@nylorun/runtime 0.15.1-beta → 0.16.0-beta

package/dist/tenant/commands.js

@@ -25,10 +25,12 @@ import { lockedSession, } from "./context.js";
 import { fail } from "./http.js";
 import { accessOf } from "./auth.js";
 import { chargeTurn } from "./subject-limits.js";
+import { checkSandboxTurn } from "./sandboxes.js";
 import { actionTarget, rebaseSessionState, turnManifestOf, variantStore, } from "./session.js";
-import { signalSessionCancel } from "./streams.js";
+import { signalActionOutcome, signalSessionCancel } from "./streams.js";
 import { toolIds } from "./transcript.js";
 import { slimModelEffects } from "./slim.js";
+import { resolveMessageParts } from "../artifacts/parts.js";
 /** `outcome`, or a failed one when a tool's output does not match its stored output schema. */
 export function acceptedOutcome(action, outcome) {
     if (action.kind !== "tool" || !action.outputSchema)
@@ -178,6 +180,9 @@ export async function command(ctx, id, input, scope) {
             if (command.type === "message") {
                 if (!["idle", "completed", "failed", "cancelled"].includes(s.status))
                     fail(409, "Session has active or unresolved work");
+                // Every turn start on a sandbox: it exists, the token's `sbx` reaches it, and no other
+                // session's turn holds it. Before the charge, so a refused turn costs nothing.
+                await checkSandboxTurn(t, s, scope, ctx);
                 // After the replay check above, so a retried message is never charged twice.
                 if (scope.kind === "token" && scope.limits)
                     await chargeTurn(t, scope.subject, scope.limits);
@@ -186,8 +191,17 @@ export async function command(ctx, id, input, scope) {
                 if (s.history?.snapshot !== undefined)
                     s.history = { ...s.history, from: s.history.snapshot };
                 s.activeTurnId = randomUUID();
+                // File parts name artifacts the caller may read; each is pinned to a version now.
+                const parts = "parts" in command
+                    ? await resolveMessageParts(t, command.parts, id, accessOf(scope))
+                    : undefined;
+                const data = "data" in command ? command.data : undefined;
                 if (isWorkflowManifest(s.manifest)) {
-                    const input = "content" in command ? command.content : command.data;
+                    const input = "content" in command
+                        ? command.content
+                        : parts
+                            ? { parts: parts.pinned }
+                            : data;
                     s.checkpoint = createFlowCheckpoint({
                         manifest: s.manifest,
                         sessionId: id,
@@ -214,9 +228,11 @@ export async function command(ctx, id, input, scope) {
                             turnId: s.activeTurnId,
                             input: "content" in command
                                 ? command.content
-                                : typeof command.data === "string"
-                                    ? command.data
-                                    : JSON.stringify(command.data),
+                                : parts
+                                    ? { content: parts.engine }
+                                    : typeof data === "string"
+                                        ? data
+                                        : JSON.stringify(data),
                             state: s.state,
                             info: s.info,
                         });
@@ -334,6 +350,15 @@ export async function recordActionOutcome(t, ctx, s, action, received, options =
         dedupeKey: `action_result:${action.turnId}:${action.actionId}:${action.generation}`,
     };
     t.afterCommit(() => ctx.wake(s.id, resultWake));
+    // A run held while the Action was pending goes on with it in the same lease (F6.2): here, or
+    // on the process whose harness holds it. The wake finds the session settled, or resumes it
+    // by replay when the run had already ended.
+    t.afterCommit(() => {
+        if (ctx.harness.holds(s.id))
+            ctx.harness.resolved(s.id, action.actionId, outcome);
+        else
+            signalActionOutcome(ctx, s.id, action.actionId);
+    });
     const event = await t.event(s.id, s.activeTurnId, "action.completed", {
         actionId: action.actionId,
         ...actionTarget(action),

package/dist/tenant/context.d.ts

@@ -27,12 +27,18 @@ import type { Keys } from "../keys/keys.js";
 import type { VaultService } from "../vault/service.js";
 import type { McpPool } from "../mcp/pool.js";
 import type { McpDiagnostic, McpSnapshot } from "../mcp/snapshot.js";
-import type { SandboxManager } from "../sandbox/manager.js";
+import type { HarnessApiServer } from "../harness-api/server.js";
+import type { WorkspacePort } from "../harness-api/workspace.js";
+import type { SandboxesClient } from "../sandbox/pods/client.js";
+import type { SandboxSignal } from "../execution/types.js";
 import type { TenantConfig } from "./types.js";
 import type { SessionStreams } from "./session-streams.js";
 import type { StuckInvocation, Wake } from "../execution/types.js";
 import type { WorkState } from "./scheduler.js";
 import type { SigningKeys } from "./signing-keys.js";
+import type { BlobStore } from "../blob/index.js";
+import type { WorkspaceReader } from "../artifacts/workspace.js";
+import type { RunGrants } from "./run-grants.js";
 export interface Session {
     id: string;
     agentId: string;
@@ -70,14 +76,19 @@ export interface Session {
     mcpDiagnostics?: readonly McpDiagnostic[];
     /** Session id that keys the shared sandbox; absent means this session owns it. */
     sandboxOwnerId?: string;
+    /**
+     * The sandbox resource the session is attached to (`sandbox: { id }`): its workspace is the
+     * sandbox's, shared with every session attached to it, and it outlives the session.
+     */
+    sandboxId?: string;
     /**
      * The sandbox chosen when the session was opened, resolved against the Tenant's limits, or
      * inherited from the session it shares with. Absent when the session has no sandbox or its
      * definition declares one (`.sandbox()`).
      */
     sandbox?: SandboxManifest;
-    /** Where `sandbox` came from. */
-    sandboxSource?: "default" | "inline" | "shared";
+    /** Where `sandbox` came from: `sandbox` is a sandbox resource's spec. */
+    sandboxSource?: "default" | "inline" | "shared" | "sandbox";
 }
 export type AuthScope = {
     kind: "application";
@@ -94,6 +105,8 @@ export type AuthScope = {
     agents: ReadonlySet<string> | "*";
     role: string;
     limits?: RoleLimits;
+    /** The token's `sbx` grants: the sandboxes it reaches. Absent reaches none. */
+    sandboxes?: readonly string[];
     epoch: number;
     expiresAt: number;
     tokenId: string;
@@ -138,8 +151,16 @@ export interface TenantContext {
     readonly envelope: TenantEnvelope;
     readonly store: SessionStore;
     readonly vault: VaultService;
-    readonly mcp: McpPool;
-    readonly sandbox: SandboxManager;
+    /**
+     * The MCP pool of the Tenant's in-process harness. Absent when harnesses run elsewhere
+     * (`NYLORUN_HARNESS=remote`): each keeps its own (F6.2).
+     */
+    readonly mcp?: McpPool;
+    /**
+     * The workspace capability (F6.2): the Tenant's SandboxManager with an in-process harness,
+     * else the harness that serves workspaces (`harness-api/workspace.ts`).
+     */
+    readonly sandbox: WorkspacePort;
     readonly flowLimits: FlowLimits;
     readonly modelProvider: ModelProvider;
     /** True when the model comes from the Tenant vault selection, served by `modelGate`. */
@@ -157,6 +178,28 @@ export interface TenantContext {
      * `signingKeys`' private key.
      */
     readonly keys: Keys;
+    /**
+     * The Object store's `BlobStore` seam (D35): the Host's `s3` store (RustFS in the local
+     * stack), or the `fs` store under `paths.blobs` without one. Bytes only; Postgres holds what
+     * they mean, and a blob counts once a committed row names its key.
+     */
+    readonly blobs: BlobStore;
+    /**
+     * How core reads a session's sandbox workspace at turn end, to export its outputs (F8.2): over
+     * this process's `sandbox` today; over the Harness API's `workspace.read` from F6.2.
+     */
+    readonly workspaces: WorkspaceReader;
+    /**
+     * The run token of each session an advance of this process owns (F5): the credential the
+     * HTTP gate clients present for that session's model and MCP calls (`run-grants.ts`).
+     * Absent when the gates run in this process, which needs no token (G6).
+     */
+    readonly runGrants?: RunGrants;
+    /**
+     * The Harness API server (D37): advances offer their segments here, and the Tenant's
+     * harnesses (the in-process one, or attached ones) run them.
+     */
+    readonly harness: HarnessApiServer;
     /** Set by drain/close; reset clears it again. Stops new advances. */
     closing: boolean;
     /** Set once close has finished releasing resources. */
@@ -187,6 +230,16 @@ export interface TenantContext {
      * from `t.afterCommit`. Dropped while the Tenant is closing; the sweep re-sends it.
      */
     deliver(actionId: string): Promise<void>;
+    /**
+     * Sandbox pods (F7.2): the sandboxes service and the Runtime image pods copy the engine from.
+     * Absent without a cluster (`nylorun sandbox enable`): kind `pod` is `sandbox_unavailable`.
+     */
+    readonly pods?: TenantPods;
+    /**
+     * Seam: reconcile a pod sandbox, or arm one of its timers (`DurableExecution.sandbox`). Call
+     * it from `t.afterCommit`. Dropped while the Tenant is closing; the sweep re-sends reconciles.
+     */
+    sandboxSignal(sandboxId: string, signal: SandboxSignal): Promise<void>;
     /** This Tenant's execution invocations that need an operator, for Tenant status. */
     readonly stuckInvocations?: () => Promise<StuckInvocation[]>;
     /** Callbacks the Tenant sweep runs after its own steps (`sweep.ts`). */
@@ -225,3 +278,9 @@ export declare function loadSession(ctx: TenantContext, id: string, access?: Ses
  * the sandbox-sharing helpers, which walk that chain synchronously.
  */
 export declare function sandboxLookup(t: Tx, start: string | undefined): Promise<(id: string) => Session | undefined>;
+/** The sandboxes service a Tenant drives its pod sandboxes with (`TenantContext.pods`). */
+export interface TenantPods {
+    readonly client: SandboxesClient;
+    /** The Runtime image the pods copy the engine from (`NYLORUN_SANDBOX_HARNESS_IMAGE`). */
+    readonly harnessImage: string;
+}

package/dist/tenant/effects.d.ts

@@ -1,18 +1,27 @@
+/**
+ * Core's side of effects: `resolveNewFlowEffect` journals and dispatches new workflow effects
+ * (linked agent sessions, tool nodes, fn, verify); the takeover helpers say which calls their
+ * gate recovers. Also vault authorization for MCP servers. The journal of a run's effects is
+ * `harness-api/record.ts`; a harness readies the session's MCP servers itself (`session.mcp`).
+ *
+ * Every journal write runs in a transaction that locks the effect's session first and checks
+ * the advance's ownership epoch (`ownedSession`): after another Worker takes over, the next
+ * write throws `ownership.lost` and nothing is written. The model, MCP, sandbox and vault
+ * calls run between transactions, never inside one.
+ */
+import type { ActionOutcome } from "@nylorun/core/contracts";
 import type { EffectResolution, HostEffect } from "@nylorun/harness/run";
+import type { Tx } from "../store/types.js";
 import type { AuthorizeResult } from "../vault/service.js";
 import { type Lease, type Session, type TenantContext } from "./context.js";
-import type { ModelProvider } from "../core/provider.js";
-/** What one advance's segment decides for all its effects. */
-export interface SegmentOptions {
-    /** Overrides the Tenant's model (the fixture-model Tenant setting, `model-setting.ts`). */
-    model?: ModelProvider;
-}
 /**
- * Call the model for one effect. A provider failure comes back as a failure outcome
- * (Model Calls §6), whichever provider serves the call; only an abort throws, and the
- * advance decides what the abort means.
+ * The outcome of a flow `agent` effect once the linked turn it started ended, or undefined
+ * while it has not. The linked session may still show an earlier iteration's turn.
  */
-export declare function invokeModel(ctx: TenantContext, request: HostEffect, signal: AbortSignal, model?: ModelProvider): Promise<unknown>;
+export declare function linkedOutcome(t: Tx, effect: {
+    request: HostEffect;
+    agentSessionId?: string;
+}, agent: Session | undefined): Promise<ActionOutcome | undefined>;
 /**
  * True when this Tenant's remote MCP calls outlive the process that sent them (the gates
  * service, F4.1 G3): after a takeover or a shutdown, the journaled call is re-sent and joins
@@ -27,11 +36,8 @@ export declare function isRemoteMcpEffect(s: Session, request: HostEffect): bool
  * the running call or gets its outcome, instead of becoming `uncertain`.
  */
 export declare function recoversModelCalls(ctx: TenantContext): boolean;
-export declare function resolveEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease, segment?: SegmentOptions): Promise<EffectResolution>;
 /** Journal and dispatch a new flow effect (agent / tool node / fn / verify). */
 export declare function resolveNewFlowEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease): Promise<EffectResolution>;
-/** Discover the session's MCP tools once, or reconnect and refresh diagnostics. */
-export declare function prepareMcp(ctx: TenantContext, lease: Lease, signal: AbortSignal): Promise<void>;
 /** Vault authorization for an MCP server request made on behalf of a session. */
 export declare function authorize(ctx: TenantContext, sessionId: string, request: {
     url: string;