scope: string, from: string
   if (!from || !to) return null;
   if (from === to) return [];
   const revs = listRevisions(tenant, scope, { limit: 500 }); // newest first
-  const ti = revs.findIndex((r) => r.id === to || r.commit === to);
-  const fi = revs.findIndex((r) => r.id === from || r.commit === from);
+  // An exact id before a commit, as resolveRevision.
+  const at = (x: string) => {
+    const byId = revs.findIndex((r) => r.id === x);
+    return byId >= 0 ? byId : revs.findIndex((r) => r.commit === x);
+  };
+  const ti = at(to);
+  const fi = at(from);
   if (ti < 0 || fi < 0 || ti > fi) return null;
   return [...new Set(revs.slice(ti, fi).flatMap((r) => r.paths))].sort();
 }

package/src/hooks.ts

@@ -44,6 +44,11 @@ export const HOOK_TIMEOUT_MAX = 120;
 export const HOOK_CODE_MAX = 100 * 1024;
 const NAME = /^[a-z0-9][a-z0-9-]{0,63}$/;
 
+/** A hook's name: its folder's name, never a path. */
+export function isHookName(name: unknown): name is string {
+  return typeof name === "string" && NAME.test(name);
+}
+
 export interface HookDef {
   name: string;
   /** The folder holding hook.md and run.mjs. */
@@ -139,6 +144,15 @@ export function resolveHooks(args: {
   for (const name of args.names) {
     if (seen.has(name)) continue;
     seen.add(name);
+    // Checked before the name is joined to anything (30 Oct 2026): readHookDef
+    // tested only basename(dir), so `../../<tenant>/workspaces/<ws>/hooks/<h>`
+    // passed, and the hook test route answered which folders exist anywhere
+    // on the server — on a laptop it would have run that run.mjs. An error,
+    // not missing: a step refuses either way, and the name is the problem.
+    if (!isHookName(name)) {
+      errors.push(`"${name}" is not a hook name — lowercase letters, digits and dashes (the hook's folder name)`);
+      continue;
+    }
     const own = path.join(args.workspaceRoot, "hooks", name);
     const shared = path.join(args.libraryRoot, "hooks", name);
     const dir = fs.existsSync(own) ? own : fs.existsSync(shared) ? shared : null;

package/src/library.ts

@@ -282,6 +282,9 @@ export function deleteLibraryPath(
 ) {
   const norm = path.normalize(rel);
   if (norm.startsWith("..") || path.isAbsolute(norm)) throw new Error(`illegal path: ${rel}`);
+  // "." (or "./", "a/..") is the shelf itself: one call took every shared
+  // tool or skill from every workspace (30 Oct 2026). Name what goes.
+  if (norm === "." || norm === "./") throw new Error(`illegal path: ${rel} — name the file or folder to delete, not the whole ${kind} shelf`);
   const target = path.join(libraryDir(tenant, kind), norm);
   const gone: { path: string; before: string | null; after: null }[] = [];
   if (fs.existsSync(target)) {

package/src/notify.ts

@@ -34,7 +34,8 @@
 import crypto from "node:crypto";
 import { readAgentsMd } from "./runner.ts";
 import { accountDir, workspaceDir, runCost, readFlow, runVerdict, type RunRecord } from "./store.ts";
-import { getSecret } from "./secrets.ts";
+import { getSecret, secretSites, signingSecretShown, accountSecretUsableIn } from "./secrets.ts";
+import { siteCovers } from "./network.ts";
 import { publicUrl } from "./webhook.ts";
 import { approveLinkPath, approveLinkTtlMs } from "./approvals.ts";
 import { noteSecretUse, healthKey } from "./secret-health.ts";
@@ -62,11 +63,15 @@ export function platformMail(tenant: string): { key: string; from: string } | nu
   return own;
 }
 
-/** The account's own Resend key and sender, or null when it has none. */
-export function accountMail(tenant: string): { key: string; from: string } | null {
-  const own = getSecret(tenant, "RESEND_API_KEY");
+/** The account's own Resend key and sender, or null when it has none.
+ *  With a workspace — mail a workspace's run causes — an account key or
+ *  sender limited to other workspaces is not used (30 Oct 2026); the
+ *  account's own mail (resets, invites) names none and is not limited. */
+export function accountMail(tenant: string, workspace?: string): { key: string; from: string } | null {
+  const usable = (name: string) => !workspace || accountSecretUsableIn(tenant, name, workspace);
+  const own = usable("RESEND_API_KEY") ? getSecret(tenant, "RESEND_API_KEY") : null;
   if (!own) return null;
-  const from = getSecret(tenant, "EMAIL_FROM")?.value?.trim() || "foldrun <onboarding@resend.dev>";
+  const from = (usable("EMAIL_FROM") ? getSecret(tenant, "EMAIL_FROM")?.value?.trim() : "") || "foldrun <onboarding@resend.dev>";
   return { key: own.value, from };
 }
 
@@ -80,8 +85,15 @@ export function accountMail(tenant: string): { key: string; from: string } | nul
  * owner's bin. The platform's key is the fallback for an account that set
  * none, so `notify:` works before anyone has configured mail at all.
  */
-export function notifyMail(tenant: string): { key: string; from: string } | null {
-  return accountMail(tenant) ?? platformMail(tenant);
+export function notifyMail(tenant: string, workspace?: string): { key: string; from: string } | null {
+  if (!workspace) return accountMail(tenant) ?? platformMail(tenant);
+  // A workspace's notification: the account's sender only where it may be
+  // used, else the platform's — never platformMail's fall back to the
+  // account's own key, which would walk around the limit.
+  const own = accountMail(tenant, workspace);
+  if (own) return own;
+  const key = process.env.FOLDRUN_RESEND_API_KEY;
+  return key ? { key, from: platform.setting("FOLDRUN_EMAIL_FROM") || "foldrun <hello@foldrun.io>" } : null;
 }
 
 /** Was the mail sent on the account's own key? Only then is a refusal from
@@ -168,7 +180,7 @@ export function signatureHeaders(
   const secret = getSecret(tenant, config.signingSecret, workspace);
   if (!secret) {
     console.error(
-      `[foldrun] notify: signing_secret names ${config.signingSecret}, which is not in the vault for ${tenant}/${workspace} — sending unsigned`,
+      `[foldrun] notify: signing_secret names ${signingSecretShown(config.signingSecret)}, which is not in the vault for ${tenant}/${workspace} — sending unsigned`,
     );
     return {};
   }
@@ -209,15 +221,80 @@ export function newDeliveryId(): string {
 }
 
 /** The URL with ${SECRET}s resolved, and how it may be shown: a Slack hook
- *  URL is itself a credential, so it is never echoed resolved. */
-export function webhookTarget(tenant: string, workspace: string, config: NotifyConfig | null = notifyConfig(tenant, workspace)): { url: string | null; shown: string } {
+ *  URL is itself a credential, so it is never echoed resolved.
+ *
+ *  A secret bound to sites (`foldrun secrets sites`) is filled only when the
+ *  resolved URL's host is one of them — the rule the egress proxy and the
+ *  tool tester keep (30 Oct 2026). Before, notify.url filled any secret into
+ *  any host, so an editor could write `https://their.server/?k=${STRIPE_KEY}`
+ *  and press Test. The host is read AFTER filling, because the usual shape is
+ *  the whole URL as one secret (`${SLACK_WEBHOOK_URL}`, bound to
+ *  hooks.slack.com). An unbound secret fills as it does for an agent's
+ *  `secrets:` and a tool test — workspace first, then the account — since
+ *  binding is how an account says where a value may go. `refused` says why
+ *  `url` is null when a binding stopped it; `filled` maps each value put
+ *  into the URL to its name, so an error that echoes the URL can be scrubbed. */
+export function webhookTarget(
+  tenant: string,
+  workspace: string,
+  config: NotifyConfig | null = notifyConfig(tenant, workspace),
+): { url: string | null; shown: string; refused?: string; filled: Record<string, string> } {
   const raw = config?.url ?? "";
+  const filled: Record<string, string> = {};
+  // Every name put in, kept apart from `filled` (value → name, for
+  // scrubbing): two secrets with the same value would otherwise leave only
+  // the last name there, and the first one's binding would go unchecked.
+  const used = new Set<string>();
   const url = raw.replace(/\$\{([A-Z][A-Z0-9_]*)\}/g, (whole, name) => {
     const hit = getSecret(tenant, name, workspace);
+    if (hit) {
+      filled[hit.value] = name;
+      used.add(name);
+    }
     return hit ? hit.value : whole;
   });
   const shown = raw.includes("${") ? raw : raw ? `${raw.slice(0, 40)}${raw.length > 40 ? "…" : ""}` : "none";
-  return { url: !url || url.includes("${") ? null : url, shown };
+  if (!url || url.includes("${")) return { url: null, shown, filled: {} };
+  const bound = secretSites(tenant, [...used], workspace);
+  if (Object.keys(bound).length) {
+    let host = "";
+    try {
+      host = new URL(url).hostname;
+    } catch {
+      // Not a URL: no host can be one of its sites.
+    }
+    const offSite = Object.entries(bound).filter(([, sites]) => !host || !sites.some((site) => siteCovers(site, host))).map(([n]) => n);
+    if (offSite.length) {
+      return {
+        url: null,
+        shown,
+        filled: {},
+        // The host is not echoed: it is read from the FILLED url, so
+        // `https://${KEY}.their.server/` would print the key back.
+        refused: `${offSite.join(", ")} ${offSite.length === 1 ? "is" : "are"} bound to other sites than notify.url's host — not sent`,
+      };
+    }
+  }
+  return { url, shown, filled };
+}
+
+/** An error about a request to a resolved notify.url, with every secret value
+ *  put back as its ${NAME} — a redirect refusal quotes the URL it was sent to,
+ *  and the delivery log that keeps it is read by every viewer. */
+function scrubTarget(text: string, filled: Record<string, string>): string {
+  let out = text;
+  // Longest first, so a value inside another is not half-replaced.
+  for (const value of Object.keys(filled).sort((a, b) => b.length - a.length)) {
+    if (!value) continue;
+    const variants = new Set([value]);
+    try {
+      variants.add(encodeURI(value)).add(encodeURIComponent(value));
+    } catch {
+      // A lone surrogate cannot be encoded, so it cannot appear encoded.
+    }
+    for (const v of variants) out = out.split(v).join(`\${${filled[value]}}`);
+  }
+  return out;
 }
 
 export interface WebhookAttempt {
@@ -252,10 +329,13 @@ export async function attemptWebhook(
   if (!config?.url) {
     return { ...base, ok: false, statusCode: null, durationMs: 0, response: null, error: "this workspace's notify: has no url any more" };
   }
-  const { url } = webhookTarget(tenant, workspace, config);
+  const { url, refused, filled } = webhookTarget(tenant, workspace, config);
   if (!url) {
-    return { ...base, ok: false, statusCode: null, durationMs: 0, response: null, error: "the secret named in notify.url is not in this account's vault" };
+    return { ...base, ok: false, statusCode: null, durationMs: 0, response: null, error: refused ?? "the secret named in notify.url is not in this account's vault" };
   }
+  // A URL that carries a secret is a credential: a redirect is followed only
+  // within the origin it was sent to, as the tool tester does.
+  const carriesSecret = Object.keys(filled).length > 0;
   try {
     const res = await fetchUntrusted(url, {
       method: "POST",
@@ -270,7 +350,7 @@ export async function attemptWebhook(
       },
       body: d.body,
       signal: AbortSignal.timeout(Number(process.env.FOLDRUN_WEBHOOK_TIMEOUT_MS) || 8000),
-    });
+    }, { sameOrigin: carriesSecret });
     const text = (await res.text().catch(() => "")).slice(0, 500);
     return {
       ...base,
@@ -282,7 +362,7 @@ export async function attemptWebhook(
     };
   } catch (err) {
     const why = err instanceof Error ? (err.name === "TimeoutError" ? "timed out" : err.message) : String(err);
-    return { ...base, ok: false, statusCode: null, durationMs: Date.now() - started, response: null, error: why.slice(0, 500) };
+    return { ...base, ok: false, statusCode: null, durationMs: Date.now() - started, response: null, error: scrubTarget(why, filled).slice(0, 500) };
   }
 }
 
@@ -406,7 +486,7 @@ export async function sendPlainNotificationOutcome(
   };
   try {
     if (config.email) {
-      const mail = notifyMail(tenant);
+      const mail = notifyMail(tenant, workspace);
       if (!mail) return no;
       const r = await sendMail({
         tenant,
@@ -460,7 +540,7 @@ export async function sendTestNotification(
   const detail = `Sent from ${workspace} at ${sent}. If you are reading this, failures and approval gates will reach you here too.`;
 
   if (config.email) {
-    const mail = notifyMail(tenant);
+    const mail = notifyMail(tenant, workspace);
     if (!mail) {
       return {
         ok: false,
@@ -486,9 +566,9 @@ export async function sendTestNotification(
   // The destination is echoed back with the secret still unresolved: a
   // Slack webhook URL is itself a credential, and a page that prints it is
   // a page that leaks it into a screenshot.
-  const { url, shown } = webhookTarget(tenant, workspace, config);
+  const { url, shown, refused } = webhookTarget(tenant, workspace, config);
   if (!url) {
-    return { ok: false, destination: shown, detail: `the secret named in notify.url is not in this account's vault` };
+    return { ok: false, destination: shown, detail: refused ?? `the secret named in notify.url is not in this account's vault` };
   }
   const payload = JSON.stringify({ text: `${headline} — ${detail}`, workspace, status: "test", summary: detail });
   // One attempt, recorded in the delivery log like any other — and the way
@@ -499,7 +579,7 @@ export async function sendTestNotification(
     ? {
         ok: true,
         destination: shown,
-        detail: `${config.signingSecret ? "accepted, signed with " + config.signingSecret : "accepted"} (delivery ${r.deliveryId})`,
+        detail: `${config.signingSecret ? "accepted, signed with " + signingSecretShown(config.signingSecret) : "accepted"} (delivery ${r.deliveryId})`,
       }
     : { ok: false, destination: shown, detail: `${r.statusCode ? `HTTP ${r.statusCode} — ` : ""}${r.detail.replace(/\s+/g, " ").slice(0, 400)}` };
 }
@@ -590,7 +670,7 @@ export async function sendRunNotification(
 
   try {
     if (config.email) {
-      const mail = notifyMail(tenant);
+      const mail = notifyMail(tenant, workspace);
       if (!mail) {
         console.error(`[foldrun] notify: email configured but no mail credential — set RESEND_API_KEY (and EMAIL_FROM) on the account ${tenant}, or FOLDRUN_RESEND_API_KEY on the platform`);
         return false;
@@ -635,8 +715,9 @@ export async function sendRunNotification(
 
     // ${SECRET} so the Slack URL — itself a credential — can live in the
     // vault instead of in a file that gets committed.
-    if (!webhookTarget(tenant, workspace, config).url) {
-      console.error(`[foldrun] notify: secret in URL not set for ${tenant}/${workspace}`);
+    const target = webhookTarget(tenant, workspace, config);
+    if (!target.url) {
+      console.error(`[foldrun] notify: ${target.refused ?? "secret in URL not set"} for ${tenant}/${workspace}`);
       return false;
     }
     const event = blocked ? "blocked" : run.status;

package/src/package.ts

@@ -74,8 +74,10 @@ export interface Package {
 /** An error the API layer turns into a status rather than a 500. */
 export class PackageError extends Error {
   readonly status: number;
-  constructor(message: string, status: number) {
-    super(message);
+  /** `cause`: the error underneath a 500, so an HTTP caller can log it and
+   *  answer without it — a Node error names the server's paths (30 Oct 2026). */
+  constructor(message: string, status: number, opts?: { cause?: unknown }) {
+    super(message, opts);
     this.status = status;
   }
 }
@@ -437,7 +439,7 @@ export function applyImport(
         // best effort — the error below is the one to report
       }
     }
-    throw new PackageError(`the import could not be written, and nothing was kept: ${err instanceof Error ? err.message : String(err)}`, 500);
+    throw new PackageError(`the import could not be written, and nothing was kept: ${err instanceof Error ? err.message : String(err)}`, 500, { cause: err });
   }
   for (const c of changes) {
     const abs = path.join(dir, c.path);

package/src/runner.ts

@@ -90,6 +90,7 @@ import {
   STORAGE_DIR,
   adoptLegacyVersionKey,
   listAgents,
+  isOneSegment,
 } from "./store.ts";
 import { canReadBack } from "./tool-output.ts";
 import { PromptLayers, promptCacheKey } from "./prompt-layers.ts";
@@ -4926,8 +4927,12 @@ function driveRunInner(
           // finished steps to `failed`, destroying the history it was
           // resuming around.
           if (step.status !== "pending") continue;
-          const aDir = path.join(pDir, "agents", step.agent);
-          if (!fs.existsSync(path.join(aDir, "agent.md"))) {
+          // One folder under agents/, never a path (30 Oct 2026): an ad-hoc
+          // run's agent came from the URL, and `../../<tenant>/…` joined here
+          // ran another account's agent. Refused as not found, before the
+          // existence check could answer for a path outside.
+          const aDir = isOneSegment(step.agent) ? path.join(pDir, "agents", step.agent) : null;
+          if (!aDir || !fs.existsSync(path.join(aDir, "agent.md"))) {
             step.status = "failed";
             step.events.push({
               t: new Date().toISOString(),
@@ -5035,15 +5040,18 @@ function driveRunInner(
         if (needsApproval.length) {
           for (const step of needsApproval) {
             step.status = "awaiting-approval";
+            const t = new Date().toISOString();
             step.events.push({
-              t: new Date().toISOString(),
+              t,
               type: "info",
               // ask: is the same gate carrying a question — the answer
               // arrives as the approval note and rides into the prompt.
+              // An event URL is this step's and this park's alone (30 Oct
+              // 2026): the index and this line's `t` are in its token.
               text: step.ask
                 ? `waiting for an answer: ${step.ask}`
                 : step.waitFor === "event"
-                  ? `waiting for an external event — release it with POST ${eventUrl(tenant, workspace, run.id)}`
+                  ? `waiting for an external event — release it with POST ${eventUrl(tenant, workspace, run.id, { step: run.steps.indexOf(step), at: t })}`
                   : "waiting for approval before running",
             });
           }
@@ -5156,8 +5164,9 @@ function driveRunInner(
         // step of the flow (isSplicedRecord). It gets no delegateJob of its
         // own: depth one.
         const delegateFor = (parent: StepRecord) => async (agent: string, job: string, cancelled: () => boolean): Promise<DelegationResult> => {
-          const dir = path.join(pDir, "agents", agent);
-          if (!fs.existsSync(path.join(dir, "agent.md"))) return { status: "failed", result: `${agent} is not an agent in this workspace` };
+          // One folder under agents/, never a path — as the group check above.
+          const dir = isOneSegment(agent) ? path.join(pDir, "agents", agent) : null;
+          if (!dir || !fs.existsSync(path.join(dir, "agent.md"))) return { status: "failed", result: `${agent} is not an agent in this workspace` };
           // A stable id on both records: an index into run.steps moves when a
           // rescue or a fan-out is spliced in before the child.
           const id = `d_${crypto.randomBytes(5).toString("hex")}`;
@@ -5597,8 +5606,8 @@ function driveRunInner(
         };
         const rescueStep = async (step: StepRecord): Promise<void> => {
           if (!step.onFail) return;
-          const rescuerDir = path.join(pDir, "agents", step.onFail);
-          if (!fs.existsSync(path.join(rescuerDir, "agent.md"))) {
+          const rescuerDir = isOneSegment(step.onFail) ? path.join(pDir, "agents", step.onFail) : null;
+          if (!rescuerDir || !fs.existsSync(path.join(rescuerDir, "agent.md"))) {
             step.events.push({
               t: new Date().toISOString(),
               type: "error",