@foldrun/core 9.0.0 → 9.2.0

package/src/api-tools.ts

@@ -20,7 +20,12 @@ import { createSdkMcpServer, tool, type SdkMcpToolDefinition } from "@anthropic-
 import type { ApiSpec } from "./store.ts";
 import { previewOrKeep, RESULT_KEEP_CHARS, type KeepIn } from "./tool-output.ts";
 import type { OperationSpec } from "./openapi.ts";
-import { resolveSecrets, materializeSecrets } from "./secrets.ts";
+import { resolveSecrets, materializeCurrent } from "./secrets.ts";
+
+/** Whose vault the secrets came from, on a host step: the account (and
+ *  workspace) they are made live in. Null inside a sandbox, where the values
+ *  crossed already resolved and there is no vault. */
+type VaultScope = { tenant: string; workspace?: string } | null;
 
 // Collected whole up to this; the model sees a preview and where the rest is
 // kept (tool-output.ts), not a cut with the rest gone.
@@ -145,6 +150,7 @@ async function performRequest(
   req: Request,
   /** Where a long body is kept, when the agent can read it back (tool-output.ts). */
   keepIn?: KeepIn,
+  scope: VaultScope = null,
 ): Promise<ToolReply> {
   const started = Date.now();
   try {
@@ -153,8 +159,11 @@ async function performRequest(
     // Per call, not per build: an oauth2 secret's recipe becomes a
     // live access token here, so a step that runs for an hour keeps
     // getting fresh tokens (the exchange is cached until near expiry)
-    // — and a recipe can never end up inside a header.
-    const live = await materializeSecrets(env);
+    // — and a recipe can never end up inside a header. On a host, the
+    // vault's recipe as it is now, made live in the account's scope: a
+    // rotating refresh token the runner (or an earlier call) spent is never
+    // sent again (secrets.ts materializeCurrent).
+    const live = await materializeCurrent(env, scope);
     const path = req.path.startsWith("/") ? req.path : `/${req.path}`;
     const url = new URL(api.base + path);
     // Base-URL confinement: a path can't escape the declared host.
@@ -243,6 +252,7 @@ function typedTool(
   bucket: TokenBucket | null,
   log: string[],
   keepIn?: KeepIn,
+  scope: VaultScope = null,
 ) {
   const keys = argKeys(op);
   const shape: Record<string, z.ZodTypeAny> = {};
@@ -292,11 +302,11 @@ function typedTool(
       query,
       headers,
       body: typeof values.body === "string" ? values.body : undefined,
-    }, keepIn);
+    }, keepIn, scope);
   });
 }
 
-function genericTool(api: ApiSpec, env: Record<string, string>, bucket: TokenBucket | null, log: string[], keepIn?: KeepIn) {
+function genericTool(api: ApiSpec, env: Record<string, string>, bucket: TokenBucket | null, log: string[], keepIn?: KeepIn, scope: VaultScope = null) {
   const typed = api.resolvedOperations?.length
     ? ` Prefer the typed ${api.name}_* tools; this one is the escape hatch for operations they do not cover.`
     : "";
@@ -321,7 +331,7 @@ function genericTool(api: ApiSpec, env: Record<string, string>, bucket: TokenBuc
         query: args.query ?? {},
         headers: {},
         body: args.body,
-      }, keepIn),
+      }, keepIn, scope),
   );
 }
 
@@ -351,6 +361,8 @@ export function buildApiTools(
         missing: resolved.missing,
       }
     : resolveSecrets(tenant, neededSecrets, workspace);
+  // Read from the vault here: made live per call in its account's scope.
+  const scope: VaultScope = !resolved && tenant ? { tenant, ...(workspace ? { workspace } : {}) } : null;
   const log: string[] = [];
 
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- the SDK types its own list this way
@@ -393,11 +405,11 @@ export function buildApiTools(
 
     const typedNames: string[] = [];
     for (const op of ops) {
-      tools.push(typedTool(api, op, env, bucket, log, keepIn));
+      tools.push(typedTool(api, op, env, bucket, log, keepIn, scope));
       typedNames.push(typedToolName(api.name, op.id));
       methods[`mcp__foldrun_apis__${typedToolName(api.name, op.id)}`] = String(op.method ?? "").toUpperCase();
     }
-    if (withGeneric) tools.push(genericTool(api, env, bucket, log, keepIn));
+    if (withGeneric) tools.push(genericTool(api, env, bucket, log, keepIn, scope));
 
     const names = [...typedNames, ...(withGeneric ? [`call_${api.name}`] : [])];
     for (const n of names) {

package/src/approvals.ts

@@ -13,7 +13,7 @@
 import crypto from "node:crypto";
 import { readRun, writeRun, readFlow, mayApprove, type FlowInfo, type RunRecord } from "./store.ts";
 import { platform } from "./platform.ts";
-import { approveToken, installKey } from "./webhook.ts";
+import { approveToken, eventToken, installKey } from "./webhook.ts";
 
 export interface ApprovalDecision {
   decision: "approve" | "reject";
@@ -361,6 +361,60 @@ export async function expireStaleGate(
  * key through the dashboard's approve route — and `step` releases one
  * waiting step rather than all of them.
  */
+const EVENT_WAIT_LINE = "waiting for an external event — release it with POST ";
+
+/**
+ * What a presented event token opens on a run (30 Oct 2026): `known` when
+ * it is a real token of this run — one of its parks, or the old per-run
+ * form — and `steps`, the waiting steps it releases now (none: a 409, the
+ * gate it was for is no longer waiting).
+ *
+ * With `step` (the `&step=` every URL printed since carries), the token is
+ * that step's, bound to the moment it parked: the `t` of its "waiting for an
+ * external event" line. It releases that step only while that park is the
+ * step's current one — a released step is no longer waiting, and a step
+ * parked again (a loop) has a new `t` — so a URL handed out for one gate
+ * opens neither a later gate nor a later park.
+ *
+ * Without `step`, the per-run token URLs carried before then. It releases
+ * only a step still waiting under such a URL — its park line has no
+ * `step=` — so a run parked when this shipped can still be released, and
+ * nothing parked since can be released by the old form.
+ */
+export function eventGatesFor(
+  tenant: string,
+  workspace: string,
+  run: RunRecord,
+  presented: string,
+  step: number | null,
+): { known: boolean; steps: number[] } {
+  const none = { known: false, steps: [] as number[] };
+  if (!presented) return none;
+  const same = (want: string) => {
+    const a = Buffer.from(presented), b = Buffer.from(want);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+  };
+  const parks = (i: number) => (run.steps[i]?.events ?? []).filter((e) => e?.text?.startsWith(EVENT_WAIT_LINE));
+  const waiting = (i: number) => {
+    const s = run.steps[i];
+    return !!s && s.status === "awaiting-approval" && s.waitFor === "event";
+  };
+  if (step !== null) {
+    const lines = parks(step);
+    const hit = lines.findIndex((e) => same(eventToken(tenant, workspace, run.id, { step, at: e.t })));
+    if (hit < 0) return none;
+    // Only the step's latest park is open, and only while it waits.
+    return { known: true, steps: hit === lines.length - 1 && waiting(step) ? [step] : [] };
+  }
+  if (!same(eventToken(tenant, workspace, run.id))) return none;
+  const legacy: number[] = [];
+  for (let i = 0; i < run.steps.length; i++) {
+    const last = parks(i).at(-1);
+    if (last && waiting(i) && !/[?&]step=\d/.test(last.text)) legacy.push(i);
+  }
+  return { known: true, steps: legacy };
+}
+
 export async function deliverEvent(
   tenant: string,
   workspace: string,

package/src/browser-pod.ts

@@ -162,6 +162,9 @@ export function classifyCall(tool: string, input: Record<string, unknown> | unde
   // tools: [peers] — reading the roster changes nothing; a message to a
   // colleague is said, and a re-run would say it twice.
   if (server === "foldrun_peers") return name === "peers_list" ? { write: false } : write("a message to a colleague");
+  // remotes: — reading where a request got to changes nothing; a send, a
+  // reply or a cancel acts on an outside agent's system.
+  if (server === "foldrun_a2a") return name === "a2a_status" ? { write: false } : write(`${name.replace(/^a2a_/, "")} to an outside agent`);
   if (server === "foldrun_scripts") {
     if (name !== "web") return write(`script ${name}`);
     const action = String(args.action ?? "").trim().toLowerCase();

package/src/catalog.ts

@@ -155,6 +155,33 @@ export async function loadCatalog(baseUrl: string): Promise<Catalog | null> {
   }
 }
 
+/** How long after an attempt a background refresh of the same gateway is
+ *  not tried again, whether it worked or not. */
+export const CATALOG_RETRY_MS = 5 * 60_000;
+const lastTried = new Map<string, number>();
+
+/**
+ * Refresh a gateway's catalogue behind the caller, at most once per
+ * CATALOG_RETRY_MS per gateway (30 Oct 2026). For the editor's completions and
+ * the flows page, which ask on every request: a stale or missing catalogue
+ * used to start a fresh outbound fetch each time — a 10 s one per keystroke
+ * against an unreachable gateway, nothing remembering that it had just
+ * failed. The attempt is noted before it starts, so callers arriving while
+ * one is in flight do not start another. True when one was started. A run's
+ * own read (loadCatalog) is untouched.
+ */
+export function refreshCatalogSoon(baseUrl: string, load: (baseUrl: string) => Promise<unknown> = loadCatalog, now = Date.now()): boolean {
+  const cached = readCatalog(baseUrl);
+  if (cached && now - Date.parse(cached.fetchedAt) < TTL_MS) return false; // fresh: nothing to fetch
+  const last = lastTried.get(baseUrl);
+  if (last !== undefined && now - last < CATALOG_RETRY_MS) return false;
+  lastTried.delete(baseUrl);
+  lastTried.set(baseUrl, now);
+  if (lastTried.size > 1000) lastTried.delete(lastTried.keys().next().value as string);
+  void load(baseUrl).catch(() => null);
+  return true;
+}
+
 /** A preset reference — settings live in the gateway's dashboard, opaque to
  *  us on purpose. The catalogue offers no opinion on one. */
 export const isPresetRef = (model: string) => model.startsWith("@preset/");

package/src/completions.ts

@@ -394,9 +394,9 @@ export function completionsAt(
     // that field's files and nothing else. `[[search]]` in tools: is how a
     // tool named after a runtime group gets granted; offering the group
     // here would defeat the point of the brackets.
-    const inlineOwner = line.match(/^\s*([a-zA-Z_]+):\s*(?:\[.*)?\[\[[^\]]*$/)?.[1];
+    const inlineOwner = line.match(/^\s*([a-zA-Z_][a-zA-Z0-9_]*):\s*(?:\[.*)?\[\[[^\]]*$/)?.[1];
     const blockOwner = /^\s+-\s*\[\[/.test(line)
-      ? before.slice(0, lineStart).split("\n").reverse().find((l) => /^\s*[a-zA-Z_]+:\s*$/.test(l))?.trim().replace(":", "")
+      ? before.slice(0, lineStart).split("\n").reverse().find((l) => /^\s*[a-zA-Z_][a-zA-Z0-9_]*:\s*$/.test(l))?.trim().replace(":", "")
       : undefined;
     const owner = inlineOwner ?? blockOwner;
     const byField: Record<string, Completion[]> = {
@@ -460,7 +460,7 @@ export function completionsAt(
   //    been chosen yet, one at a time. Fixed combinations were the wrong
   //    model: nobody wants a menu of every permutation, they want to add the
   //    next verb.
-  const inlineList = line.match(/^(\s*)([a-zA-Z_]+):\s*\[([^\]]*)$/);
+  const inlineList = line.match(/^(\s*)([a-zA-Z_][a-zA-Z0-9_]*):\s*\[([^\]]*)$/);
   if (inlineList) {
     const [, , key, inside] = inlineList;
     // The inline and block forms of a list are the same field — `tools: [a, b]`
@@ -505,7 +505,7 @@ export function completionsAt(
   }
 
   // 4. `key: value` — the value side of a known field.
-  const kv = line.match(/^(\s*)([a-zA-Z_]+):\s*(\S*)$/);
+  const kv = line.match(/^(\s*)([a-zA-Z_][a-zA-Z0-9_]*):\s*(\S*)$/);
   if (kv) {
     const [, , key, partial] = kv;
     const from = cursor - partial.length;
@@ -587,7 +587,7 @@ export function completionsAt(
     const partial = listItem[2];
     const from = cursor - partial.length;
     const priorLines = before.slice(0, lineStart).split("\n").reverse();
-    const owner = priorLines.find((l) => /^\s*[a-zA-Z_]+:\s*$/.test(l))?.trim().replace(":", "");
+    const owner = priorLines.find((l) => /^\s*[a-zA-Z_][a-zA-Z0-9_]*:\s*$/.test(l))?.trim().replace(":", "");
     const byOwner: Record<string, Completion[]> = {
       // One list now: built-ins and your own tools are granted the same way.
       // Groups first (they cover most needs), then your own tools — the ones
@@ -629,7 +629,7 @@ export function completionsAt(
     const partial = mapping[2] ?? "";
     const priorLines = before.slice(0, lineStart).split("\n").reverse();
     const owner = priorLines
-      .find((l) => /^\s*[a-zA-Z_]+:\s*$/.test(l))
+      .find((l) => /^\s*[a-zA-Z_][a-zA-Z0-9_]*:\s*$/.test(l))
       ?.trim()
       .replace(":", "");
     const byOwner: Record<string, Completion[]> = {
@@ -666,7 +666,7 @@ export function completionsAt(
   //     kind of file — the block takes nothing else.
   const fmClose = text.indexOf("\n---", text.indexOf("---") + 3);
   const insideFrontmatter = text.startsWith("---") && (fmClose === -1 || cursor <= fmClose);
-  const nested = line.match(/^(\s+)([a-zA-Z_]*)$/);
+  const nested = line.match(/^(\s+)([a-zA-Z_][a-zA-Z0-9_]*|)$/);
   if (insideFrontmatter && nested) {
     const header = before.slice(0, lineStart).split("\n").reverse().find((l) => /^\S/.test(l));
     const job = JOBS.find((j) => new RegExp(`^${j.name}\\s*:\\s*$`).test(header ?? ""));
@@ -699,7 +699,7 @@ export function completionsAt(
   //    this kind of file. This is where you learn the format by writing it.
   const fmEnd = text.indexOf("\n---", text.indexOf("---") + 3);
   const inFrontmatter = text.startsWith("---") && (fmEnd === -1 || cursor <= fmEnd);
-  if (inFrontmatter && /^[a-zA-Z_][a-zA-Z_-]*$|^$/.test(line)) {
+  if (inFrontmatter && /^[a-zA-Z_][a-zA-Z0-9_-]*$|^$/.test(line)) {
     const from = cursor - line.length;
     return { from, query: line, items: filter(fieldsFor(path, kind), line), title: `${kind} fields` };
   }

package/src/cron.ts

@@ -118,3 +118,22 @@ export function cronProblem(expr: unknown): string | null {
     ? `schedule: "${expr}" has ${fields} field${fields === 1 ? "" : "s"}; cron has five — minute hour day-of-month month day-of-week ("0 9 * * MON"), or @hourly, @daily, @weekly, @monthly. As written the flow never fires`
     : `schedule: "${expr}" is not a cron the scheduler can read — a field is out of range or not a number (minute 0-59, hour 0-23, day 1-31, month 1-12, weekday 0-7 or sun-sat). As written the flow never fires`;
 }
+
+/** Days in each month, February at its leap-year 29: a cron naming the 29th
+ *  of February does fire, every fourth year. */
+const MONTH_DAYS = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+
+/**
+ * Whether the calendar has any day this cron names (30 Oct 2026). `0 0 30 2 *`
+ * parses — every field is in range — yet no February has a 30th, so a search
+ * for its next fire walked the whole window every time it was asked (the
+ * schedule page did, 57,600 minutes per flow per request). Answered from the
+ * fields alone: only a day of the month with no weekday beside it can miss,
+ * since with a weekday either may match and every month has every weekday.
+ */
+export function cronCanFire(cron: Cron): boolean {
+  if (!cron.domRestricted || cron.dowRestricted) return true;
+  const firstDay = Math.min(...cron.dom);
+  for (const m of cron.month) if (firstDay <= MONTH_DAYS[m - 1]!) return true;
+  return false;
+}

package/src/frontmatter-fields.ts

@@ -88,6 +88,7 @@ const AGENT: FieldSpec[] = [
   { key: "scripts", type: "list", help: "programs in scripts/, each a tool" },
   { key: "apis", type: "list", help: "an HTTP API as a tool" },
   { key: "mcpServers", type: "object", help: "MCP servers, name → {command | url, args, env, headers}" },
+  { key: "remotes", type: "list", help: "outside A2A agents it may call — [{name, card: the https URL of its agent card, secret?: a vault NAME sent as a bearer token, description?}]" },
   { key: "agents", type: ["list", "string"], help: "colleagues it may consult" },
   { key: "subagents", type: ["list", "string"], help: "colleagues it may delegate to" },
   { key: "sandbox", type: "string", values: ["own", "parent"], help: "when delegated to as a sub-agent: own = its own sandbox, tools, secrets and network; parent (default) = inside the delegating step's" },
@@ -156,7 +157,7 @@ const FLOW: FieldSpec[] = [
   { key: "catchup", type: "string", validated: true, help: "last | none" },
   { key: "on", type: "string", validated: true, help: "trigger: flow — completed | failed | blocked | any" },
   { key: "signature", type: "string", validated: true, help: "github | stripe | slack | hmac" },
-  { key: "signing_secret", type: "string", help: "the secret a webhook's signature is checked with" },
+  { key: "signing_secret", type: "string", help: "the NAME of the vault secret a webhook's signature is checked with — never the value" },
   { key: "after", type: ["string", "list"], help: "trigger: flow — the flow this one follows" },
   { key: "at", type: "string", help: "trigger: once — when" },
   { key: "url", type: "string", help: "trigger: watch — the page watched" },
@@ -174,6 +175,7 @@ const FLOW: FieldSpec[] = [
   { key: "budget", type: ["number", "string"], help: "USD per run" },
   { key: "compute", type: "object", help: "{vcpu, memory, disk} one run's steps may hold together at once — only narrows the workspace's and account's" },
   { key: "live", type: "boolean", help: "true: steps may act for real in a test run" },
+  { key: "a2a", type: "object", help: "serve this flow to outside agents over A2A 1.0 — {publish: true, name?, description?, examples?, public_card?, input?}; changing it needs workspace:manage" },
 ];
 
 const TOOL: FieldSpec[] = [

package/src/frontmatter-schema.ts

@@ -6,9 +6,12 @@ import { FRONTMATTER, JOBS, type FieldType, type SchemaKind } from "./frontmatte
 import { jobFold } from "./matter.ts";
 import { resolveEffort, parseDuration, parseInstant, parseRate, STEP_OPTION_KEYS } from "./store.ts";
 import { budgetProblem } from "./budget.ts";
-import { cronProblem } from "./cron.ts";
+import { cronProblem, parseCron, cronCanFire } from "./cron.ts";
+import { SECRET_NAME } from "./secrets.ts";
 import { modelSecretCollision } from "./model-credential.ts";
 import { resourcesProblem, computeProblem } from "./resources.ts";
+import { remotesProblem } from "./a2a-remotes.ts";
+import { a2aPublishProblem } from "./a2a-publish.ts";
 
 export { FRONTMATTER, schemaKindOf, type FieldSpec, type FieldType, type SchemaKind } from "./frontmatter-fields.ts";
 
@@ -32,6 +35,7 @@ const CHECKS: Partial<Record<SchemaKind, Record<string, (value: unknown) => stri
   "agent": {
     effort: (v) => (resolveEffort(v) ? null : `"${String(v)}" is not an effort — low, medium, high, xhigh or max; the step runs at the model's default`),
     apis: apisProblem,
+    remotes: remotesProblem,
     budget: (v) => budgetProblem(v, ["run"]),
     ask: (v) => askProblem(v),
     resources: resourcesProblem,
@@ -56,6 +60,7 @@ const CHECKS: Partial<Record<SchemaKind, Record<string, (value: unknown) => stri
     pause_when: (v) => (String(v).length <= 60 ? null : "is longer than 60 characters"),
     budget: (v) => budgetProblem(v, ["run"]),
     compute: computeProblem,
+    a2a: a2aPublishProblem,
   },
   "tool": {
     transport: (v) => (["http", "script", "mcp"].includes(String(v).toLowerCase()) ? null : `"${String(v)}" is not a transport — http, script or mcp`),
@@ -70,7 +75,7 @@ const CHECKS: Partial<Record<SchemaKind, Record<string, (value: unknown) => stri
 
 export interface FieldProblem {
   key: string;
-  rule: "config/unknown-field" | "config/wrong-type" | "config/invalid-value" | "config/missing-field" | "config/conflict" | "config/misplaced";
+  rule: "config/unknown-field" | "config/wrong-type" | "config/invalid-value" | "config/missing-field" | "config/conflict" | "config/misplaced" | "config/cron-never-fires" | "secret/signing-secret-value";
   level: "error" | "warn" | "info";
   message: string;
 }
@@ -172,12 +177,47 @@ export function frontmatterProblems(
         : null;
     if (why) out.push({ key, rule: "config/invalid-value", level: "warn", message: `\`${key}:\` ${why.replace(/^\w+: /, "")}` });
   }
+  // A cron every field of which is in range, on a day no month has —
+  // `0 0 30 2 *`. The scheduler's own cronCanFire decides (30 Oct 2026), so
+  // check and the scheduler say the same about it: it never fires.
+  if (kind === "flow" && typeof data.schedule === "string") {
+    const cron = parseCron(data.schedule);
+    if (cron && !cronCanFire(cron)) {
+      out.push({ key: "schedule", rule: "config/cron-never-fires", level: "warn", message: `\`schedule: "${data.schedule}"\` names a day no month it allows has — the flow never fires. Pick a day every named month has, or add a weekday` });
+    }
+  }
+  // A signing secret is the NAME of a vault entry (30 Oct 2026): a flow's
+  // `signing_secret:` and notify's `signing_secret:` are looked up with
+  // getSecret, so a literal value there is a secret written into a
+  // versioned, deployed file — and never matches anything in the vault.
+  // The message never repeats the value.
+  if (kind === "flow" && data.signing_secret !== undefined) {
+    const why = signingSecretProblem(data.signing_secret);
+    if (why) out.push({ key: "signing_secret", rule: "secret/signing-secret-value", level: "warn", message: `\`signing_secret:\` ${why}` });
+  }
+  if (kind === "agents-md" && data.notify && typeof data.notify === "object" && !Array.isArray(data.notify)) {
+    const raw = (data.notify as { signing_secret?: unknown }).signing_secret;
+    const why = raw === undefined ? null : signingSecretProblem(raw);
+    if (why) out.push({ key: "notify", rule: "secret/signing-secret-value", level: "warn", message: `\`notify: signing_secret:\` ${why}` });
+  }
   if (kind === "skill" && !(typeof data.description === "string" && data.description.trim())) {
     out.push({ key: "description", rule: "config/missing-field", level: "warn", message: "no `description:` — a skill without one is never loaded; the model chooses a skill by it" });
   }
   return out;
 }
 
+/** Why a `signing_secret:` value is not a vault secret's name, or null. The
+ *  runtime reads `NAME` and `${NAME}` alike (notify.ts, store.ts). Never
+ *  says what the value is: it may be the secret itself. */
+export function signingSecretProblem(v: unknown): string | null {
+  if (typeof v !== "string") return null; // config/wrong-type says so
+  const name = v.trim().replace(/^\$\{|\}$/g, "");
+  if (!name) return null;
+  return SECRET_NAME.test(name)
+    ? null
+    : "holds something that is not a secret's name (UPPER_SNAKE_CASE, like WEBHOOK_SIGNING_KEY) — it is looked up in the vault by name, so a value written here is never found, and is deployed and versioned in plain text. Put the value in the vault (`foldrun secrets set NAME`), write the name here, and rotate it";
+}
+
 function askProblem(v: unknown): string | null {
   const t = (v as { timeout?: unknown } | null)?.timeout;
   return t === undefined ? null : DURATION(30, 86400, "30s to 24h")(t);

package/src/limits.ts

@@ -5,6 +5,8 @@
 //     web.search: 40      # one action of the web tool
 //     web: 150            # every web action together
 //     crm: 20             # an API, script or MCP tool, by the name it is granted as
+//     a2a: 10             # messages to outside agents (a2a_send and a2a_reply)
+//     a2a.status: 30      # polls of them, apart from the sends
 //     calls: 300          # every tool call in the step, whatever the tool
 //     repeat: 5           # the same call — one tool, the same input — at most this often
 //
@@ -22,6 +24,7 @@
 import crypto from "node:crypto";
 import { WEB_ACTIONS } from "./providers.ts";
 import { DELEGATE_TOOLS } from "./subagents.ts";
+import { A2A_SERVER, A2A_LIMIT_KEY, A2A_LIMIT_ACTIONS } from "./a2a-remotes.ts";
 
 export type Limits = Record<string, number>;
 
@@ -103,8 +106,13 @@ export function readLimits(raw: unknown, where = "limits"): { limits: Limits; pr
     }
     if (k.includes(".")) {
       const [head, action] = k.split(".");
-      if (head !== "web" || !(WEB_ACTIONS as readonly string[]).includes(action)) {
-        problems.push(`${where}: "${k}" is not a key — the dotted keys are web.<action>: ${WEB_ACTIONS.map((a) => `web.${a}`).join(", ")}.`);
+      const web = head === "web" && (WEB_ACTIONS as readonly string[]).includes(action);
+      const a2a = head === A2A_LIMIT_KEY && (A2A_LIMIT_ACTIONS as readonly string[]).includes(action);
+      if (!web && !a2a) {
+        problems.push(
+          `${where}: "${k}" is not a key — the dotted keys are web.<action>: ${WEB_ACTIONS.map((a) => `web.${a}`).join(", ")}, ` +
+            `and ${A2A_LIMIT_ACTIONS.map((a) => `${A2A_LIMIT_KEY}.${a}`).join(", ")}.`,
+        );
         continue;
       }
     }
@@ -166,6 +174,15 @@ export function limitKeysFor(toolName: string, input: Record<string, unknown> |
   if (toolName === "WebSearch") { webAction("search"); return keys; }
   if (toolName === "WebFetch") { webAction("fetch"); return keys; }
   if ((DELEGATE_TOOLS as readonly string[]).includes(toolName)) return keys;
+  // remotes: — a message to an outside agent (a2a_send, a2a_reply) counts
+  // under `a2a`; every tool also under its own `a2a.<action>`, so polling
+  // (`a2a.status`) is capped apart from sending.
+  const a2a = new RegExp(`^mcp__${A2A_SERVER}__a2a_([a-z]+)$`).exec(toolName);
+  if (a2a) {
+    if (a2a[1] === "send" || a2a[1] === "reply") keys.push(A2A_LIMIT_KEY);
+    keys.push(`${A2A_LIMIT_KEY}.${a2a[1]}`);
+    return keys;
+  }
   const owner = owners[toolName];
   const mcp = /^mcp__(.+?)__(.+)$/.exec(toolName);
   const name = owner
@@ -274,7 +291,7 @@ export function limitKeyProblems(
   ctx: { known: Iterable<string>; granted: Iterable<string> },
 ): { level: "error" | "warn"; message: string }[] {
   const out: { level: "error" | "warn"; message: string }[] = [];
-  const builtinKeys = ["read", "write", "code", ...Object.keys(BUILTIN_GROUP), "TodoWrite", "search", "history", "desks", "ask", "web"];
+  const builtinKeys = ["read", "write", "code", ...Object.keys(BUILTIN_GROUP), "TodoWrite", "search", "history", "desks", "ask", "web", A2A_LIMIT_KEY];
   const known = new Set([...builtinKeys, ...ctx.known].map(normKey));
   const granted = new Set([...ctx.granted].flatMap((g) => {
     const n = normKey(g);
@@ -287,10 +304,11 @@ export function limitKeyProblems(
   }).map(normKey));
   for (const key of Object.keys(limits)) {
     if (key === TOTAL_KEY || key === REPEAT_KEY) continue;
-    const base = key.startsWith("web.") ? "web" : key;
+    const base = key.startsWith("web.") ? "web" : key.startsWith(`${A2A_LIMIT_KEY}.`) ? A2A_LIMIT_KEY : key;
     const n = normKey(base);
     if (!known.has(n)) {
       const valid = [TOTAL_KEY, "web", ...WEB_ACTIONS.map((a) => `web.${a}`), ...[...new Set([...ctx.granted].map(String))].filter((g) => g !== "web")];
+      if ([...ctx.granted].map(String).includes(A2A_LIMIT_KEY)) valid.push(...A2A_LIMIT_ACTIONS.map((a) => `${A2A_LIMIT_KEY}.${a}`));
       out.push({ level: "error", message: `limits: ${key} — not a tool this agent could call. The keys: ${[...new Set(valid)].join(", ")}.` });
     } else if (!granted.has(n)) {
       out.push({ level: "warn", message: `limits: ${key} — this agent is not granted ${base}, so the limit never applies` });

package/src/notify.ts

@@ -34,7 +34,7 @@
 import crypto from "node:crypto";
 import { readAgentsMd } from "./runner.ts";
 import { accountDir, workspaceDir, runCost, readFlow, runVerdict, type RunRecord } from "./store.ts";
-import { getSecret, secretSites } from "./secrets.ts";
+import { getSecret, secretSites, signingSecretShown, accountSecretUsableIn } from "./secrets.ts";
 import { siteCovers } from "./network.ts";
 import { publicUrl } from "./webhook.ts";
 import { approveLinkPath, approveLinkTtlMs } from "./approvals.ts";
@@ -63,11 +63,15 @@ export function platformMail(tenant: string): { key: string; from: string } | nu
   return own;
 }
 
-/** The account's own Resend key and sender, or null when it has none. */
-export function accountMail(tenant: string): { key: string; from: string } | null {
-  const own = getSecret(tenant, "RESEND_API_KEY");
+/** The account's own Resend key and sender, or null when it has none.
+ *  With a workspace — mail a workspace's run causes — an account key or
+ *  sender limited to other workspaces is not used (30 Oct 2026); the
+ *  account's own mail (resets, invites) names none and is not limited. */
+export function accountMail(tenant: string, workspace?: string): { key: string; from: string } | null {
+  const usable = (name: string) => !workspace || accountSecretUsableIn(tenant, name, workspace);
+  const own = usable("RESEND_API_KEY") ? getSecret(tenant, "RESEND_API_KEY") : null;
   if (!own) return null;
-  const from = getSecret(tenant, "EMAIL_FROM")?.value?.trim() || "foldrun <onboarding@resend.dev>";
+  const from = (usable("EMAIL_FROM") ? getSecret(tenant, "EMAIL_FROM")?.value?.trim() : "") || "foldrun <onboarding@resend.dev>";
   return { key: own.value, from };
 }
 
@@ -81,8 +85,15 @@ export function accountMail(tenant: string): { key: string; from: string } | nul
  * owner's bin. The platform's key is the fallback for an account that set
  * none, so `notify:` works before anyone has configured mail at all.
  */
-export function notifyMail(tenant: string): { key: string; from: string } | null {
-  return accountMail(tenant) ?? platformMail(tenant);
+export function notifyMail(tenant: string, workspace?: string): { key: string; from: string } | null {
+  if (!workspace) return accountMail(tenant) ?? platformMail(tenant);
+  // A workspace's notification: the account's sender only where it may be
+  // used, else the platform's — never platformMail's fall back to the
+  // account's own key, which would walk around the limit.
+  const own = accountMail(tenant, workspace);
+  if (own) return own;
+  const key = process.env.FOLDRUN_RESEND_API_KEY;
+  return key ? { key, from: platform.setting("FOLDRUN_EMAIL_FROM") || "foldrun <hello@foldrun.io>" } : null;
 }
 
 /** Was the mail sent on the account's own key? Only then is a refusal from
@@ -169,7 +180,7 @@ export function signatureHeaders(
   const secret = getSecret(tenant, config.signingSecret, workspace);
   if (!secret) {
     console.error(
-      `[foldrun] notify: signing_secret names ${config.signingSecret}, which is not in the vault for ${tenant}/${workspace} — sending unsigned`,
+      `[foldrun] notify: signing_secret names ${signingSecretShown(config.signingSecret)}, which is not in the vault for ${tenant}/${workspace} — sending unsigned`,
     );
     return {};
   }
@@ -475,7 +486,7 @@ export async function sendPlainNotificationOutcome(
   };
   try {
     if (config.email) {
-      const mail = notifyMail(tenant);
+      const mail = notifyMail(tenant, workspace);
       if (!mail) return no;
       const r = await sendMail({
         tenant,
@@ -529,7 +540,7 @@ export async function sendTestNotification(
   const detail = `Sent from ${workspace} at ${sent}. If you are reading this, failures and approval gates will reach you here too.`;
 
   if (config.email) {
-    const mail = notifyMail(tenant);
+    const mail = notifyMail(tenant, workspace);
     if (!mail) {
       return {
         ok: false,
@@ -568,7 +579,7 @@ export async function sendTestNotification(
     ? {
         ok: true,
         destination: shown,
-        detail: `${config.signingSecret ? "accepted, signed with " + config.signingSecret : "accepted"} (delivery ${r.deliveryId})`,
+        detail: `${config.signingSecret ? "accepted, signed with " + signingSecretShown(config.signingSecret) : "accepted"} (delivery ${r.deliveryId})`,
       }
     : { ok: false, destination: shown, detail: `${r.statusCode ? `HTTP ${r.statusCode} — ` : ""}${r.detail.replace(/\s+/g, " ").slice(0, 400)}` };
 }
@@ -659,7 +670,7 @@ export async function sendRunNotification(
 
   try {
     if (config.email) {
-      const mail = notifyMail(tenant);
+      const mail = notifyMail(tenant, workspace);
       if (!mail) {
         console.error(`[foldrun] notify: email configured but no mail credential — set RESEND_API_KEY (and EMAIL_FROM) on the account ${tenant}, or FOLDRUN_RESEND_API_KEY on the platform`);
         return false;

package/src/package.ts

@@ -74,8 +74,10 @@ export interface Package {
 /** An error the API layer turns into a status rather than a 500. */
 export class PackageError extends Error {
   readonly status: number;
-  constructor(message: string, status: number) {
-    super(message);
+  /** `cause`: the error underneath a 500, so an HTTP caller can log it and
+   *  answer without it — a Node error names the server's paths (30 Oct 2026). */
+  constructor(message: string, status: number, opts?: { cause?: unknown }) {
+    super(message, opts);
     this.status = status;
   }
 }
@@ -437,7 +439,7 @@ export function applyImport(
         // best effort — the error below is the one to report
       }
     }
-    throw new PackageError(`the import could not be written, and nothing was kept: ${err instanceof Error ? err.message : String(err)}`, 500);
+    throw new PackageError(`the import could not be written, and nothing was kept: ${err instanceof Error ? err.message : String(err)}`, 500, { cause: err });
   }
   for (const c of changes) {
     const abs = path.join(dir, c.path);