@nylorun/agents 0.31.1-beta → 0.32.0-beta

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # @nylorun/agents
 
+## 0.32.0-beta
+
+### Minor Changes
+
+- 67ed2ea: `previewTurn(manifest, { sandbox?, memory?, mcpFacts?, model?, selfWake?, loop? })` (ADR-100):
+  what the model of a turn reads and may call, offline, built from the code the harness runs:
+  `{ system, tools, blocks, features, pinned, diagnostics, agents }`, the root agent's and each
+  subagent's. It takes a compiled agent manifest v8 (`checkFolder`'s) or a loop manifest; the facts
+  it is not given come from the manifest.
+- 67ed2ea: A message's `removeTools` (Host feature `remove-tools`): the tools its turn may not use, by name. A
+  declared tool or an agent used as a tool by its name (in the agent and the agents it uses as tools),
+  an MCP server's tool as `<server>__<tool>`, a whole server by its name. The Runtime applies it to the
+  version the turn runs, after the turn's first segment re-pins the session to its Agent's version, so
+  a session that always sends it still moves to new versions; names that version lacks are ignored.
+  A message's turn manifest is validated again against the version a re-pin moves to; one that is no
+  variant of it keeps the turn on the version it pinned (`turn.version_kept`). A variant may narrow an
+  agent it uses as a tool (`isVariantOf`; `withoutTools` in `@nylorun/core/define`). An HTTP tool call
+  is checked against the turn's manifest. `session.input` and `session.inputParts` take
+  `removeTools`.
+- 67ed2ea: Secret routing: the agent folder names, the installation routes (Host feature `secret-routing`, no
+  protocol change). A `bearer` or `headers` secret slot (`runtime.json`, `runtime.secrets`) takes the
+  gateway's `toolPrefix`, with or without `via`, and a slot's value write
+  (`PUT /v1/agents/{id}/secrets/{name}` with `{ value }` or `{ headers }`) takes `via`, with the same
+  URL rules as a slot's. At each request the secret's `via` wins, else the slot's in the version the
+  Agent runs, else none (the slot's `url`); the slot's `toolPrefix` wins over the secret's and
+  applies only with a `via`; the slot's `url` still picks the credential, for MCP servers and HTTP
+  tools alike, and an HTTP tool whose URL has `{field}` parameters still fails behind a `via`. A
+  write whose `toolPrefix` differs from its slot's is accepted, with a warning in the log. A `via` a
+  write copied from its slot follows the slot when the Agent moves, and a fork keeps a secret's own
+  `via`. Secret views show the `via` and `toolPrefix` in force, never a value.
+  `client.agents.secrets.put` takes `{ value | headers, via?, toolPrefix? }` (`AgentSecretRouting`),
+  and `nylorun agents secrets put` takes `--via` and `--tool-prefix`, and a slot's JSON without a
+  `type`. The JSON Schemas that gained the slot's `toolPrefix` are published as
+  `agent-manifest/v8.2`, `runtime-manifest/v1.1` and `agent-folder/v1/runtime.1`, which `nylorun init`
+  maps; the old `$schema` URLs are still read.
+- 67ed2ea: A session records the model its turns call and why (`SessionModelRecord`): `model` on `GET
+/v1/sessions/{id}` is `{provider, model, source: "manifest" | "session" | "tenant", reason?,
+requested?}`, with the fallback's `reason` (`provider_not_connected`, `not_in_catalog`,
+  `invalid_model`) and the model `requested` by the manifest or the session. It is set when the
+  session opens, chooses or clears its model, and again at each segment's start, and each change
+  writes the new `session.model` event with the `previous` record. `SessionView.model` in
+  `@nylorun/agents`.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+  - @nylorun/core@0.34.0-beta
+
 ## 0.31.1-beta
 
 ### Patch Changes

package/README.md

@@ -371,7 +371,7 @@ With a sandbox (kind `virtual` or `pod`), the model gets `bash`, `read`, `write`
 
 An Agent runs one version of its manifest at a time and evolves in place, with its id, disk, vault and sessions: a `put` on an existing one may change its `labels` and `owner` guard and moves it to the version its `manifest` names (`"name"` tracks the latest, `"name@n"` pins), `plan(id, input)` answers what that move would do, and a save of a new version moves every Agent that tracks the manifest. A harness change applies at once (each session's next turn runs it); a pod's runtime change waits for its next start on the same volume (`targetVersion`, `waitingFor: "start"`; `restart(id)` applies it now), and a start that fails goes back to the version it ran (`failedVersion`; `restart(id, { retry: true })` tries again). A version that adds a required secret waits for its value (`waitingFor: "secrets"`). `list({ outdated: true })` lists the Agents still moving. Its manifest's name, kind, harness and storage are fixed (`409 agent_fixed_field`): `fork(id, { id: next, manifest? })` makes a new Agent (default the source's manifest, tracking), with the source's disk (`disk`: `latest`, a version, or `empty`) and the secrets the new manifest declares (`secrets: "none"` copies none), and `planFork` answers what a fork would do. The Runtime checks the runtime section against the Tenant's limits (`GET`/`PUT /v1/tenant/sandbox`: a network ceiling, a resource maximum, the idle timeout; `/v1/tenant/artifacts` and `/v1/tenant/skills` for its `limits`). `lifecycle.idle` stops a pod after that long without a turn (at most the Tenant's); `lifecycle.deleteAfter` deletes the Agent, its vault and its files once nothing has used it that long. Private networks, loopback, the host and cloud metadata endpoints are always blocked.
 
-Secrets are write-only: `client.agents.secrets.put(id, name, secret)` creates or replaces one, and `list`, `get` and `delete` never return a value. When the manifest declares the secret's slot (`runtime.secrets`), send only `{ value }` (or `{ headers }`): the type and binding come from the slot, and a name it does not declare is `409 secret_not_in_manifest`. Typed, an `environment_secret` (`{ value, allowedHosts, inject? }`) shows its name to commands as the sentinel `nylorun_managed`, and egress-gate sets its header on HTTPS requests to `allowedHosts` (pods only); an `environment_variable` (`{ value }`) is a plain variable; `bearer` (`{ url, value, via?, toolPrefix?, identity? }`) and `headers` (`{ url, headers, via?, toolPrefix?, identity? }`) are credentials for the MCP servers and HTTP tools at `url`. A second secret for one host, or a second credential for one URL, is `409 credential_conflict` at the write ([DEPLOYMENT.md](../../guides/DEPLOYMENT.md#credentials)).
+Secrets are write-only: `client.agents.secrets.put(id, name, secret)` creates or replaces one, and `list`, `get` and `delete` never return a value. When the manifest declares the secret's slot (`runtime.secrets`), send only `{ value }` (or `{ headers }`): the type and binding come from the slot, and a name it does not declare is `409 secret_not_in_manifest`. A `bearer` or `headers` slot's value may carry this installation's routing (Host feature `secret-routing`): `via`, where its requests go (a gateway's endpoint, or the real URL of a tool the folder names by a fixed URL), which wins over the slot's `via`, and the gateway's `toolPrefix`, which needs a `via` and gives way to the slot's (a folder may name it in the slot, with or without a `via`). The slot's `url` still picks the credential, and `get` and `list` show the `via` and `toolPrefix` in force: `client.agents.secrets.put("bot", "WEB_KEY", { headers: { "x-litellm-api-key": key }, via: "http://localhost:4100/mcp/web" })`. Typed, an `environment_secret` (`{ value, allowedHosts, inject? }`) shows its name to commands as the sentinel `nylorun_managed`, and egress-gate sets its header on HTTPS requests to `allowedHosts` (pods only); an `environment_variable` (`{ value }`) is a plain variable; `bearer` (`{ url, value, via?, toolPrefix?, identity? }`) and `headers` (`{ url, headers, via?, toolPrefix?, identity? }`) are credentials for the MCP servers and HTTP tools at `url`. A second secret for one host, or a second credential for one URL, is `409 credential_conflict` at the write ([DEPLOYMENT.md](../../guides/DEPLOYMENT.md#credentials)).
 
 Sessions on one Agent share its `/workspace` and run their turns at the same time (one turn per session); which sessions work on one disk, and when, is your app's call. Stop, reset, snapshot and restore wait until no turn runs (`409 agent_busy`). Deleting a session only detaches it. With `owner` set, a session of another owner is `403 agent_owner_mismatch` (a caller acting for a person gets the `404` of a missing Agent), checked when it opens and at every turn start. An Agent's view says what it runs (`manifest`, `resolvedVersion`, `tracking`), its `state` (`working`, `sleeping`, `input_required`, `failing` or `paused`, `AGENT_STATES`) with the sessions behind it (`attention`), its compute (`compute.state`) and its slots. `client.agents.list({ labels, state, manifest })`, `page`, `get(id)`, `events(id, { types, since, until })` (its lifecycle, and `agent.egress` for every connection its sandbox opens, naming the turns that were running), `stop(id)`, `reset(id)` and `delete(id)` manage them, and `npx nylorun agents list | put | rm` does the same from the command line. Acting for a person (`app.as(...)`), changing an Agent or its secrets needs `agents:write`, and saving a manifest `agent-manifests:write`. A trusted issuer's token reaches only the Agents its issuer grants (the identity file's `agents` templates, exact ids or prefixes ending in `/*`), checked at every turn start. The Tenant holds at most `limits.environments` of them (`PUT /v1/tenant/sandbox`, default 100).
 

package/dist/agents.d.ts

@@ -33,15 +33,27 @@ import { type AgentDiskVersions, type AgentEvent, type AgentEventType, type Agen
 import { type Transport } from "./http.js";
 /** What an Agent is made from (`manifest: "name"` or `"name@n"`), and its owner guard, labels and `from`. */
 export type AgentInput = Omit<PutAgentRequest, "requestId">;
+/**
+ * This installation's routing of a `bearer` or `headers` slot's value (Host feature
+ * `secret-routing`): `via`, where the credential's requests go (an `https` URL, `http` only to a
+ * loopback host, with no userinfo, query or fragment), which wins over the slot's `via`; and the
+ * gateway's `toolPrefix`, which needs a `via` (this one or the slot's) and gives way to the slot's.
+ * The credential is still chosen by the slot's `url`.
+ */
+export interface AgentSecretRouting {
+    readonly via?: string;
+    readonly toolPrefix?: string;
+}
 /**
  * One secret of an Agent's vault, as written: typed, or only its value (`{ value }`, or
- * `{ headers }` for a `headers` secret) when its manifest declares the slot.
+ * `{ headers }` for a `headers` secret) when its manifest declares the slot, with this
+ * installation's routing for a `bearer` or `headers` slot (`AgentSecretRouting`).
  */
-export type AgentSecretInput = PutAgentSecretRequest | {
+export type AgentSecretInput = PutAgentSecretRequest | ({
     readonly value: string;
-} | {
+} & AgentSecretRouting) | ({
     readonly headers: Readonly<Record<string, string>>;
-};
+} & AgentSecretRouting);
 /** Which Agents a `list` or `page` answers: those with every label, and the state or manifest given. */
 export interface AgentFilter {
     readonly labels?: Readonly<Record<string, string>>;
@@ -75,8 +87,10 @@ export declare class AgentSecretsClient {
      * Creates or replaces secret `name` (`PUT /v1/agents/{id}/secrets/{name}`): for
      * `environment_secret` and `environment_variable` the name is the variable's. A second
      * credential for a host or a URL is a 409 `credential_conflict`. When the Agent's manifest
-     * declares the secret's slot, send only `{ value }` (or `{ headers }`); a name it does
-     * not declare is `409 secret_not_in_manifest`.
+     * declares the secret's slot, send only `{ value }` (or `{ headers }`), with `via` and
+     * `toolPrefix` for a `bearer` or `headers` slot routed through a gateway (Host feature
+     * `secret-routing`); a name it does not declare is `409 secret_not_in_manifest`. The answer
+     * shows the `via` and `toolPrefix` in force, never a value.
      */
     put(agentId: string, name: string, secret: AgentSecretInput, options?: {
         signal?: AbortSignal;
@@ -284,6 +298,7 @@ export declare class AgentInstancesClient {
                     description?: string | undefined;
                     type: "bearer";
                     url: string;
+                    toolPrefix?: string | undefined;
                 } | {
                     via?: string | undefined;
                     identity?: {
@@ -293,6 +308,7 @@ export declare class AgentInstancesClient {
                     description?: string | undefined;
                     type: "headers";
                     url: string;
+                    toolPrefix?: string | undefined;
                 }> | undefined;
             };
             limits: {

package/dist/agents.js

@@ -71,8 +71,10 @@ export class AgentSecretsClient {
      * Creates or replaces secret `name` (`PUT /v1/agents/{id}/secrets/{name}`): for
      * `environment_secret` and `environment_variable` the name is the variable's. A second
      * credential for a host or a URL is a 409 `credential_conflict`. When the Agent's manifest
-     * declares the secret's slot, send only `{ value }` (or `{ headers }`); a name it does
-     * not declare is `409 secret_not_in_manifest`.
+     * declares the secret's slot, send only `{ value }` (or `{ headers }`), with `via` and
+     * `toolPrefix` for a `bearer` or `headers` slot routed through a gateway (Host feature
+     * `secret-routing`); a name it does not declare is `409 secret_not_in_manifest`. The answer
+     * shows the `via` and `toolPrefix` in force, never a value.
      */
     async put(agentId, name, secret, options = {}) {
         return this.transport.json(`${this.path(agentId)}/secrets/${segment(name)}`, "PUT", { requestId: id(), ...secret }, options.signal);

package/dist/index.d.ts

@@ -6,18 +6,19 @@ export { Agent, AgentBuilder } from "./builder.js";
 export { AgentBuildError, AgentLifecycleError, VerdictSchema, isVerdict, WorkflowBuildError, isBuiltWorkflow, flow, tool, http, defineSchema, ToolError, harnessSectionOf, sectionGaps, } from "@nylorun/core/define";
 export type { FlowAgentBuilder, Flow, Named, LoopOptions, StageOptions, HttpTarget, } from "@nylorun/core/define";
 export type { AgentOptions, AgentManifest, BuiltAgent, BuiltWorkflow, Verdict, WorkflowBinding, WorkflowManifest, ToolDefinition, ToolExecutionContext, ToolOutcome, JsonValue, JsonObject, } from "@nylorun/core/define";
-export type { SessionPage, SessionListItem, SessionManifestView, HistoryPage, SessionUsageTotals, SessionModelChoice, SessionModelView, CostSplit, ModelCall, ModelCallsPage, AgentPage, ToolCall, ToolCallsPage, LiveEvent, SessionEvent, SessionEventOf, EventType, SessionCommand, SubjectScope, AgentView, AgentState, AgentAttention, AgentEvent, AgentEventType, EgressRunningTurn, EnvironmentKind, EnvironmentRecipe, EnvironmentSecretSlot, AgentSecretView, AgentSnapshot, AgentRestore, AgentDiskVersions, RestoreAgentRequest, AgentForkPlan, AgentMovePlan, RestartAgentRequest, ForkAgentRequest, ForkAgentResponse, DeleteAgentResponse, PutAgentRequest, PutAgentSecretRequest, AgentManifestV8, AgentManifestFile, HarnessManifestFile, RuntimeManifestFile, RuntimeSection, AgentManifestChange, AgentManifestWarning, AgentManifestPlan, AgentManifestSource, AgentManifestSourceDiff, AgentManifestSourceSummary, AgentFolderDiagnostic, AgentManifestView, AgentManifestVersions, SaveAgentManifestResponse, DeleteAgentManifestResponse, MessagePart, ArtifactView, ArtifactKind, ArtifactListItem, ArtifactPage, ArtifactVersionView, ArtifactLink, UploadArtifactResponse, DefinitionFileView, ArtifactTree, ArtifactDiff, FolderEntry, } from "@nylorun/core/contracts";
+export type { SessionPage, SessionListItem, SessionManifestView, HistoryPage, SessionUsageTotals, SessionModelChoice, SessionModelView, SessionModelRecord, CostSplit, ModelCall, ModelCallsPage, AgentPage, ToolCall, ToolCallsPage, LiveEvent, SessionEvent, SessionEventOf, EventType, SessionCommand, SubjectScope, AgentView, AgentState, AgentAttention, AgentEvent, AgentEventType, EgressRunningTurn, EnvironmentKind, EnvironmentRecipe, EnvironmentSecretSlot, AgentSecretView, AgentSnapshot, AgentRestore, AgentDiskVersions, RestoreAgentRequest, AgentForkPlan, AgentMovePlan, RestartAgentRequest, ForkAgentRequest, ForkAgentResponse, DeleteAgentResponse, PutAgentRequest, PutAgentSecretRequest, PutAgentSecretValueRequest, AgentManifestV8, AgentManifestFile, HarnessManifestFile, RuntimeManifestFile, RuntimeSection, AgentManifestChange, AgentManifestWarning, AgentManifestPlan, AgentManifestSource, AgentManifestSourceDiff, AgentManifestSourceSummary, AgentFolderDiagnostic, AgentManifestView, AgentManifestVersions, SaveAgentManifestResponse, DeleteAgentManifestResponse, MessagePart, ArtifactView, ArtifactKind, ArtifactListItem, ArtifactPage, ArtifactVersionView, ArtifactLink, UploadArtifactResponse, DefinitionFileView, ArtifactTree, ArtifactDiff, FolderEntry, } from "@nylorun/core/contracts";
 export { AGENT_EVENT_TYPES, AGENT_FOLDER_MEDIA_TYPE, AGENT_STATES, COMPUTE_STATES, RUNTIME_LIMIT_DEFAULTS, SUBJECT_SCOPES, } from "@nylorun/core/contracts";
 export type { AgentHarnessSection, HarnessSection, HarnessSkill, HarnessMcpServer, WorkflowHarnessSection, } from "@nylorun/core";
 export { AgentsClient, SessionClient, createClient } from "./client.js";
 export { ArtifactsClient } from "./artifacts.js";
 export { FilesClient, definitionFileHash } from "./files.js";
 export type { ArtifactBody, ArtifactPageOptions, ArtifactLinkWithUrl, UploadArtifactOptions, } from "./artifacts.js";
-export type { ActAsOptions, AgentSource, SessionView, CommandOptions, CreateSessionOptions, SessionSandbox, AgentFilter, AgentInput, AgentSecretInput, RuntimeFileBytes, AgentManifestDocument, AgentManifestFromAgent, AgentManifestInput, AgentManifestSaveOptions, ComposedManifest, DefinitionFiles, } from "./client.js";
+export type { ActAsOptions, AgentSource, SessionView, CommandOptions, CreateSessionOptions, SessionSandbox, AgentFilter, AgentInput, AgentSecretInput, AgentSecretRouting, RuntimeFileBytes, AgentManifestDocument, AgentManifestFromAgent, AgentManifestInput, AgentManifestSaveOptions, ComposedManifest, DefinitionFiles, } from "./client.js";
 export { AgentInstancesClient, AgentManifestsClient, AgentMemoriesClient, AgentSecretsClient, ManifestGapsError, agentManifest, requirementGaps, runtimeFiles, } from "./client.js";
 export { composeManifest, manifestFolders, ComposeError, AGENT_MANIFEST_FILE } from "./compose.js";
 export { AGENT_FOLDER_FILE, FolderError, FolderInvalidError, diagnosticLine } from "./folder.js";
 export { checkFolder, folderOfManifest, type FolderOfManifest, type FolderOfManifestOptions } from "./folder-check.js";
+export { ENGINE_BLOCK_NAMES, previewTurn, type AgentTurnPreview, type EngineBlockName, type PreviewTool, type PreviewTurnOptions, type TurnPreview, } from "@nylorun/core/engine";
 export type { PackedFolder } from "./folder.js";
 export { packFolder, isAgentFolder, FOLDER_IGNORE_FILE } from "./folder-pack.js";
 export { ignoreMatcher } from "./folder-ignore.js";

package/dist/index.js

@@ -15,6 +15,8 @@ export { AgentInstancesClient, AgentManifestsClient, AgentMemoriesClient, AgentS
 export { composeManifest, manifestFolders, ComposeError, AGENT_MANIFEST_FILE } from "./compose.js";
 export { AGENT_FOLDER_FILE, FolderError, FolderInvalidError, diagnosticLine } from "./folder.js";
 export { checkFolder, folderOfManifest } from "./folder-check.js";
+// What the model of a turn reads and may call (ADR-100), offline: our engine's own code.
+export { ENGINE_BLOCK_NAMES, previewTurn, } from "@nylorun/core/engine";
 export { packFolder, isAgentFolder, FOLDER_IGNORE_FILE } from "./folder-pack.js";
 export { ignoreMatcher } from "./folder-ignore.js";
 export { AccessClient } from "./access.js";

package/dist/session-client.d.ts

@@ -3,7 +3,7 @@
  * which resolves the connection from the environment or the Project link.
  */
 import type { JsonValue, SandboxToolName } from "@nylorun/core/define";
-import { type SessionModelChoice, type SessionItemsResponse, type SessionSummary, type SubjectScope, type MessageDelivery, type MessagePart, type SessionCommand } from "@nylorun/core/contracts";
+import { type SessionModelChoice, type SessionModelRecord, type SessionItemsResponse, type SessionSummary, type SubjectScope, type MessageDelivery, type MessagePart, type SessionCommand } from "@nylorun/core/contracts";
 import { SessionsReadClient } from "./reads.js";
 import { AccessClient } from "./access.js";
 import { AgentInstancesClient } from "./agents.js";
@@ -22,6 +22,13 @@ export interface SessionView {
     status: string;
     activeTurnId: string | null;
     waits?: unknown;
+    /**
+     * The model the session's turns call and why: `source` `manifest` (its Agent's version's
+     * `harness.model`), `session` (its own, `setModel`) or `tenant`, with `reason` and `requested`
+     * when it falls back to the Tenant's. Null for a flow and while the Tenant has no model; absent
+     * from an older Runtime. Each change is a `session.model` event.
+     */
+    model?: SessionModelRecord | null;
     [key: string]: unknown;
 }
 /** `AgentsClient.createSession`'s options. */
@@ -92,10 +99,15 @@ export type CommandOptions = {
 /**
  * A message's options. `delivery` says what a message to a busy session does (protocol 17):
  * `queue` (the default) waits for the running turn to end, `reject` is refused with
- * `409 session_busy`.
+ * `409 session_busy`. `removeTools` names the tools the message's turn may not use (Host feature
+ * `remove-tools`): a declared tool or an agent used as a tool by its name (in the agent and in
+ * the agents it uses as tools), an MCP server's tool as `<server>__<tool>`, a whole MCP server by
+ * its name. It applies to the version the turn runs, so the session still moves to its Agent's
+ * new versions; names that version does not have are ignored.
  */
 export type MessageOptions = CommandOptions & {
     delivery?: MessageDelivery;
+    removeTools?: readonly string[];
 };
 export declare class SessionClient {
     private readonly transport;
@@ -152,6 +164,8 @@ export declare class SessionClient {
         cursor: string | null;
         requestId: string;
     }>;
+    /** A message's `removeTools`, when it names any; a Runtime without `remove-tools` refuses it. */
+    private removeToolsOf;
     /** Approve (or deny) a held tool call. Without an idempotency key, a new one is made. */
     approve(interactionId: string, approved: boolean, options?: Partial<CommandOptions>): Promise<{
         status: "accepted";
@@ -492,7 +506,7 @@ export type { Destination, IncompatibleReason } from "./http.js";
 export type { LiveEvent } from "@nylorun/core/contracts";
 export { AccessClient } from "./access.js";
 export { AgentInstancesClient, AgentMemoriesClient, AgentSecretsClient, runtimeFiles } from "./agents.js";
-export type { AgentFilter, AgentInput, AgentSecretInput, RuntimeFileBytes } from "./agents.js";
+export type { AgentFilter, AgentInput, AgentSecretInput, AgentSecretRouting, RuntimeFileBytes } from "./agents.js";
 export { AgentManifestsClient, ManifestGapsError, agentManifest, requirementGaps } from "./agent-manifests.js";
 export { AGENT_FOLDER_FILE, FolderError, FolderInvalidError, diagnosticLine } from "./folder.js";
 export type { PackedFolder } from "./folder.js";

package/dist/session-client.js

@@ -143,12 +143,13 @@ export class SessionClient {
      * Start a turn. Strings become `message.content`; any other JSON value becomes
      * `message.data` (workflows.md §5).
      */
-    input(value, options) {
+    async input(value, options) {
         const base = {
             type: "message",
             requestId: options.requestId ?? id(),
             idempotencyKey: options.idempotencyKey,
             ...(options.delivery ? { delivery: options.delivery } : {}),
+            ...(await this.removeToolsOf(options)),
         };
         return this.command(typeof value === "string"
             ? { ...base, content: value }
@@ -159,15 +160,23 @@ export class SessionClient {
      * it with `client.artifacts.upload`), at a version or its latest, and the model reads it, an
      * image as an image and a text file as text.
      */
-    inputParts(parts, options) {
+    async inputParts(parts, options) {
         return this.command({
             type: "message",
             requestId: options.requestId ?? id(),
             idempotencyKey: options.idempotencyKey,
             parts: [...parts],
             ...(options.delivery ? { delivery: options.delivery } : {}),
+            ...(await this.removeToolsOf(options)),
         }, options.signal);
     }
+    /** A message's `removeTools`, when it names any; a Runtime without `remove-tools` refuses it. */
+    async removeToolsOf(options) {
+        if (!options.removeTools?.length)
+            return {};
+        await this.transport.requireFeature("remove-tools", options.signal);
+        return { removeTools: [...options.removeTools] };
+    }
     /** Approve (or deny) a held tool call. Without an idempotency key, a new one is made. */
     approve(interactionId, approved, options = {}) {
         return this.command({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/agents",
-  "version": "0.31.1-beta",
+  "version": "0.32.0-beta",
   "description": "Nylorun agent definitions and session client",
   "type": "module",
   "license": "Apache-2.0",
@@ -43,7 +43,7 @@
     "test": "vitest run --passWithNoTests"
   },
   "dependencies": {
-    "@nylorun/core": "0.33.0-beta",
+    "@nylorun/core": "0.34.0-beta",
     "gray-matter": "^4.0.3"
   },
   "peerDependencies": {