@nylorun/runtime 0.15.2-beta → 0.16.0-beta

package/dist/admin-openapi.json

@@ -2,16 +2,17 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime: Admin API",
-    "version": "0.15.2-beta",
+    "version": "0.16.0-beta",
     "description": "The Host's status, its Tenant's state and shutdown, with the admin key. Served on the operator listener when the Host has one; the public listener answers these routes with the opaque 404.",
     "x-nylorun-protocol": {
       "min": 4,
-      "max": 5,
+      "max": 6,
       "features": [
         "runtime-tenants",
         "admin-status",
         "studio-principal",
         "action-endpoints",
+        "artifacts",
         "tenant-fixture-model",
         "transcript-events",
         "derived-principals",
@@ -20,7 +21,9 @@
         "browser-access",
         "ag-ui-endpoint",
         "a2a-endpoint",
-        "action-endpoints"
+        "action-endpoints",
+        "sandboxes",
+        "sandbox-pods"
       ]
     }
   },
@@ -238,6 +241,31 @@
                   "lastError"
                 ],
                 "additionalProperties": false
+              },
+              "harness": {
+                "type": "object",
+                "properties": {
+                  "mode": {
+                    "type": "string",
+                    "enum": [
+                      "in-process",
+                      "remote"
+                    ]
+                  },
+                  "connected": {
+                    "type": "integer",
+                    "minimum": 0
+                  },
+                  "workspace": {
+                    "type": "boolean"
+                  }
+                },
+                "required": [
+                  "mode",
+                  "connected",
+                  "workspace"
+                ],
+                "additionalProperties": false
               }
             },
             "required": [
@@ -306,6 +334,12 @@
               "request_rejected",
               "invalid_request",
               "subject_required",
+              "sandbox_not_granted",
+              "sandbox_busy",
+              "sandbox_unavailable",
+              "placement_refused",
+              "sandbox_lost",
+              "sandbox_expired",
               "internal_error"
             ]
           },

package/dist/api/a2a/tasks.js

@@ -86,7 +86,12 @@ export function historyOf(events, contextId, taskId) {
         const payload = (event.payload ?? {});
         switch (event.type) {
             case "command.message":
-                add(clientMessageId(event), "ROLE_USER", ["content" in payload ? { text: String(payload.content) } : valuePart(payload.data)]);
+                add(clientMessageId(event), "ROLE_USER", "content" in payload
+                    ? [{ text: String(payload.content) }]
+                    : Array.isArray(payload.parts)
+                        ? // Parts (protocol 6): text as text, a file part as its artifact reference.
+                            payload.parts.map((part) => part.type === "text" ? valuePart(part.text) : valuePart(part))
+                        : [valuePart(payload.data)]);
                 break;
             case "command.respond":
                 add(clientMessageId(event), "ROLE_USER", [valuePart(payload.value)]);

package/dist/api/ag-ui/history.js

@@ -11,7 +11,12 @@ export function messagesFromEvents(items) {
                 // The AG-UI endpoint sends the client's message id as the idempotency key.
                 id: p.idempotencyKey ?? raw.eventId,
                 role: "user",
-                content: typeof p.content === "string" ? p.content : JSON.stringify(p.data),
+                content: typeof p.content === "string"
+                    ? p.content
+                    : Array.isArray(p.parts)
+                        ? // A message with parts (protocol 6): its text; files are artifacts, not text.
+                            p.parts.flatMap((part) => (typeof part.text === "string" ? [part.text] : [])).join("\n")
+                        : JSON.stringify(p.data),
             });
             sawAssistant = false;
             continue;

package/dist/api/ag-ui/routes.js

@@ -33,6 +33,7 @@ import { fail, HttpError } from "../../tenant/http.js";
 import { observeSession, readHistory, StreamClosed, } from "../../tenant/session-streams.js";
 import { putSession, sessionView } from "../../tenant/sessions.js";
 import { mayUseAgent } from "../../tenant/tokens.js";
+import { sandboxGrantsOf } from "../../tenant/sandboxes.js";
 const HEARTBEAT_MS = 15_000;
 const TERMINAL = new Set([
     "turn.completed",
@@ -244,7 +245,10 @@ export async function startRun(ctx, scope, agentId, caller, body, response) {
         agentId,
         ownerUserId: caller.subject,
         ...sessionOptions(input, scope),
-    }, caller.access, { createOnly: true });
+    }, caller.access, {
+        createOnly: true,
+        ...(sandboxGrantsOf(scope) === undefined ? {} : { sandboxGrants: sandboxGrantsOf(scope) }),
+    });
     const translator = new RunTranslator(input.threadId, input.runId);
     let cursor;
     try {