@nylorun/runtime 0.15.1-beta → 0.16.0-beta

package/dist/gates/egress.d.ts

@@ -0,0 +1,72 @@
+import { type Server } from "node:http";
+import { type Socket } from "node:net";
+import type { EgressTokenVerdict } from "../sandbox/egress-token.js";
+import type { SessionStore } from "../store/types.js";
+import type { Logger } from "../tenant/types.js";
+/**
+ * What egress-gate reads of a sandbox: its current host epoch, the pod that joined at it, and
+ * its spec's `network.allow`; `undefined` when it is gone, deleted, lost, expired or not a pod.
+ */
+export interface EgressSandboxes {
+    live(sandboxId: string): Promise<{
+        readonly epoch: number;
+        readonly podUid?: string;
+        readonly allow: readonly string[];
+    } | undefined>;
+}
+/** Ports a tunnel may open. */
+export declare const EGRESS_PORTS: readonly number[];
+/** Tunnels one sandbox may hold open at once. */
+export declare const EGRESS_MAX_PER_SANDBOX = 64;
+/** A tunnel with no traffic either way for this long is closed. */
+export declare const EGRESS_IDLE_MS: number;
+/** How long a sandbox's epoch and allowlist are reused before they are read again. */
+export declare const EGRESS_CACHE_MS = 5000;
+/** How long the gate waits for the upstream connection. */
+export declare const EGRESS_CONNECT_TIMEOUT_MS = 10000;
+export interface StartEgressGateOptions {
+    readonly listen: {
+        readonly host: string;
+        readonly port: number;
+    };
+    readonly logger: Logger;
+    /** Verifies a presented egress token (`verifyEgressToken` over the Tenant's keys). */
+    verify(raw: string): Promise<EgressTokenVerdict>;
+    readonly sandboxes: EgressSandboxes;
+    readonly idleMs?: number;
+    readonly maxPerSandbox?: number;
+    readonly cacheMs?: number;
+    readonly connectTimeoutMs?: number;
+    /** Tests replace name resolution. */
+    readonly lookup?: (host: string) => Promise<readonly {
+        address: string;
+        family: number;
+    }[]>;
+    /** Tests replace which resolved addresses are refused. Default `isEgressBlocked`. */
+    readonly blocked?: (address: string) => boolean;
+    /** Tests replace how the checked address is dialled. */
+    readonly dial?: (address: string, port: number) => Socket;
+}
+export interface EgressGate {
+    /** Where the gate listens, e.g. `http://0.0.0.0:4200`. */
+    readonly url: string;
+    readonly server: Server;
+    close(): Promise<void>;
+}
+/**
+ * True when a tunnel must not reach `address`: private, loopback, link-local (169.254.169.254, the
+ * cloud metadata address, included), unspecified, multicast, reserved, or an IPv6 form that
+ * embeds an IPv4 address.
+ */
+export declare function isEgressBlocked(address: string): boolean;
+/** Whether `host` (a lowercase name) matches one of `allow`'s names or `*.suffix` patterns. */
+export declare function egressAllows(host: string, allow: readonly string[]): boolean;
+/** The egress token in a `Proxy-Authorization` header, or `undefined`. */
+export declare function proxyToken(header: string | undefined): string | undefined;
+export declare function startEgressGate(options: StartEgressGateOptions): Promise<EgressGate>;
+/**
+ * `EgressSandboxes` over the Tenant's `sandbox_resources` (one indexed read): a pod sandbox's
+ * host epoch, the pod that joined at it and its spec's allowlist; nothing for a virtual
+ * sandbox, or one deleted, lost or expired, as `staleHost` judges a host token.
+ */
+export declare function storeEgressSandboxes(store: SessionStore): EgressSandboxes;

package/dist/gates/egress.js

@@ -0,0 +1,319 @@
+/**
+ * egress-gate (F7.2, D42): the only way out of a pod sandbox to the internet. A CONNECT proxy in
+ * the gateway (`--service egress`, port 4200) that opens a TCP tunnel to a host the sandbox's spec
+ * allows (`network.allow`), and nothing else. Pods reach it through `HTTPS_PROXY`/`HTTP_PROXY`
+ * with their egress token as the proxy credential; NetworkPolicy lets them reach nothing but this
+ * listener, the gates and the Harness API.
+ *
+ * Every CONNECT, in order:
+ * 1. the egress token from `Proxy-Authorization` (Basic with the token as password, as tools send
+ *    proxy userinfo, or Bearer) verifies (`verifyEgressToken`), else 407;
+ * 2. its sandbox is live and its host epoch and pod are the token's (`EgressSandboxes.live`),
+ *    else 407;
+ * 3. the port is 443 or 80, the target is a host name and no IP literal, and it matches the spec's
+ *    `network.allow` exactly or by `*.suffix`, else 403;
+ * 4. the sandbox has fewer than `maxPerSandbox` tunnels open, else 429;
+ * 5. the name resolves, and to at least one address that is not private, loopback, link-local
+ *    (cloud metadata included), multicast or reserved, else 502 or 403;
+ * 6. the gate connects to that checked address (never to the name again) and pipes.
+ *
+ * No TLS interception and no credential injection: a tunnel is opaque bytes. Any other request
+ * (an absolute-form plain HTTP request included) is answered 405. Refusals are logged, never as
+ * events; the token never is. Tunnels close after `idleMs` without traffic in either direction.
+ */
+import { lookup as dnsLookup } from "node:dns/promises";
+import { createServer } from "node:http";
+import { BlockList, connect, isIP } from "node:net";
+import { isSandboxHostPattern } from "@nylorun/core/define";
+import { isPrivateAddress } from "../tenant/outbound.js";
+import { bindListener } from "../host/http.js";
+/** Ports a tunnel may open. */
+export const EGRESS_PORTS = [443, 80];
+/** Tunnels one sandbox may hold open at once. */
+export const EGRESS_MAX_PER_SANDBOX = 64;
+/** A tunnel with no traffic either way for this long is closed. */
+export const EGRESS_IDLE_MS = 5 * 60_000;
+/** How long a sandbox's epoch and allowlist are reused before they are read again. */
+export const EGRESS_CACHE_MS = 5_000;
+/** How long the gate waits for the upstream connection. */
+export const EGRESS_CONNECT_TIMEOUT_MS = 10_000;
+/** Ranges beyond `isPrivateAddress`'s that a tunnel never reaches. */
+const RESERVED = new BlockList();
+for (const [network, prefix] of [
+    ["192.0.0.0", 24], // IETF protocol assignments
+    ["192.0.2.0", 24], // documentation
+    ["198.18.0.0", 15], // benchmarking
+    ["198.51.100.0", 24],
+    ["203.0.113.0", 24],
+    ["224.0.0.0", 4], // multicast
+    ["240.0.0.0", 4], // reserved, broadcast
+])
+    RESERVED.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+    ["64:ff9b::", 96], // NAT64: would reach any IPv4 address
+    ["64:ff9b:1::", 48],
+    ["100::", 64], // discard
+    ["2001::", 32], // Teredo
+    ["2001:db8::", 32], // documentation
+    ["2002::", 16], // 6to4
+    ["ff00::", 8], // multicast
+])
+    RESERVED.addSubnet(network, prefix, "ipv6");
+/**
+ * True when a tunnel must not reach `address`: private, loopback, link-local (169.254.169.254, the
+ * cloud metadata address, included), unspecified, multicast, reserved, or an IPv6 form that
+ * embeds an IPv4 address.
+ */
+export function isEgressBlocked(address) {
+    if (isPrivateAddress(address))
+        return true;
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(address);
+    if (mapped)
+        return RESERVED.check(mapped[1], "ipv4");
+    const family = isIP(address);
+    if (family === 0)
+        return true;
+    return RESERVED.check(address, family === 4 ? "ipv4" : "ipv6");
+}
+/** Whether `host` (a lowercase name) matches one of `allow`'s names or `*.suffix` patterns. */
+export function egressAllows(host, allow) {
+    for (const entry of allow) {
+        const pattern = entry.toLowerCase();
+        if (pattern.startsWith("*.") ? host.endsWith(pattern.slice(1)) : host === pattern)
+            return true;
+    }
+    return false;
+}
+/** The egress token in a `Proxy-Authorization` header, or `undefined`. */
+export function proxyToken(header) {
+    if (!header)
+        return undefined;
+    const match = /^(basic|bearer)\s+(\S+)\s*$/i.exec(header);
+    if (!match)
+        return undefined;
+    if (match[1].toLowerCase() === "bearer")
+        return match[2];
+    const decoded = Buffer.from(match[2], "base64").toString("utf8");
+    const colon = decoded.indexOf(":");
+    // userinfo `x:<token>@`; a bare `<token>@` arrives as the user with no password.
+    const token = colon === -1 ? decoded : decoded.slice(colon + 1) || decoded.slice(0, colon);
+    return token === "" ? undefined : token;
+}
+/** `host:port` of a CONNECT request target, lowercase, without a trailing root dot. */
+function parseTarget(target) {
+    const match = /^(\[[^\]]*\]|[^:[\]]+):(\d{1,5})$/.exec(target ?? "");
+    if (!match)
+        return undefined;
+    const port = Number(match[2]);
+    if (port < 1 || port > 65535)
+        return undefined;
+    return { host: match[1].toLowerCase().replace(/\.$/, ""), port };
+}
+const REASONS = {
+    403: "Forbidden",
+    405: "Method Not Allowed",
+    407: "Proxy Authentication Required",
+    429: "Too Many Requests",
+    502: "Bad Gateway",
+};
+function answer(socket, status, message, headers = []) {
+    const body = `egress-gate: ${message}\n`;
+    if (socket.destroyed)
+        return;
+    socket.end([
+        `HTTP/1.1 ${status} ${REASONS[status] ?? "Error"}`,
+        "content-type: text/plain; charset=utf-8",
+        `content-length: ${Buffer.byteLength(body)}`,
+        "connection: close",
+        ...headers,
+        "",
+        body,
+    ].join("\r\n"));
+}
+export async function startEgressGate(options) {
+    const { logger, sandboxes } = options;
+    const idleMs = options.idleMs ?? EGRESS_IDLE_MS;
+    const maxPerSandbox = options.maxPerSandbox ?? EGRESS_MAX_PER_SANDBOX;
+    const cacheMs = options.cacheMs ?? EGRESS_CACHE_MS;
+    const connectTimeoutMs = options.connectTimeoutMs ?? EGRESS_CONNECT_TIMEOUT_MS;
+    const blocked = options.blocked ?? isEgressBlocked;
+    const lookup = options.lookup ?? ((host) => dnsLookup(host, { all: true, verbatim: true }));
+    const dial = options.dial ?? ((address, port) => connect({ host: address, port }));
+    const cache = new Map();
+    /** The sandbox as of at most `cacheMs` ago; read again when the token names a newer epoch. */
+    async function live(sandboxId, epoch) {
+        const cached = cache.get(sandboxId);
+        if (cached && Date.now() - cached.at < cacheMs && cached.value && cached.value.epoch >= epoch)
+            return cached.value;
+        const value = await sandboxes.live(sandboxId);
+        cache.set(sandboxId, { at: Date.now(), value });
+        if (cache.size > 4096)
+            cache.delete(cache.keys().next().value);
+        return value;
+    }
+    const open = new Map();
+    const tunnels = new Set();
+    async function onConnect(req, client, head) {
+        const target = parseTarget(req.url);
+        const refuse = (status, reason, fields = {}, message) => {
+            logger.warn("egress_refused", { status, reason, ...(target ? { host: target.host, port: target.port } : {}), ...fields });
+            answer(client, status, message ?? reason, status === 407 ? ['proxy-authenticate: Basic realm="nylorun-egress"'] : []);
+        };
+        const raw = proxyToken(req.headers["proxy-authorization"]);
+        if (!raw)
+            return refuse(407, "egress_token_missing", {}, "an egress token is required");
+        const verdict = await options.verify(raw);
+        if (!verdict.ok)
+            return refuse(407, verdict.reason, {}, "the egress token was refused");
+        const { sandboxId, epoch } = verdict.claims;
+        const sandbox = await live(sandboxId, epoch);
+        if (!sandbox)
+            return refuse(407, "sandbox_gone", { sandboxId }, "the egress token was refused");
+        if (sandbox.epoch !== epoch)
+            return refuse(407, "epoch_stale", { sandboxId, epoch, current: sandbox.epoch }, "the egress token was refused");
+        if (sandbox.podUid !== undefined && sandbox.podUid !== verdict.claims.podUid)
+            return refuse(407, "pod_stale", { sandboxId }, "the egress token was refused");
+        if (!target)
+            return refuse(403, "target_invalid", { sandboxId }, "CONNECT needs host:port");
+        const { host, port } = target;
+        if (!EGRESS_PORTS.includes(port))
+            return refuse(403, "port_refused", { sandboxId }, `port ${port} is not allowed; tunnels open to 443 or 80 only`);
+        if (isIP(host.replace(/^\[|\]$/g, "")) !== 0 || !isSandboxHostPattern(host) || host.startsWith("*."))
+            return refuse(403, "not_a_host_name", { sandboxId }, `${host} is not a host name; IP literals are refused`);
+        if (!egressAllows(host, sandbox.allow))
+            return refuse(403, "host_not_allowed", { sandboxId }, `${host} is not in this sandbox's network.allow`);
+        let mine = open.get(sandboxId);
+        if (!mine)
+            open.set(sandboxId, (mine = new Set()));
+        if (mine.size >= maxPerSandbox)
+            return refuse(429, "too_many_tunnels", { sandboxId }, `this sandbox has ${maxPerSandbox} tunnels open`);
+        const slot = mine;
+        slot.add(client);
+        tunnels.add(client);
+        const release = () => {
+            slot.delete(client);
+            tunnels.delete(client);
+            if (slot.size === 0 && open.get(sandboxId) === slot)
+                open.delete(sandboxId);
+        };
+        client.once("close", release);
+        let addresses;
+        try {
+            addresses = await lookup(host);
+        }
+        catch (error) {
+            return refuse(502, "resolve_failed", { sandboxId, code: error.code }, `${host} does not resolve`);
+        }
+        const allowed = addresses.filter((entry) => !blocked(entry.address));
+        if (allowed.length === 0)
+            return refuse(403, "address_refused", { sandboxId }, `${host} resolves only to addresses tunnels may not reach`);
+        if (client.destroyed)
+            return;
+        const upstream = await dialFirst(allowed.map((entry) => entry.address), port);
+        if (!upstream)
+            return refuse(502, "connect_failed", { sandboxId }, `could not connect to ${host}:${port}`);
+        if (client.destroyed) {
+            upstream.destroy();
+            return;
+        }
+        upstream.setTimeout(idleMs);
+        const close = () => {
+            client.destroy();
+            upstream.destroy();
+        };
+        upstream.on("timeout", close);
+        upstream.on("error", close);
+        upstream.on("close", () => client.destroy());
+        client.on("close", () => upstream.destroy());
+        client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+        if (head.length > 0)
+            upstream.write(head);
+        upstream.pipe(client);
+        client.pipe(upstream);
+    }
+    /** Connects to the first of `addresses` that answers within the connect timeout. */
+    async function dialFirst(addresses, port) {
+        for (const address of addresses) {
+            const socket = await new Promise((resolve) => {
+                const attempt = dial(address, port);
+                const timer = setTimeout(() => {
+                    attempt.destroy();
+                    resolve(undefined);
+                }, connectTimeoutMs);
+                attempt.once("connect", () => {
+                    clearTimeout(timer);
+                    attempt.removeAllListeners("error");
+                    resolve(attempt);
+                });
+                attempt.once("error", () => {
+                    clearTimeout(timer);
+                    attempt.destroy();
+                    resolve(undefined);
+                });
+            });
+            if (socket)
+                return socket;
+        }
+        return undefined;
+    }
+    const server = createServer((req, res) => {
+        logger.warn("egress_refused", { status: 405, reason: "not_connect", method: req.method });
+        res.writeHead(405, { allow: "CONNECT", "content-type": "text/plain; charset=utf-8", connection: "close" });
+        res.end("egress-gate: only CONNECT is served; set HTTPS_PROXY and HTTP_PROXY to this address\n");
+    });
+    server.headersTimeout = 10_000;
+    server.requestTimeout = 15_000;
+    server.on("connect", (req, client, head) => {
+        // A client socket: idle from the request on, through the tunnel's life.
+        client.on("error", () => { });
+        client.setTimeout(idleMs);
+        client.on("timeout", () => client.destroy());
+        onConnect(req, client, head).catch((error) => {
+            logger.error("egress_failed", { error: error instanceof Error ? error.message : String(error) });
+            answer(client, 502, "the tunnel failed");
+        });
+    });
+    server.on("clientError", (_error, socket) => {
+        if (!socket.destroyed)
+            socket.end("HTTP/1.1 400 Bad Request\r\nconnection: close\r\n\r\n");
+    });
+    await bindListener(server, options.listen.port, options.listen.host, (error) => logger.error("listener_error", { error: error.message }));
+    const port = server.address().port;
+    const host = options.listen.host.includes(":") ? `[${options.listen.host}]` : options.listen.host;
+    let closing;
+    return {
+        url: `http://${host}:${port}`,
+        server,
+        close() {
+            closing ??= new Promise((resolve) => {
+                server.close(() => resolve());
+                for (const tunnel of tunnels)
+                    tunnel.destroy();
+                server.closeAllConnections();
+            });
+            return closing;
+        },
+    };
+}
+/**
+ * `EgressSandboxes` over the Tenant's `sandbox_resources` (one indexed read): a pod sandbox's
+ * host epoch, the pod that joined at it and its spec's allowlist; nothing for a virtual
+ * sandbox, or one deleted, lost or expired, as `staleHost` judges a host token.
+ */
+export function storeEgressSandboxes(store) {
+    return {
+        async live(sandboxId) {
+            const sandbox = await store.tx((t) => t.sandboxResource(sandboxId));
+            const pod = sandbox?.pod;
+            if (!sandbox || sandbox.kind !== "pod" || !pod)
+                return undefined;
+            if (pod.desired === "deleted" || pod.observed === "lost" || pod.observed === "expired")
+                return undefined;
+            return {
+                epoch: pod.hostEpoch,
+                ...(pod.podUid ? { podUid: pod.podUid } : {}),
+                allow: sandbox.spec.network?.allow ?? [],
+            };
+        },
+    };
+}

package/dist/gates/handler.d.ts

@@ -1,4 +1,5 @@
 import type { Logger } from "../tenant/types.js";
+import type { BlobStore } from "../blob/index.js";
 import type { ModelCallSettings, ModelGate, ModelGateRequest } from "./model-gate.js";
 import { type TenantVaults } from "./tenant-vaults.js";
 export interface ModelCallHandlerOptions {
@@ -6,6 +7,8 @@ export interface ModelCallHandlerOptions {
     readonly logger: Logger;
     /** Retries and timeouts; `piModel`'s defaults when absent. */
     readonly settings?: ModelCallSettings;
+    /** The Object store, for the files a prompt names (protocol 6). */
+    readonly blobs?: BlobStore;
 }
 /**
  * A model call as the gate receives it: the Tenant is optional (the loop of a protocol 4

package/dist/gates/handler.js

@@ -6,11 +6,11 @@
  * the Tenant's ledger. Logs one line per call, never the prompt, the output or a credential.
  */
 import { classifyThrown } from "../model/classify.js";
-import { inProcessModelGate } from "./in-process.js";
+import { callFiles, inProcessModelGate } from "./in-process.js";
 import { createMeter } from "./meter.js";
 import { GateRefusal } from "./tenant-vaults.js";
 export function createModelCallHandler(options) {
-    const { vaults, logger, settings } = options;
+    const { vaults, logger, settings, blobs } = options;
     const meter = createMeter({ logger });
     return {
         async call(named, signal) {
@@ -26,6 +26,7 @@ export function createModelCallHandler(options) {
                     readHostModel: () => vault.readHostModel(),
                     writeHostCredential: (credential) => vault.writeHostCredential(credential),
                     ...(settings ? { settings } : {}),
+                    ...(blobs ? { files: callFiles(vault.store, blobs) } : {}),
                 });
                 outcome = await meter.call(vault.store, call, () => gate.call(call, signal));
             }

package/dist/gates/http-client.d.ts

@@ -1,11 +1,12 @@
 import type { ModelGate } from "./model-gate.js";
+import type { RunTokens } from "../tenant/run-grants.js";
 /** Above the gate's 600 s provider request timeout. */
 export declare const GATE_CLIENT_TIMEOUT_MS = 630000;
 export interface HttpModelGateOptions {
     /** The gates service, e.g. `http://gateway:4100` (`NYLORUN_GATES_URL`). */
     readonly url: string;
-    /** `NYLORUN_GATES_TOKEN`. */
-    readonly token: string;
+    /** The run token of each session an advance of this process owns: a call's credential. */
+    readonly runTokens: RunTokens;
     /** How long the connection may stay silent. Default `GATE_CLIENT_TIMEOUT_MS`. */
     readonly timeoutMs?: number;
 }

package/dist/gates/http-client.js

@@ -10,6 +10,10 @@
  * A failure of the hop is a failure outcome, never a throw: `resolveEffect` marks anything
  * thrown `uncertain`. Only an abort of the caller's signal throws. The client never retries;
  * the gate retries the provider.
+ *
+ * The credential is the session's run token (F5), read per request from the advance's grant:
+ * the gate takes session, turn and agent from it, so the body no longer names them. A call for
+ * a session without a grant fails at once; it never falls back to core's credential.
  */
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
@@ -27,12 +31,16 @@ export function httpModelGate(options) {
     return {
         recovers: true,
         async cancel(request) {
+            const token = options.runTokens.token(request.sessionId);
+            // Without a grant there is no run whose call to stop.
+            if (!token)
+                return;
             const url = new URL(`${MODEL_CALLS_PATH}/${encodeURIComponent(request.effectId)}/cancel`, options.url);
             await new Promise((resolve) => {
                 const outgoing = send(url, {
                     method: "POST",
                     headers: {
-                        authorization: `Bearer ${options.token}`,
+                        authorization: `Bearer ${token}`,
                         [TENANT_HEADER]: request.tenantId,
                         "content-length": 0,
                     },
@@ -49,10 +57,11 @@ export function httpModelGate(options) {
         },
         async call(request, signal) {
             signal.throwIfAborted();
+            const token = options.runTokens.token(request.sessionId);
+            // Never core's credential: like an unreachable gate, and the heartbeat mints it again.
+            if (!token)
+                return failure("transient", `No run token for session ${request.sessionId}: the advance that owns it could not mint one, or the call came from outside an owned advance`, true);
             const body = {
-                sessionId: request.sessionId,
-                turnId: request.turnId,
-                agentId: request.agentId,
                 effectId: request.effectId,
                 invocationId: request.invocationId,
                 call: request.call,
@@ -87,7 +96,7 @@ export function httpModelGate(options) {
                 const outgoing = send(endpoint, {
                     method: "POST",
                     headers: {
-                        authorization: `Bearer ${options.token}`,
+                        authorization: `Bearer ${token}`,
                         "content-type": "application/json",
                         "content-length": payload.byteLength,
                         [TENANT_HEADER]: request.tenantId,
@@ -151,7 +160,9 @@ function answer(status, text) {
     }
     const message = parsed?.error?.message;
     if (status === 401)
-        return failure("auth", "The model gate refused this Runtime's token: the runtime and gateway containers must share NYLORUN_GATES_TOKEN", false);
+        return failure("auth", `The model gate refused the run token${message ? `: ${message}` : ""}`, false);
+    if (status === 409 && parsed?.error?.code === "run_stale")
+        return failure("invalid_request", `The model gate refused a stale run${message ? `: ${message}` : ""}`, false);
     if (status === 409)
         return failure("invalid_request", `The call's request changed under the same effect id${message ? `: ${message}` : ""}`, false);
     if (status === 400)

package/dist/gates/in-process.d.ts

@@ -8,7 +8,9 @@ import { type ModelCallSettings } from "../model/pi-model.js";
 import type { SessionStore } from "../store/types.js";
 import type { Logger } from "../tenant/types.js";
 import type { HostModelSecret } from "../vault/service.js";
-import type { ModelGate } from "./model-gate.js";
+import type { ModelGate, ModelGateRequest } from "./model-gate.js";
+import { type FileResolver } from "../artifacts/files.js";
+import type { BlobStore } from "../blob/index.js";
 export interface InProcessModelGateOptions {
     /** The Tenant's home: `piModel` redacts secrets it finds there from failure messages. */
     readonly root?: string;
@@ -16,7 +18,15 @@ export interface InProcessModelGateOptions {
     /** Writes back a credential pi-ai refreshed (OAuth). */
     readonly writeHostCredential: (credential: Credential) => Promise<void>;
     readonly settings?: ModelCallSettings;
+    /** Reads the files a call's prompt names (protocol 6): artifacts, for model-gate. */
+    readonly files?: (request: ModelGateRequest) => FileResolver;
 }
+/**
+ * The files a call names, from the Tenant's artifacts, limited to the call's session: in
+ * process, the loop's own request; over HTTP, the session of the run token's claims, which the
+ * gate's route puts on the request (F5). A request without a session reads no file at all.
+ */
+export declare function callFiles(store: SessionStore, blobs: BlobStore): (request: Pick<ModelGateRequest, "sessionId">) => FileResolver;
 /**
  * The in-process gate of an open Tenant: reads its host model from its own vault and records
  * each call in its usage ledger. Only a Runtime without the gates service (embedding, the
@@ -28,5 +38,7 @@ export declare function tenantModelGate(options: {
     readonly root: string;
     readonly logger: Logger;
     readonly settings?: ModelCallSettings;
+    /** The Tenant's Object store, for the files a prompt names. */
+    readonly blobs?: BlobStore;
 }): ModelGate;
 export declare function inProcessModelGate(options: InProcessModelGateOptions): ModelGate;

package/dist/gates/in-process.js

@@ -1,6 +1,15 @@
 import { piModel } from "../model/pi-model.js";
 import { HostModelVault } from "../vault/host-model.js";
 import { createMeter } from "./meter.js";
+import { artifactFiles } from "../artifacts/files.js";
+/**
+ * The files a call names, from the Tenant's artifacts, limited to the call's session: in
+ * process, the loop's own request; over HTTP, the session of the run token's claims, which the
+ * gate's route puts on the request (F5). A request without a session reads no file at all.
+ */
+export function callFiles(store, blobs) {
+    return (request) => artifactFiles({ store, blobs, sessionId: request.sessionId });
+}
 /**
  * The in-process gate of an open Tenant: reads its host model from its own vault and records
  * each call in its usage ledger. Only a Runtime without the gates service (embedding, the
@@ -13,6 +22,7 @@ export function tenantModelGate(options) {
         readHostModel: () => vault.readHostModel(),
         writeHostCredential: (credential) => vault.updateHostCredential(credential),
         ...(options.settings ? { settings: options.settings } : {}),
+        ...(options.blobs ? { files: callFiles(options.store, options.blobs) } : {}),
     });
     const meter = createMeter({ logger: options.logger });
     return {
@@ -28,6 +38,7 @@ export function inProcessModelGate(options) {
                 readHostModel: options.readHostModel,
                 writeHostCredential: options.writeHostCredential,
                 ...(options.settings ? { settings: options.settings } : {}),
+                ...(options.files ? { files: options.files(request) } : {}),
             });
             return adapter(request.call, {
                 // The Runtime never journals the provider request (harness `durable.ts`), and

package/dist/gates/inflight.d.ts

@@ -8,22 +8,41 @@
  * In memory, one gateway only (M2): a gateway restart loses these, and a re-sent call runs
  * again (the ledger flags the duplicate). Outcomes are kept `ttlMs` after they settle; a call
  * that throws (an abort) is not kept.
+ *
+ * A call sent under a run token (F5) records the session and lease epoch that started it. A
+ * re-send joins it only for the same session at the same or a newer epoch (the new owner after
+ * a takeover, G4), and a cancel stops it only for the same session.
  */
 import type { ModelGateOutcome } from "./model-gate.js";
 /** A re-send whose request differs from the call already running under its key. */
 export declare class InflightConflict extends Error {
     readonly name = "InflightConflict";
 }
+/** A re-send under an older lease epoch than the call's: never joins (G4). */
+export declare class InflightStale extends Error {
+    readonly name = "InflightStale";
+}
+/** The run a keyed call belongs to: its session and the lease epoch that sent it. */
+export interface InflightOwner {
+    readonly sessionId: string;
+    readonly epoch: number;
+}
 export interface InflightCalls<T = ModelGateOutcome> {
     /**
      * Joins the call under `key`, or starts it with `start` under the entry's own signal.
-     * Rejects with `InflightConflict` when `hash` differs from the running call's.
+     * Rejects with `InflightConflict` when `hash` differs from the running call's, or `owner`
+     * names another session than the call's, and with `InflightStale` when `owner`'s epoch is
+     * older than the call's. A call started without an owner (core's credential) is joined by
+     * hash alone.
      */
-    run(key: string, hash: string, start: (signal: AbortSignal) => Promise<T>): Promise<T>;
+    run(key: string, hash: string, start: (signal: AbortSignal) => Promise<T>, owner?: InflightOwner): Promise<T>;
     /** True while a call runs under `key`, or its outcome is still kept. */
     has(key: string): boolean;
-    /** Aborts the call under `key` and forgets it; nothing when there is none. */
-    cancel(key: string): void;
+    /**
+     * Aborts the call under `key` and forgets it; nothing when there is none. With `sessionId`
+     * (a run's cancel), returns false and leaves the call alone when it is another session's.
+     */
+    cancel(key: string, sessionId?: string): boolean;
     /** Aborts every running call (gateway shutdown). */
     close(): void;
     /** Entries held: running, or settled within the TTL. */