@foldrun/core 9.1.0 → 9.2.0

package/dist/src/api-tools.js

@@ -17,7 +17,7 @@ import { EGRESS_ENV, viaEgress } from "./egress.js";
 import { z } from "zod";
 import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
 import { previewOrKeep, RESULT_KEEP_CHARS } from "./tool-output.js";
-import { resolveSecrets, materializeSecrets } from "./secrets.js";
+import { resolveSecrets, materializeCurrent } from "./secrets.js";
 // Collected whole up to this; the model sees a preview and where the rest is
 // kept (tool-output.ts), not a cut with the rest gone.
 const MAX_BODY_CHARS = RESULT_KEEP_CHARS;
@@ -97,7 +97,7 @@ export function typedToolName(apiName, opId) {
  */
 async function performRequest(api, env, bucket, log, req, 
 /** Where a long body is kept, when the agent can read it back (tool-output.ts). */
-keepIn) {
+keepIn, scope = null) {
     const started = Date.now();
     try {
         const waited = bucket ? await bucket.take() : 0;
@@ -105,8 +105,11 @@ keepIn) {
         // Per call, not per build: an oauth2 secret's recipe becomes a
         // live access token here, so a step that runs for an hour keeps
         // getting fresh tokens (the exchange is cached until near expiry)
-        // — and a recipe can never end up inside a header.
-        const live = await materializeSecrets(env);
+        // — and a recipe can never end up inside a header. On a host, the
+        // vault's recipe as it is now, made live in the account's scope: a
+        // rotating refresh token the runner (or an earlier call) spent is never
+        // sent again (secrets.ts materializeCurrent).
+        const live = await materializeCurrent(env, scope);
         const path = req.path.startsWith("/") ? req.path : `/${req.path}`;
         const url = new URL(api.base + path);
         // Base-URL confinement: a path can't escape the declared host.
@@ -183,7 +186,7 @@ function argKeys(op) {
     }
     return out;
 }
-function typedTool(api, op, env, bucket, log, keepIn) {
+function typedTool(api, op, env, bucket, log, keepIn, scope = null) {
     const keys = argKeys(op);
     const shape = {};
     for (const [key, p] of keys)
@@ -235,10 +238,10 @@ function typedTool(api, op, env, bucket, log, keepIn) {
             query,
             headers,
             body: typeof values.body === "string" ? values.body : undefined,
-        }, keepIn);
+        }, keepIn, scope);
     });
 }
-function genericTool(api, env, bucket, log, keepIn) {
+function genericTool(api, env, bucket, log, keepIn, scope = null) {
     const typed = api.resolvedOperations?.length
         ? ` Prefer the typed ${api.name}_* tools; this one is the escape hatch for operations they do not cover.`
         : "";
@@ -258,7 +261,7 @@ function genericTool(api, env, bucket, log, keepIn) {
         query: args.query ?? {},
         headers: {},
         body: args.body,
-    }, keepIn));
+    }, keepIn, scope));
 }
 export function buildApiTools(tenant, apis, workspace, 
 // The runner container passes this: secrets were resolved before the specs
@@ -277,6 +280,8 @@ keepIn) {
             missing: resolved.missing,
         }
         : resolveSecrets(tenant, neededSecrets, workspace);
+    // Read from the vault here: made live per call in its account's scope.
+    const scope = !resolved && tenant ? { tenant, ...(workspace ? { workspace } : {}) } : null;
     const log = [];
     // eslint-disable-next-line @typescript-eslint/no-explicit-any -- the SDK types its own list this way
     const tools = [];
@@ -311,12 +316,12 @@ keepIn) {
         }
         const typedNames = [];
         for (const op of ops) {
-            tools.push(typedTool(api, op, env, bucket, log, keepIn));
+            tools.push(typedTool(api, op, env, bucket, log, keepIn, scope));
             typedNames.push(typedToolName(api.name, op.id));
             methods[`mcp__foldrun_apis__${typedToolName(api.name, op.id)}`] = String(op.method ?? "").toUpperCase();
         }
         if (withGeneric)
-            tools.push(genericTool(api, env, bucket, log, keepIn));
+            tools.push(genericTool(api, env, bucket, log, keepIn, scope));
         const names = [...typedNames, ...(withGeneric ? [`call_${api.name}`] : [])];
         for (const n of names) {
             toolNames.push(`mcp__foldrun_apis__${n}`);

package/dist/src/browser-pod.js

@@ -173,6 +173,10 @@ export function classifyCall(tool, input, ctx = {}) {
     // colleague is said, and a re-run would say it twice.
     if (server === "foldrun_peers")
         return name === "peers_list" ? { write: false } : write("a message to a colleague");
+    // remotes: — reading where a request got to changes nothing; a send, a
+    // reply or a cancel acts on an outside agent's system.
+    if (server === "foldrun_a2a")
+        return name === "a2a_status" ? { write: false } : write(`${name.replace(/^a2a_/, "")} to an outside agent`);
     if (server === "foldrun_scripts") {
         if (name !== "web")
             return write(`script ${name}`);

package/dist/src/completions.js

@@ -331,9 +331,9 @@ export function completionsAt(path, text, cursor, vocab) {
         // that field's files and nothing else. `[[search]]` in tools: is how a
         // tool named after a runtime group gets granted; offering the group
         // here would defeat the point of the brackets.
-        const inlineOwner = line.match(/^\s*([a-zA-Z_]+):\s*(?:\[.*)?\[\[[^\]]*$/)?.[1];
+        const inlineOwner = line.match(/^\s*([a-zA-Z_][a-zA-Z0-9_]*):\s*(?:\[.*)?\[\[[^\]]*$/)?.[1];
         const blockOwner = /^\s+-\s*\[\[/.test(line)
-            ? before.slice(0, lineStart).split("\n").reverse().find((l) => /^\s*[a-zA-Z_]+:\s*$/.test(l))?.trim().replace(":", "")
+            ? before.slice(0, lineStart).split("\n").reverse().find((l) => /^\s*[a-zA-Z_][a-zA-Z0-9_]*:\s*$/.test(l))?.trim().replace(":", "")
             : undefined;
         const owner = inlineOwner ?? blockOwner;
         const byField = {
@@ -391,7 +391,7 @@ export function completionsAt(path, text, cursor, vocab) {
     //    been chosen yet, one at a time. Fixed combinations were the wrong
     //    model: nobody wants a menu of every permutation, they want to add the
     //    next verb.
-    const inlineList = line.match(/^(\s*)([a-zA-Z_]+):\s*\[([^\]]*)$/);
+    const inlineList = line.match(/^(\s*)([a-zA-Z_][a-zA-Z0-9_]*):\s*\[([^\]]*)$/);
     if (inlineList) {
         const [, , key, inside] = inlineList;
         // The inline and block forms of a list are the same field — `tools: [a, b]`
@@ -435,7 +435,7 @@ export function completionsAt(path, text, cursor, vocab) {
         }
     }
     // 4. `key: value` — the value side of a known field.
-    const kv = line.match(/^(\s*)([a-zA-Z_]+):\s*(\S*)$/);
+    const kv = line.match(/^(\s*)([a-zA-Z_][a-zA-Z0-9_]*):\s*(\S*)$/);
     if (kv) {
         const [, , key, partial] = kv;
         const from = cursor - partial.length;
@@ -517,7 +517,7 @@ export function completionsAt(path, text, cursor, vocab) {
         const partial = listItem[2];
         const from = cursor - partial.length;
         const priorLines = before.slice(0, lineStart).split("\n").reverse();
-        const owner = priorLines.find((l) => /^\s*[a-zA-Z_]+:\s*$/.test(l))?.trim().replace(":", "");
+        const owner = priorLines.find((l) => /^\s*[a-zA-Z_][a-zA-Z0-9_]*:\s*$/.test(l))?.trim().replace(":", "");
         const byOwner = {
             // One list now: built-ins and your own tools are granted the same way.
             // Groups first (they cover most needs), then your own tools — the ones
@@ -558,7 +558,7 @@ export function completionsAt(path, text, cursor, vocab) {
         const partial = mapping[2] ?? "";
         const priorLines = before.slice(0, lineStart).split("\n").reverse();
         const owner = priorLines
-            .find((l) => /^\s*[a-zA-Z_]+:\s*$/.test(l))
+            .find((l) => /^\s*[a-zA-Z_][a-zA-Z0-9_]*:\s*$/.test(l))
             ?.trim()
             .replace(":", "");
         const byOwner = {
@@ -593,7 +593,7 @@ export function completionsAt(path, text, cursor, vocab) {
     //     kind of file — the block takes nothing else.
     const fmClose = text.indexOf("\n---", text.indexOf("---") + 3);
     const insideFrontmatter = text.startsWith("---") && (fmClose === -1 || cursor <= fmClose);
-    const nested = line.match(/^(\s+)([a-zA-Z_]*)$/);
+    const nested = line.match(/^(\s+)([a-zA-Z_][a-zA-Z0-9_]*|)$/);
     if (insideFrontmatter && nested) {
         const header = before.slice(0, lineStart).split("\n").reverse().find((l) => /^\S/.test(l));
         const job = JOBS.find((j) => new RegExp(`^${j.name}\\s*:\\s*$`).test(header ?? ""));
@@ -624,7 +624,7 @@ export function completionsAt(path, text, cursor, vocab) {
     //    this kind of file. This is where you learn the format by writing it.
     const fmEnd = text.indexOf("\n---", text.indexOf("---") + 3);
     const inFrontmatter = text.startsWith("---") && (fmEnd === -1 || cursor <= fmEnd);
-    if (inFrontmatter && /^[a-zA-Z_][a-zA-Z_-]*$|^$/.test(line)) {
+    if (inFrontmatter && /^[a-zA-Z_][a-zA-Z0-9_-]*$|^$/.test(line)) {
         const from = cursor - line.length;
         return { from, query: line, items: filter(fieldsFor(path, kind), line), title: `${kind} fields` };
     }

package/dist/src/frontmatter-fields.js

@@ -43,6 +43,7 @@ const AGENT = [
     { key: "scripts", type: "list", help: "programs in scripts/, each a tool" },
     { key: "apis", type: "list", help: "an HTTP API as a tool" },
     { key: "mcpServers", type: "object", help: "MCP servers, name → {command | url, args, env, headers}" },
+    { key: "remotes", type: "list", help: "outside A2A agents it may call — [{name, card: the https URL of its agent card, secret?: a vault NAME sent as a bearer token, description?}]" },
     { key: "agents", type: ["list", "string"], help: "colleagues it may consult" },
     { key: "subagents", type: ["list", "string"], help: "colleagues it may delegate to" },
     { key: "sandbox", type: "string", values: ["own", "parent"], help: "when delegated to as a sub-agent: own = its own sandbox, tools, secrets and network; parent (default) = inside the delegating step's" },
@@ -127,6 +128,7 @@ const FLOW = [
     { key: "budget", type: ["number", "string"], help: "USD per run" },
     { key: "compute", type: "object", help: "{vcpu, memory, disk} one run's steps may hold together at once — only narrows the workspace's and account's" },
     { key: "live", type: "boolean", help: "true: steps may act for real in a test run" },
+    { key: "a2a", type: "object", help: "serve this flow to outside agents over A2A 1.0 — {publish: true, name?, description?, examples?, public_card?, input?}; changing it needs workspace:manage" },
 ];
 const TOOL = [
     { key: "name", type: "string", help: "defaults to the file or folder name" },

package/dist/src/frontmatter-schema.js

@@ -9,6 +9,8 @@ import { cronProblem, parseCron, cronCanFire } from "./cron.js";
 import { SECRET_NAME } from "./secrets.js";
 import { modelSecretCollision } from "./model-credential.js";
 import { resourcesProblem, computeProblem } from "./resources.js";
+import { remotesProblem } from "./a2a-remotes.js";
+import { a2aPublishProblem } from "./a2a-publish.js";
 export { FRONTMATTER, schemaKindOf } from "./frontmatter-fields.js";
 /** A value for a message: a scalar as written, anything else by its shape.
  *  Never String() of a map — its `toString` is whatever the YAML says. */
@@ -31,6 +33,7 @@ const CHECKS = {
     "agent": {
         effort: (v) => (resolveEffort(v) ? null : `"${String(v)}" is not an effort — low, medium, high, xhigh or max; the step runs at the model's default`),
         apis: apisProblem,
+        remotes: remotesProblem,
         budget: (v) => budgetProblem(v, ["run"]),
         ask: (v) => askProblem(v),
         resources: resourcesProblem,
@@ -55,6 +58,7 @@ const CHECKS = {
         pause_when: (v) => (String(v).length <= 60 ? null : "is longer than 60 characters"),
         budget: (v) => budgetProblem(v, ["run"]),
         compute: computeProblem,
+        a2a: a2aPublishProblem,
     },
     "tool": {
         transport: (v) => (["http", "script", "mcp"].includes(String(v).toLowerCase()) ? null : `"${String(v)}" is not a transport — http, script or mcp`),

package/dist/src/limits.js

@@ -5,6 +5,8 @@
 //     web.search: 40      # one action of the web tool
 //     web: 150            # every web action together
 //     crm: 20             # an API, script or MCP tool, by the name it is granted as
+//     a2a: 10             # messages to outside agents (a2a_send and a2a_reply)
+//     a2a.status: 30      # polls of them, apart from the sends
 //     calls: 300          # every tool call in the step, whatever the tool
 //     repeat: 5           # the same call — one tool, the same input — at most this often
 //
@@ -21,6 +23,7 @@
 import crypto from "node:crypto";
 import { WEB_ACTIONS } from "./providers.js";
 import { DELEGATE_TOOLS } from "./subagents.js";
+import { A2A_SERVER, A2A_LIMIT_KEY, A2A_LIMIT_ACTIONS } from "./a2a-remotes.js";
 /** The key that caps every call in the step. */
 export const TOTAL_KEY = "calls";
 /** The key that caps one identical call: a model asking the same tool the
@@ -96,8 +99,11 @@ export function readLimits(raw, where = "limits") {
         }
         if (k.includes(".")) {
             const [head, action] = k.split(".");
-            if (head !== "web" || !WEB_ACTIONS.includes(action)) {
-                problems.push(`${where}: "${k}" is not a key — the dotted keys are web.<action>: ${WEB_ACTIONS.map((a) => `web.${a}`).join(", ")}.`);
+            const web = head === "web" && WEB_ACTIONS.includes(action);
+            const a2a = head === A2A_LIMIT_KEY && A2A_LIMIT_ACTIONS.includes(action);
+            if (!web && !a2a) {
+                problems.push(`${where}: "${k}" is not a key — the dotted keys are web.<action>: ${WEB_ACTIONS.map((a) => `web.${a}`).join(", ")}, ` +
+                    `and ${A2A_LIMIT_ACTIONS.map((a) => `${A2A_LIMIT_KEY}.${a}`).join(", ")}.`);
                 continue;
             }
         }
@@ -166,6 +172,16 @@ export function limitKeysFor(toolName, input, owners = {}) {
     }
     if (DELEGATE_TOOLS.includes(toolName))
         return keys;
+    // remotes: — a message to an outside agent (a2a_send, a2a_reply) counts
+    // under `a2a`; every tool also under its own `a2a.<action>`, so polling
+    // (`a2a.status`) is capped apart from sending.
+    const a2a = new RegExp(`^mcp__${A2A_SERVER}__a2a_([a-z]+)$`).exec(toolName);
+    if (a2a) {
+        if (a2a[1] === "send" || a2a[1] === "reply")
+            keys.push(A2A_LIMIT_KEY);
+        keys.push(`${A2A_LIMIT_KEY}.${a2a[1]}`);
+        return keys;
+    }
     const owner = owners[toolName];
     const mcp = /^mcp__(.+?)__(.+)$/.exec(toolName);
     const name = owner
@@ -263,7 +279,7 @@ export class CallCounter {
  */
 export function limitKeyProblems(limits, ctx) {
     const out = [];
-    const builtinKeys = ["read", "write", "code", ...Object.keys(BUILTIN_GROUP), "TodoWrite", "search", "history", "desks", "ask", "web"];
+    const builtinKeys = ["read", "write", "code", ...Object.keys(BUILTIN_GROUP), "TodoWrite", "search", "history", "desks", "ask", "web", A2A_LIMIT_KEY];
     const known = new Set([...builtinKeys, ...ctx.known].map(normKey));
     const granted = new Set([...ctx.granted].flatMap((g) => {
         const n = normKey(g);
@@ -281,10 +297,12 @@ export function limitKeyProblems(limits, ctx) {
     for (const key of Object.keys(limits)) {
         if (key === TOTAL_KEY || key === REPEAT_KEY)
             continue;
-        const base = key.startsWith("web.") ? "web" : key;
+        const base = key.startsWith("web.") ? "web" : key.startsWith(`${A2A_LIMIT_KEY}.`) ? A2A_LIMIT_KEY : key;
         const n = normKey(base);
         if (!known.has(n)) {
             const valid = [TOTAL_KEY, "web", ...WEB_ACTIONS.map((a) => `web.${a}`), ...[...new Set([...ctx.granted].map(String))].filter((g) => g !== "web")];
+            if ([...ctx.granted].map(String).includes(A2A_LIMIT_KEY))
+                valid.push(...A2A_LIMIT_ACTIONS.map((a) => `${A2A_LIMIT_KEY}.${a}`));
             out.push({ level: "error", message: `limits: ${key} — not a tool this agent could call. The keys: ${[...new Set(valid)].join(", ")}.` });
         }
         else if (!granted.has(n)) {

package/dist/src/run-container.d.ts

@@ -16,6 +16,7 @@ import { type OperatorEvent } from "./operator.ts";
 import type { SearchRoot, RunDigest } from "./context-tools.ts";
 import type { TranslatorSpec } from "./translator.ts";
 import { type BrowserPodOutcome } from "./browser-pod.ts";
+import type { RemoteSpec } from "./a2a-remotes.ts";
 /** What crosses the boundary. Everything in here is values — pre-resolved
  *  secrets in headers, assembled prompt, serializable MCP configs. */
 export interface ContainerStepInput {
@@ -32,6 +33,14 @@ export interface ContainerStepInput {
     /** http/stdio configs only — in-process servers are rebuilt inside. */
     mcpServers: Record<string, McpServerConfig>;
     apis: ApiSpec[];
+    /** `remotes:` — outside A2A agents, each spec's `token` filled host-side
+     *  (`${NAME}` for the egress proxy, or the value with no proxy), and the
+     *  run and step its handles are kept under (a2a-tools.ts). */
+    a2a?: {
+        remotes: RemoteSpec[];
+        runId: string | null;
+        step: number | null;
+    };
     scripts: ScriptSpec[];
     /** The agent's `runtime:` declaration — the driver builds the venv/npm
      *  prefix inside the container, where the network is. Without this,
@@ -339,7 +348,7 @@ export declare function runtimeCacheMount(tenant: string | undefined): {
     target: string;
 } | null;
 /** The runner container's entrypoint, as JS text: written into the image as driver.mjs, so it must be plain JS — a TypeScript cast here broke every step on v2026.10.21.5 (tests/run-container.test.ts checks it). */
-export declare const DRIVER = "// The runner container's entrypoint. Reads one step, executes it with the\n// same core the server uses, speaks JSONL on stdout, exits.\nimport fs from \"node:fs\";\nconst input = JSON.parse(fs.readFileSync(\"/opt/runner/job/input.json\", \"utf8\"));\n// Start-up marks (run-container.ts#STARTUP_PHASES): which phase just ended,\n// on the sandbox's clock. A worker that does not know a mark skips the line.\nconst mark = (name) => process.stdout.write(JSON.stringify({ e: \"mark\", name, at: Date.now() }) + \"\\n\");\nmark(\"driver\");\nlet modelSpoke = false;\nconst emit = (type, text, extra) => {\n  // The model's first text or tool call is where start-up ends and the\n  // step's own work begins \u2014 runtime and tool lines before it are set-up.\n  if (!modelSpoke && (type === \"text\" || type === \"tool\")) { modelSpoke = true; mark(\"model\"); }\n  process.stdout.write(JSON.stringify({ e: \"event\", type, text, ...extra }) + \"\\n\");\n};\n// What this sandbox actually touched, read at the last moment from the\n// kernel's own books: cgroup v2 for CPU busy-time and peak memory,\n// /proc/net/dev for bytes on the wire. Every read is best-effort \u2014 gVisor\n// exposes some of these files and not others depending on version, and a\n// metric we cannot read is null, never guessed. Reservation is what is\n// billed; these exist so the reservation can be right-sized.\nfunction readActuals() {\n  // fs from the module's own import \u2014 the driver is ESM, and a require()\n  // here threw on every call, silently nulling every metric it guarded.\n  const read = (p) => { try { return fs.readFileSync(p, \"utf8\"); } catch { return null; } };\n  // Two cgroup dialects: v2 (cpu.stat, microseconds; memory.peak) on a\n  // plain runtime, v1-style controllers under gVisor (cpuacct.usage,\n  // NANOseconds; memory.max_usage_in_bytes) \u2014 probed on the real cluster,\n  // not assumed. Whichever answers wins; both silent means null.\n  const cpuStat = read(\"/sys/fs/cgroup/cpu.stat\");\n  const usage = cpuStat?.match(/^usage_usec (\\d+)/m);\n  const cpuacctNs = usage ? NaN : Number(read(\"/sys/fs/cgroup/cpuacct/cpuacct.usage\")?.trim());\n  // Time the CPU cap held the sandbox back: v2's throttled_usec in the same\n  // cpu.stat, v1's throttled_time (nanoseconds) under gVisor. Large against\n  // busy time means the step wanted more cores than its class gives.\n  const throttledUs = cpuStat?.match(/^throttled_usec (\\d+)/m);\n  const throttledNs = throttledUs ? null : read(\"/sys/fs/cgroup/cpu/cpu.stat\")?.match(/^throttled_time (\\d+)/m);\n  const peak =\n    read(\"/sys/fs/cgroup/memory.peak\") ??\n    read(\"/sys/fs/cgroup/memory/memory.max_usage_in_bytes\") ??\n    read(\"/sys/fs/cgroup/memory/memory.usage_in_bytes\");\n  let rx = 0, tx = 0, sawNet = false;\n  const net = read(\"/proc/net/dev\");\n  if (net) {\n    for (const line of net.split(\"\\n\").slice(2)) {\n      const m = line.trim().match(/^(\\S+):\\s+(\\d+)(?:\\s+\\d+){7}\\s+(\\d+)/);\n      if (m && m[1] !== \"lo\") { rx += Number(m[2]); tx += Number(m[3]); sawNet = true; }\n    }\n  }\n  return {\n    busyCpuSecs: usage\n      ? Number(usage[1]) / 1e6\n      : Number.isFinite(cpuacctNs) && cpuacctNs > 0\n        ? cpuacctNs / 1e9\n        : null,\n    peakMemBytes: peak ? Number(peak.trim()) || null : null,\n    throttledSecs: throttledUs ? Number(throttledUs[1]) / 1e6 : throttledNs ? Number(throttledNs[1]) / 1e9 : null,\n    rxBytes: sawNet ? rx : null,\n    txBytes: sawNet ? tx : null,\n  };\n}\n\ntry {\n  // Runtime state (venvs, npm prefixes) lands in the agent user's real home\n  // \u2014 writable, inside the container, gone with it.\n  process.env.FOLDRUN_DATA = \"/home/agent/.foldrun\";\n  const { executeStep } = await import(\"@foldrun/core/step-exec\");\n  const { buildApiTools } = await import(\"@foldrun/core/api-tools\");\n  const { buildScriptTools } = await import(\"@foldrun/core/script-tools\");\n  const { buildConsultTools } = await import(\"@foldrun/core/agent-tools\");\n  const { buildSearchTools, buildHistoryTools, buildDeskTools } = await import(\"@foldrun/core/context-tools\");\n  const { httpChannel, buildAskTool, buildPeerTools, inboxReader } = await import(\"@foldrun/core/operator\");\n  const { buildDelegateTools } = await import(\"@foldrun/core/delegate-tools\");\n  const { startTranslator } = await import(\"@foldrun/core/translator\");\n  const { prepareRuntime } = await import(\"@foldrun/core/runtime\");\n  const { materializeFileSecrets } = await import(\"@foldrun/core/secret-files\");\n  const { paidWebActions } = await import(\"@foldrun/core/browser-pod\");\n  mark(\"imports\");\n\n  const agentDir = \"/workspace/\" + input.agentRel;\n  // HOME is where a bare relative path lands when anything resolves one\n  // outside cwd \u2014 and root's /root is outside the workspace, so such a read\n  // was refused by confinement with a path the agent never typed. Its own\n  // directory is both the truthful answer and the safe one.\n  // @file secrets crossed as content; materialise them to 0600 paths inside\n  // the container (a host path from the other side would not exist here).\n  const env = materializeFileSecrets(agentDir, { ...process.env, HOME: agentDir }).env;\n  // Caches go to the sandbox user's own home, not to HOME: the Claude CLI's\n  // logs, fontconfig, Mesa and gstreamer all follow XDG_CACHE_HOME, and under\n  // agents/<name>/.cache they were copied back after every step \u2014 3,855 files\n  // across 179 agent folders on the box by 17 Oct 2026, read by nothing.\n  env.XDG_CACHE_HOME = \"/home/agent/.cache\";\n\n  // The declared runtime, built in here \u2014 pip and npm have the network, which\n  // the host side may not. It lands in .foldrun/runner/.runtimes, which the\n  // executors mount from a per-tenant directory (run-container.ts#RUNTIME_CACHE):\n  // the first step for a given fingerprint installs, every later one finds\n  // .ready and skips. With no mount it still works, just fresh every time \u2014\n  // which is what this used to be unconditionally. The log says which happened.\n  const runtime = input.runtime\n    ? prepareRuntime(\"runner\", input.runtime)\n    : { interpreters: {}, env: {}, log: [], error: null };\n  for (const line of runtime.log) emit(\"info\", \"runtime: \" + line);\n  if (runtime.error) emit(\"error\", \"runtime: \" + runtime.error);\n  // The step's own environment gets it too, not only the script tools: an\n  // agent that runs \"python3 x.py\" or a shebang script through Bash should\n  // meet the packages its runtime declared, not the image's bare python.\n  Object.assign(env, runtime.env);\n\n  // install: what the agent finds it needs mid-step. apt goes through the\n  // root start-up's helper (install-helper.ts); pip and npm land in a\n  // directory of this container's own, on the paths from the first turn.\n  const { buildInstallTool, INSTALL_TOOL } = await import(\"@foldrun/core/install-tool\");\n  const { stepInstallEnv, INSTALL_SOCKET } = await import(\"@foldrun/core/runtime\");\n  const installDir = \"/home/agent/.foldrun/step\";\n  const installing = (input.allowed ?? []).includes(INSTALL_TOOL);\n  if (installing) Object.assign(env, stepInstallEnv(installDir, env));\n  const install = installing\n    ? buildInstallTool({\n        dir: installDir,\n        socket: env.FOLDRUN_INSTALL_SOCKET || INSTALL_SOCKET,\n        cacheRoot: \"/home/agent/.foldrun/runner/.runtimes\",\n        python: env.VIRTUAL_ENV ? env.VIRTUAL_ENV + \"/bin/python\" : \"python3\",\n        env,\n        emit,\n      })\n    : { server: null };\n\n  // API and script tools, rebuilt in here from their specs. Secrets were\n  // substituted into API headers before the input crossed the boundary, so\n  // buildApiTools gets an already-resolved environment. verify: gets the\n  // container's own environment, whole: it is the boundary, assembled on\n  // the host from an allowlist, and the declared secrets are in it.\n  // A long result is kept in a file only when the agent can read it back.\n  // (tool-output.ts canReadBack, inlined: the driver imports core by subpath.)\n  const keepIn = { dir: agentDir, readable: () => (input.allowed ?? []).some((t) => t === \"Read\" || t === \"Grep\") };\n  // A declared secret named like a model variable crosses as\n  // FOLDRUN_DECLARED_<NAME> (runner.ts, FOL-19): the model keeps its own\n  // settings, and the agent's API and script tools and verify: get the value\n  // back under the name it declared. Built here, after the runtime and any\n  // mid-step install have added their paths to env.\n  const toolEnv = { ...env };\n  for (const [k, v] of Object.entries(env)) if (k.startsWith(\"FOLDRUN_DECLARED_\")) toolEnv[k.slice(\"FOLDRUN_DECLARED_\".length)] = v;\n  const api = buildApiTools(\"\", input.apis, undefined, { env: toolEnv, missing: [] }, keepIn);\n  const script = buildScriptTools(\n    agentDir,\n    input.scripts,\n    toolEnv,\n    \"/library/scripts\",\n    runtime.interpreters,\n    null,\n    keepIn.readable,\n  );\n  // The translator, when the provider speaks Chat Completions: a loopback\n  // server for the length of this step. Its env replaces the endpoint the\n  // host assembled; the provider's real URL and key stay inside it.\n  const translator = input.translator ? await startTranslator(input.translator) : null;\n  if (translator) {\n    Object.assign(env, translator.env);\n    emit(\"info\", \"translator: listening on \" + translator.baseUrl + \" for \" + (input.translator.label ?? input.translator.upstreamBase));\n  }\n  const consult = buildConsultTools(input.consults ?? [], env, emit);\n  // The platform's own two groups, rebuilt from values like everything else.\n  const search = buildSearchTools(input.search ?? []);\n  const history = input.history?.length ? buildHistoryTools(input.history) : { server: null };\n  const desks = input.desks?.length ? buildDeskTools(input.desks) : { server: null };\n  // A person in the loop, over the proxy this step's lease already names:\n  // ask_person when tools: [ask], and the run's inbox after every tool call.\n  const channel = httpChannel(env.FOLDRUN_EGRESS);\n  const ask = input.ask ? buildAskTool({ channel, timeoutSec: input.ask.timeoutSec, emit }) : { server: null };\n  const peers = input.peers ? buildPeerTools({ channel, self: input.peers.self, siblings: input.peers.siblings, emit }) : { server: null };\n  const inbox = channel ? inboxReader(channel, emit) : undefined;\n  // sandbox: own sub-agents: a tool each, whose job runs in its own sandbox\n  // on the worker, reached over the same proxy door.\n  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec, workspaceRoot: \"/workspace\" }) : { server: null };\n\n  // Keyless cloud identities (FOLDRUN_IDENTITIES): each token file kept\n  // fresh through the proxy's /identity door, which mints only what this\n  // step's lease was granted. Fetched before the step starts, renewed five\n  // minutes before it expires (with jitter); a failure is said and retried.\n  // Plain JS: this text is the driver, not TypeScript.\n  const identityNames = (env.FOLDRUN_IDENTITIES || \"\").split(\",\").filter(Boolean);\n  if (identityNames.length) {\n    // No backslashes: this sits inside a template literal, which eats them.\n    const ep = new RegExp(\"^(https?://[^/]+)/e/([A-Za-z0-9_-]{16,})/?$\").exec(env.FOLDRUN_EGRESS || \"\");\n    const dir = env.FOLDRUN_IDENTITY_DIR || \"/tmp/foldrun-identity\";\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    const keepFresh = async (name) => {\n      let wait = 30000;\n      try {\n        if (!ep) throw new Error(\"no egress proxy to ask\");\n        const res = await fetch(ep[1] + \"/identity/\" + ep[2] + \"/\" + name, { signal: AbortSignal.timeout(15000) });\n        const body = await res.json().catch(() => ({}));\n        if (!res.ok || !body.token) throw new Error((body.error && body.error.message) || (\"proxy answered \" + res.status));\n        const file = dir + \"/\" + name.toLowerCase() + \".jwt\";\n        fs.writeFileSync(file + \".tmp\", body.token, { mode: 0o600 });\n        fs.renameSync(file + \".tmp\", file);\n        wait = Math.max(30000, body.expiresAt - Date.now() - 300000 + Math.floor(Math.random() * 60000) - 30000);\n      } catch (err) {\n        emit(\"error\", \"identity \" + name + \": \" + (err && err.message ? err.message : String(err)) + \" \u2014 trying again in 30s\");\n      }\n      setTimeout(() => { void keepFresh(name); }, wait).unref();\n    };\n    await Promise.all(identityNames.map(keepFresh));\n  }\n\n  mark(\"tools\");\n  const outcome = await executeStep({\n    agentDir,\n    workspaceRoot: \"/workspace\",\n    libraryRoot: \"/library\",\n    configWrites: input.configWrites === true,\n    prompt: input.prompt,\n    model: input.model,\n    effort: input.effort ?? null,\n    systemPrompt: input.systemPrompt,\n    allowed: input.allowed,\n    mcpNames: input.mcpNames,\n    mcpServers: {\n      ...(api.server ? { foldrun_apis: api.server } : {}),\n      ...(script.server ? { foldrun_scripts: script.server } : {}),\n      ...(consult.server ? { foldrun_agents: consult.server } : {}),\n      ...(search.server ? { foldrun_search: search.server } : {}),\n      ...(history.server ? { foldrun_history: history.server } : {}),\n      ...(desks.server ? { foldrun_desks: desks.server } : {}),\n      ...(ask.server ? { foldrun_ask: ask.server } : {}),\n      ...(peers.server ? { foldrun_peers: peers.server } : {}),\n      ...(delegate.server ? { foldrun_delegate: delegate.server } : {}),\n      ...(install.server ? { foldrun_install: install.server } : {}),\n      ...input.mcpServers,\n    },\n    ...(inbox ? { inbox } : {}),\n    ...(input.subagents?.length ? { subagents: input.subagents } : {}),\n    env,\n    timeoutSec: input.timeoutSec,\n    budgetUsd: input.budgetUsd,\n    budgetNote: input.budgetNote,\n    price: input.price,\n    verify: input.verify,\n    verifyEnv: toolEnv,\n    ...(typeof input.judgeModel === \"string\" ? { judgeModel: input.judgeModel } : {}),\n    ...(typeof input.judgeEffort === \"string\" ? { judgeEffort: input.judgeEffort } : {}),\n    output: input.output,\n    schema: input.schema,\n    maxTurns: input.maxTurns,\n    ...(input.capture === \"metadata\" || input.capture === \"full\" ? { capture: input.capture } : {}),\n    ...(input.limits && Object.keys(input.limits).length ? { limits: input.limits, toolOwners: input.toolOwners ?? {} } : {}),\n    ...(input.hookNames?.length ? { hookNames: input.hookNames, hookBase: input.hookBase ?? {} } : {}),\n    // Slim browsing: the platform put this step on the slim image to browse\n    // through the account's pod, and named the file the web tool logs its\n    // reconnects to. A lost pod stops the step; what it wrote decides what\n    // the runner does next (browser-pod.ts).\n    ...(env.FOLDRUN_BROWSER_POD_EVENTS ? { browserPod: { events: env.FOLDRUN_BROWSER_POD_EVENTS, methods: api.methods ?? {}, paidWeb: paidWebActions(env), ...(env.FOLDRUN_BROWSER_INIT ? { browseInit: env.FOLDRUN_BROWSER_INIT } : {}) } } : {}),\n    // The container is the boundary; the SDK's own bash sandbox here would\n    // only block declared network use (SSH, curl) for no added safety.\n    sandboxBash: false,\n    emit,\n  });\n  for (const line of api.drainLog()) emit(\"info\", \"api: \" + line);\n  for (const line of script.drainLog()) emit(\"info\", \"script: \" + line);\n  if (translator) {\n    for (const line of translator.drainLog()) emit(\"info\", line.startsWith(\"translator\") ? line : \"translator: \" + line);\n    await translator.close();\n  }\n  // A consult's spend belongs to the step that asked.\n  const consultCost = consult.drainCost();\n  if (consultCost > 0) outcome.costUsd = (outcome.costUsd ?? 0) + consultCost;\n  if (consultCost > 0 && typeof outcome.turnsCostUsd === \"number\") outcome.turnsCostUsd += consultCost;\n  process.stdout.write(JSON.stringify({ e: \"done\", ...outcome, res: readActuals() }) + \"\\n\");\n  process.exit(0);\n} catch (err) {\n  emit(\"error\", err instanceof Error ? err.message : String(err));\n  // The failure path reports actuals too \u2014 a step that died eleven minutes\n  // in still held its slice for eleven minutes, and the failed runs are\n  // exactly the ones whose resource story gets read.\n  let res = null;\n  try { res = readActuals(); } catch { /* the reading must never mask the error */ }\n  process.stdout.write(JSON.stringify({ e: \"done\", status: \"failed\", result: null, costUsd: null, res }) + \"\\n\");\n  process.exit(0);\n}\n";
+export declare const DRIVER = "// The runner container's entrypoint. Reads one step, executes it with the\n// same core the server uses, speaks JSONL on stdout, exits.\nimport fs from \"node:fs\";\nconst input = JSON.parse(fs.readFileSync(\"/opt/runner/job/input.json\", \"utf8\"));\n// Start-up marks (run-container.ts#STARTUP_PHASES): which phase just ended,\n// on the sandbox's clock. A worker that does not know a mark skips the line.\nconst mark = (name) => process.stdout.write(JSON.stringify({ e: \"mark\", name, at: Date.now() }) + \"\\n\");\nmark(\"driver\");\nlet modelSpoke = false;\nconst emit = (type, text, extra) => {\n  // The model's first text or tool call is where start-up ends and the\n  // step's own work begins \u2014 runtime and tool lines before it are set-up.\n  if (!modelSpoke && (type === \"text\" || type === \"tool\")) { modelSpoke = true; mark(\"model\"); }\n  process.stdout.write(JSON.stringify({ e: \"event\", type, text, ...extra }) + \"\\n\");\n};\n// What this sandbox actually touched, read at the last moment from the\n// kernel's own books: cgroup v2 for CPU busy-time and peak memory,\n// /proc/net/dev for bytes on the wire. Every read is best-effort \u2014 gVisor\n// exposes some of these files and not others depending on version, and a\n// metric we cannot read is null, never guessed. Reservation is what is\n// billed; these exist so the reservation can be right-sized.\nfunction readActuals() {\n  // fs from the module's own import \u2014 the driver is ESM, and a require()\n  // here threw on every call, silently nulling every metric it guarded.\n  const read = (p) => { try { return fs.readFileSync(p, \"utf8\"); } catch { return null; } };\n  // Two cgroup dialects: v2 (cpu.stat, microseconds; memory.peak) on a\n  // plain runtime, v1-style controllers under gVisor (cpuacct.usage,\n  // NANOseconds; memory.max_usage_in_bytes) \u2014 probed on the real cluster,\n  // not assumed. Whichever answers wins; both silent means null.\n  const cpuStat = read(\"/sys/fs/cgroup/cpu.stat\");\n  const usage = cpuStat?.match(/^usage_usec (\\d+)/m);\n  const cpuacctNs = usage ? NaN : Number(read(\"/sys/fs/cgroup/cpuacct/cpuacct.usage\")?.trim());\n  // Time the CPU cap held the sandbox back: v2's throttled_usec in the same\n  // cpu.stat, v1's throttled_time (nanoseconds) under gVisor. Large against\n  // busy time means the step wanted more cores than its class gives.\n  const throttledUs = cpuStat?.match(/^throttled_usec (\\d+)/m);\n  const throttledNs = throttledUs ? null : read(\"/sys/fs/cgroup/cpu/cpu.stat\")?.match(/^throttled_time (\\d+)/m);\n  const peak =\n    read(\"/sys/fs/cgroup/memory.peak\") ??\n    read(\"/sys/fs/cgroup/memory/memory.max_usage_in_bytes\") ??\n    read(\"/sys/fs/cgroup/memory/memory.usage_in_bytes\");\n  let rx = 0, tx = 0, sawNet = false;\n  const net = read(\"/proc/net/dev\");\n  if (net) {\n    for (const line of net.split(\"\\n\").slice(2)) {\n      const m = line.trim().match(/^(\\S+):\\s+(\\d+)(?:\\s+\\d+){7}\\s+(\\d+)/);\n      if (m && m[1] !== \"lo\") { rx += Number(m[2]); tx += Number(m[3]); sawNet = true; }\n    }\n  }\n  return {\n    busyCpuSecs: usage\n      ? Number(usage[1]) / 1e6\n      : Number.isFinite(cpuacctNs) && cpuacctNs > 0\n        ? cpuacctNs / 1e9\n        : null,\n    peakMemBytes: peak ? Number(peak.trim()) || null : null,\n    throttledSecs: throttledUs ? Number(throttledUs[1]) / 1e6 : throttledNs ? Number(throttledNs[1]) / 1e9 : null,\n    rxBytes: sawNet ? rx : null,\n    txBytes: sawNet ? tx : null,\n  };\n}\n\ntry {\n  // Runtime state (venvs, npm prefixes) lands in the agent user's real home\n  // \u2014 writable, inside the container, gone with it.\n  process.env.FOLDRUN_DATA = \"/home/agent/.foldrun\";\n  const { executeStep } = await import(\"@foldrun/core/step-exec\");\n  const { buildApiTools } = await import(\"@foldrun/core/api-tools\");\n  const { buildA2ATools } = await import(\"@foldrun/core/a2a-tools\");\n  const { buildScriptTools } = await import(\"@foldrun/core/script-tools\");\n  const { buildConsultTools } = await import(\"@foldrun/core/agent-tools\");\n  const { buildSearchTools, buildHistoryTools, buildDeskTools } = await import(\"@foldrun/core/context-tools\");\n  const { httpChannel, buildAskTool, buildPeerTools, inboxReader } = await import(\"@foldrun/core/operator\");\n  const { buildDelegateTools } = await import(\"@foldrun/core/delegate-tools\");\n  const { startTranslator } = await import(\"@foldrun/core/translator\");\n  const { prepareRuntime } = await import(\"@foldrun/core/runtime\");\n  const { materializeFileSecrets } = await import(\"@foldrun/core/secret-files\");\n  const { paidWebActions } = await import(\"@foldrun/core/browser-pod\");\n  mark(\"imports\");\n\n  const agentDir = \"/workspace/\" + input.agentRel;\n  // HOME is where a bare relative path lands when anything resolves one\n  // outside cwd \u2014 and root's /root is outside the workspace, so such a read\n  // was refused by confinement with a path the agent never typed. Its own\n  // directory is both the truthful answer and the safe one.\n  // @file secrets crossed as content; materialise them to 0600 paths inside\n  // the container (a host path from the other side would not exist here).\n  const env = materializeFileSecrets(agentDir, { ...process.env, HOME: agentDir }).env;\n  // Caches go to the sandbox user's own home, not to HOME: the Claude CLI's\n  // logs, fontconfig, Mesa and gstreamer all follow XDG_CACHE_HOME, and under\n  // agents/<name>/.cache they were copied back after every step \u2014 3,855 files\n  // across 179 agent folders on the box by 17 Oct 2026, read by nothing.\n  env.XDG_CACHE_HOME = \"/home/agent/.cache\";\n\n  // The declared runtime, built in here \u2014 pip and npm have the network, which\n  // the host side may not. It lands in .foldrun/runner/.runtimes, which the\n  // executors mount from a per-tenant directory (run-container.ts#RUNTIME_CACHE):\n  // the first step for a given fingerprint installs, every later one finds\n  // .ready and skips. With no mount it still works, just fresh every time \u2014\n  // which is what this used to be unconditionally. The log says which happened.\n  const runtime = input.runtime\n    ? prepareRuntime(\"runner\", input.runtime)\n    : { interpreters: {}, env: {}, log: [], error: null };\n  for (const line of runtime.log) emit(\"info\", \"runtime: \" + line);\n  if (runtime.error) emit(\"error\", \"runtime: \" + runtime.error);\n  // The step's own environment gets it too, not only the script tools: an\n  // agent that runs \"python3 x.py\" or a shebang script through Bash should\n  // meet the packages its runtime declared, not the image's bare python.\n  Object.assign(env, runtime.env);\n\n  // install: what the agent finds it needs mid-step. apt goes through the\n  // root start-up's helper (install-helper.ts); pip and npm land in a\n  // directory of this container's own, on the paths from the first turn.\n  const { buildInstallTool, INSTALL_TOOL } = await import(\"@foldrun/core/install-tool\");\n  const { stepInstallEnv, INSTALL_SOCKET } = await import(\"@foldrun/core/runtime\");\n  const installDir = \"/home/agent/.foldrun/step\";\n  const installing = (input.allowed ?? []).includes(INSTALL_TOOL);\n  if (installing) Object.assign(env, stepInstallEnv(installDir, env));\n  const install = installing\n    ? buildInstallTool({\n        dir: installDir,\n        socket: env.FOLDRUN_INSTALL_SOCKET || INSTALL_SOCKET,\n        cacheRoot: \"/home/agent/.foldrun/runner/.runtimes\",\n        python: env.VIRTUAL_ENV ? env.VIRTUAL_ENV + \"/bin/python\" : \"python3\",\n        env,\n        emit,\n      })\n    : { server: null };\n\n  // API and script tools, rebuilt in here from their specs. Secrets were\n  // substituted into API headers before the input crossed the boundary, so\n  // buildApiTools gets an already-resolved environment. verify: gets the\n  // container's own environment, whole: it is the boundary, assembled on\n  // the host from an allowlist, and the declared secrets are in it.\n  // A long result is kept in a file only when the agent can read it back.\n  // (tool-output.ts canReadBack, inlined: the driver imports core by subpath.)\n  const keepIn = { dir: agentDir, readable: () => (input.allowed ?? []).some((t) => t === \"Read\" || t === \"Grep\") };\n  // A declared secret named like a model variable crosses as\n  // FOLDRUN_DECLARED_<NAME> (runner.ts, FOL-19): the model keeps its own\n  // settings, and the agent's API and script tools and verify: get the value\n  // back under the name it declared. Built here, after the runtime and any\n  // mid-step install have added their paths to env.\n  const toolEnv = { ...env };\n  for (const [k, v] of Object.entries(env)) if (k.startsWith(\"FOLDRUN_DECLARED_\")) toolEnv[k.slice(\"FOLDRUN_DECLARED_\".length)] = v;\n  const api = buildApiTools(\"\", input.apis, undefined, { env: toolEnv, missing: [] }, keepIn);\n  // remotes: \u2014 the four a2a tools, rebuilt from values. Each token crossed in\n  // its spec (a placeholder the proxy fills for the card's origin alone), so\n  // nothing here asks a vault; handles go under the workspace's state/.\n  const a2a = input.a2a && Array.isArray(input.a2a.remotes) && input.a2a.remotes.length\n    ? buildA2ATools(\"\", input.a2a.remotes, undefined, { env: {}, missing: [] }, {\n        stateDir: \"/workspace/state/a2a/\" + input.agentRel.split(\"/\").pop(),\n        runId: input.a2a.runId,\n        step: input.a2a.step,\n        egress: env.FOLDRUN_EGRESS || null,\n        test: env.FOLDRUN_TEST_MODE === \"1\",\n        keepIn,\n        emit,\n      })\n    : { server: null, drainLog: () => [] };\n  const script = buildScriptTools(\n    agentDir,\n    input.scripts,\n    toolEnv,\n    \"/library/scripts\",\n    runtime.interpreters,\n    null,\n    keepIn.readable,\n  );\n  // The translator, when the provider speaks Chat Completions: a loopback\n  // server for the length of this step. Its env replaces the endpoint the\n  // host assembled; the provider's real URL and key stay inside it.\n  const translator = input.translator ? await startTranslator(input.translator) : null;\n  if (translator) {\n    Object.assign(env, translator.env);\n    emit(\"info\", \"translator: listening on \" + translator.baseUrl + \" for \" + (input.translator.label ?? input.translator.upstreamBase));\n  }\n  const consult = buildConsultTools(input.consults ?? [], env, emit);\n  // The platform's own two groups, rebuilt from values like everything else.\n  const search = buildSearchTools(input.search ?? []);\n  const history = input.history?.length ? buildHistoryTools(input.history) : { server: null };\n  const desks = input.desks?.length ? buildDeskTools(input.desks) : { server: null };\n  // A person in the loop, over the proxy this step's lease already names:\n  // ask_person when tools: [ask], and the run's inbox after every tool call.\n  const channel = httpChannel(env.FOLDRUN_EGRESS);\n  const ask = input.ask ? buildAskTool({ channel, timeoutSec: input.ask.timeoutSec, emit }) : { server: null };\n  const peers = input.peers ? buildPeerTools({ channel, self: input.peers.self, siblings: input.peers.siblings, emit }) : { server: null };\n  const inbox = channel ? inboxReader(channel, emit) : undefined;\n  // sandbox: own sub-agents: a tool each, whose job runs in its own sandbox\n  // on the worker, reached over the same proxy door.\n  const delegate = input.delegates?.length ? buildDelegateTools({ specs: input.delegates, channel, emit, timeoutSec: input.timeoutSec, workspaceRoot: \"/workspace\" }) : { server: null };\n\n  // Keyless cloud identities (FOLDRUN_IDENTITIES): each token file kept\n  // fresh through the proxy's /identity door, which mints only what this\n  // step's lease was granted. Fetched before the step starts, renewed five\n  // minutes before it expires (with jitter); a failure is said and retried.\n  // Plain JS: this text is the driver, not TypeScript.\n  const identityNames = (env.FOLDRUN_IDENTITIES || \"\").split(\",\").filter(Boolean);\n  if (identityNames.length) {\n    // No backslashes: this sits inside a template literal, which eats them.\n    const ep = new RegExp(\"^(https?://[^/]+)/e/([A-Za-z0-9_-]{16,})/?$\").exec(env.FOLDRUN_EGRESS || \"\");\n    const dir = env.FOLDRUN_IDENTITY_DIR || \"/tmp/foldrun-identity\";\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    const keepFresh = async (name) => {\n      let wait = 30000;\n      try {\n        if (!ep) throw new Error(\"no egress proxy to ask\");\n        const res = await fetch(ep[1] + \"/identity/\" + ep[2] + \"/\" + name, { signal: AbortSignal.timeout(15000) });\n        const body = await res.json().catch(() => ({}));\n        if (!res.ok || !body.token) throw new Error((body.error && body.error.message) || (\"proxy answered \" + res.status));\n        const file = dir + \"/\" + name.toLowerCase() + \".jwt\";\n        fs.writeFileSync(file + \".tmp\", body.token, { mode: 0o600 });\n        fs.renameSync(file + \".tmp\", file);\n        wait = Math.max(30000, body.expiresAt - Date.now() - 300000 + Math.floor(Math.random() * 60000) - 30000);\n      } catch (err) {\n        emit(\"error\", \"identity \" + name + \": \" + (err && err.message ? err.message : String(err)) + \" \u2014 trying again in 30s\");\n      }\n      setTimeout(() => { void keepFresh(name); }, wait).unref();\n    };\n    await Promise.all(identityNames.map(keepFresh));\n  }\n\n  mark(\"tools\");\n  const outcome = await executeStep({\n    agentDir,\n    workspaceRoot: \"/workspace\",\n    libraryRoot: \"/library\",\n    configWrites: input.configWrites === true,\n    prompt: input.prompt,\n    model: input.model,\n    effort: input.effort ?? null,\n    systemPrompt: input.systemPrompt,\n    allowed: input.allowed,\n    mcpNames: input.mcpNames,\n    mcpServers: {\n      ...(api.server ? { foldrun_apis: api.server } : {}),\n      ...(a2a.server ? { foldrun_a2a: a2a.server } : {}),\n      ...(script.server ? { foldrun_scripts: script.server } : {}),\n      ...(consult.server ? { foldrun_agents: consult.server } : {}),\n      ...(search.server ? { foldrun_search: search.server } : {}),\n      ...(history.server ? { foldrun_history: history.server } : {}),\n      ...(desks.server ? { foldrun_desks: desks.server } : {}),\n      ...(ask.server ? { foldrun_ask: ask.server } : {}),\n      ...(peers.server ? { foldrun_peers: peers.server } : {}),\n      ...(delegate.server ? { foldrun_delegate: delegate.server } : {}),\n      ...(install.server ? { foldrun_install: install.server } : {}),\n      ...input.mcpServers,\n    },\n    ...(inbox ? { inbox } : {}),\n    ...(input.subagents?.length ? { subagents: input.subagents } : {}),\n    env,\n    timeoutSec: input.timeoutSec,\n    budgetUsd: input.budgetUsd,\n    budgetNote: input.budgetNote,\n    price: input.price,\n    verify: input.verify,\n    verifyEnv: toolEnv,\n    ...(typeof input.judgeModel === \"string\" ? { judgeModel: input.judgeModel } : {}),\n    ...(typeof input.judgeEffort === \"string\" ? { judgeEffort: input.judgeEffort } : {}),\n    output: input.output,\n    schema: input.schema,\n    maxTurns: input.maxTurns,\n    ...(input.capture === \"metadata\" || input.capture === \"full\" ? { capture: input.capture } : {}),\n    ...(input.limits && Object.keys(input.limits).length ? { limits: input.limits, toolOwners: input.toolOwners ?? {} } : {}),\n    ...(input.hookNames?.length ? { hookNames: input.hookNames, hookBase: input.hookBase ?? {} } : {}),\n    // Slim browsing: the platform put this step on the slim image to browse\n    // through the account's pod, and named the file the web tool logs its\n    // reconnects to. A lost pod stops the step; what it wrote decides what\n    // the runner does next (browser-pod.ts).\n    ...(env.FOLDRUN_BROWSER_POD_EVENTS ? { browserPod: { events: env.FOLDRUN_BROWSER_POD_EVENTS, methods: api.methods ?? {}, paidWeb: paidWebActions(env), ...(env.FOLDRUN_BROWSER_INIT ? { browseInit: env.FOLDRUN_BROWSER_INIT } : {}) } } : {}),\n    // The container is the boundary; the SDK's own bash sandbox here would\n    // only block declared network use (SSH, curl) for no added safety.\n    sandboxBash: false,\n    emit,\n  });\n  for (const line of api.drainLog()) emit(\"info\", \"api: \" + line);\n  for (const line of a2a.drainLog()) emit(\"info\", \"a2a: \" + line);\n  for (const line of script.drainLog()) emit(\"info\", \"script: \" + line);\n  if (translator) {\n    for (const line of translator.drainLog()) emit(\"info\", line.startsWith(\"translator\") ? line : \"translator: \" + line);\n    await translator.close();\n  }\n  // A consult's spend belongs to the step that asked.\n  const consultCost = consult.drainCost();\n  if (consultCost > 0) outcome.costUsd = (outcome.costUsd ?? 0) + consultCost;\n  if (consultCost > 0 && typeof outcome.turnsCostUsd === \"number\") outcome.turnsCostUsd += consultCost;\n  process.stdout.write(JSON.stringify({ e: \"done\", ...outcome, res: readActuals() }) + \"\\n\");\n  process.exit(0);\n} catch (err) {\n  emit(\"error\", err instanceof Error ? err.message : String(err));\n  // The failure path reports actuals too \u2014 a step that died eleven minutes\n  // in still held its slice for eleven minutes, and the failed runs are\n  // exactly the ones whose resource story gets read.\n  let res = null;\n  try { res = readActuals(); } catch { /* the reading must never mask the error */ }\n  process.stdout.write(JSON.stringify({ e: \"done\", status: \"failed\", result: null, costUsd: null, res }) + \"\\n\");\n  process.exit(0);\n}\n";
 /** The uv release copied into the image. Pinned: a floating uv is a floating
  *  resolver, and the runtime cache is keyed on the declaration, not on it. */
 export declare const UV_VERSION = "0.11.25";

package/dist/src/run-container.js

@@ -569,6 +569,7 @@ try {
   process.env.FOLDRUN_DATA = "/home/agent/.foldrun";
   const { executeStep } = await import("@foldrun/core/step-exec");
   const { buildApiTools } = await import("@foldrun/core/api-tools");
+  const { buildA2ATools } = await import("@foldrun/core/a2a-tools");
   const { buildScriptTools } = await import("@foldrun/core/script-tools");
   const { buildConsultTools } = await import("@foldrun/core/agent-tools");
   const { buildSearchTools, buildHistoryTools, buildDeskTools } = await import("@foldrun/core/context-tools");
@@ -645,6 +646,20 @@ try {
   const toolEnv = { ...env };
   for (const [k, v] of Object.entries(env)) if (k.startsWith("FOLDRUN_DECLARED_")) toolEnv[k.slice("FOLDRUN_DECLARED_".length)] = v;
   const api = buildApiTools("", input.apis, undefined, { env: toolEnv, missing: [] }, keepIn);
+  // remotes: — the four a2a tools, rebuilt from values. Each token crossed in
+  // its spec (a placeholder the proxy fills for the card's origin alone), so
+  // nothing here asks a vault; handles go under the workspace's state/.
+  const a2a = input.a2a && Array.isArray(input.a2a.remotes) && input.a2a.remotes.length
+    ? buildA2ATools("", input.a2a.remotes, undefined, { env: {}, missing: [] }, {
+        stateDir: "/workspace/state/a2a/" + input.agentRel.split("/").pop(),
+        runId: input.a2a.runId,
+        step: input.a2a.step,
+        egress: env.FOLDRUN_EGRESS || null,
+        test: env.FOLDRUN_TEST_MODE === "1",
+        keepIn,
+        emit,
+      })
+    : { server: null, drainLog: () => [] };
   const script = buildScriptTools(
     agentDir,
     input.scripts,
@@ -721,6 +736,7 @@ try {
     mcpNames: input.mcpNames,
     mcpServers: {
       ...(api.server ? { foldrun_apis: api.server } : {}),
+      ...(a2a.server ? { foldrun_a2a: a2a.server } : {}),
       ...(script.server ? { foldrun_scripts: script.server } : {}),
       ...(consult.server ? { foldrun_agents: consult.server } : {}),
       ...(search.server ? { foldrun_search: search.server } : {}),
@@ -760,6 +776,7 @@ try {
     emit,
   });
   for (const line of api.drainLog()) emit("info", "api: " + line);
+  for (const line of a2a.drainLog()) emit("info", "a2a: " + line);
   for (const line of script.drainLog()) emit("info", "script: " + line);
   if (translator) {
     for (const line of translator.drainLog()) emit("info", line.startsWith("translator") ? line : "translator: " + line);

package/dist/src/runner.d.ts

@@ -1,6 +1,7 @@
 import { type DelegateSpec, type SubagentSpec } from "./subagents.ts";
 import { type FlowStep, type RunRecord, type StepRecord } from "./store.ts";
 import { type Catalog } from "./catalog.ts";
+import { type RemoteSpec } from "./a2a-remotes.ts";
 import { type SearchRoot, type RunDigest } from "./context-tools.ts";
 import { type ScriptSpec } from "./script-tools.ts";
 import { type RuntimeSpec } from "./runtime.ts";
@@ -331,6 +332,9 @@ grantsOnly?: boolean): {
     apiTools: import("./api-tools.ts").ApiToolResult;
     scriptTools: import("./script-tools.ts").ScriptToolResult;
     apiSpecs: import("./store.ts").ApiSpec[];
+    remotes: RemoteSpec[];
+    remoteOnlySecrets: string[];
+    remoteSecretEnv: Record<string, string>;
     scriptSpecs: ScriptSpec[];
     outward: boolean;
     searchRoots: SearchRoot[];
@@ -579,6 +583,12 @@ export declare function platformModelEnv(): Record<string, string | undefined>;
 export declare function readSchemaFile(workspaceRoot: string, rel: string): Record<string, unknown> | boolean | null;
 export declare function createFlowRun(tenant: string, workspace: string, steps: FlowStep[], flowName: string, status: "queued" | "running", tags?: string[], startedBy?: string | null, opts?: {
     test?: boolean;
+}, 
+/** An A2A task's correlation (foldrun-platform flow-admission.ts) — its
+ *  own trailing argument, so the signature only widened. */
+a2a?: {
+    task: string;
+    key: string;
 }): RunRecord;
 export declare function startFlowRun(tenant: string, workspace: string, steps: FlowStep[], flowName: string, modelOverride?: string | null, tags?: string[], effortOverride?: string | null, startedBy?: string | null, opts?: {
     test?: boolean;