@nylorun/runtime 0.15.2-beta → 0.17.0-beta

package/dist/adapters/sandbox/local.js

@@ -0,0 +1,195 @@
+/**
+ * Local backend (F7.2): the workspace of the pod sandbox the engine runs in. The pod is the
+ * boundary (its own user, no capabilities, a read-only root, a NetworkPolicy that lets it reach
+ * only the Harness API, the gates and egress-gate), so commands run as plain child processes:
+ * `/bin/sh -c <command>` in `/workspace`, its own process group, killed whole on a timeout or a
+ * cancel. Files are read and written with `fs`. Egress goes through egress-gate: every command
+ * gets `HTTPS_PROXY`/`HTTP_PROXY` with the sandbox's current egress token as the proxy password
+ * (`proxyEnv`), and nothing of the engine's own environment (`NYLORUN_*`).
+ *
+ * One pod holds one sandbox: every key opens the same `/workspace`. Removing a workspace is the
+ * sandbox's reset or delete (a new volume), so `remove` and `list` do nothing here.
+ */
+import { spawn } from "node:child_process";
+import { accessSync, constants } from "node:fs";
+import { lstat, readdir, readFile, stat, writeFile } from "node:fs/promises";
+import { posix } from "node:path";
+import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
+import { SandboxFileTooLargeError } from "../../sandbox/types.js";
+/** The most of each stream kept from one command (the tools keep 30 000 characters of it). */
+const STREAM_LIMIT = 4 * 1024 * 1024;
+/** This process's environment without the engine's own variables. */
+function baseEnv(env, workspace) {
+    const out = {};
+    for (const [name, value] of Object.entries(env))
+        if (value !== undefined && !name.startsWith("NYLORUN_") && !/_PROXY$/i.test(name))
+            out[name] = value;
+    return { PATH: "/usr/local/bin:/usr/bin:/bin", LANG: "C.UTF-8", TERM: "dumb", ...out, HOME: workspace };
+}
+/** Collects a stream, keeping at most `STREAM_LIMIT` bytes (head first). */
+function collector() {
+    const chunks = [];
+    let size = 0;
+    let dropped = 0;
+    return {
+        push(chunk) {
+            if (size >= STREAM_LIMIT) {
+                dropped += chunk.length;
+                return;
+            }
+            const room = STREAM_LIMIT - size;
+            const kept = chunk.length > room ? chunk.subarray(0, room) : chunk;
+            chunks.push(kept);
+            size += kept.length;
+            dropped += chunk.length - kept.length;
+        },
+        text() {
+            const text = Buffer.concat(chunks).toString("utf8");
+            return dropped > 0 ? `${text}\n… [${dropped} bytes dropped]` : text;
+        },
+    };
+}
+export function localBackend(options) {
+    const workspace = options.workspace ?? SANDBOX_WORKSPACE;
+    const env = baseEnv(options.env, workspace);
+    const exec = (request, signal) => new Promise((resolve, reject) => {
+        if (signal.aborted)
+            return reject(signal.reason ?? new Error("Turn cancelled"));
+        const child = spawn("/bin/sh", ["-c", request.command], {
+            cwd: request.cwd,
+            env: { ...env, ...(options.proxyEnv?.() ?? {}) },
+            stdio: ["ignore", "pipe", "pipe"],
+            // Its own process group, so a timeout or a cancel kills everything it started.
+            detached: true,
+        });
+        const stdout = collector();
+        const stderr = collector();
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        let killed = false;
+        let timedOut = false;
+        const kill = () => {
+            if (killed || child.pid === undefined)
+                return;
+            killed = true;
+            try {
+                process.kill(-child.pid, "SIGKILL");
+            }
+            catch {
+                child.kill("SIGKILL");
+            }
+        };
+        const timer = setTimeout(() => {
+            timedOut = true;
+            kill();
+        }, request.timeoutMs);
+        const onAbort = () => kill();
+        signal.addEventListener("abort", onAbort, { once: true });
+        child.once("error", (error) => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", onAbort);
+            reject(error);
+        });
+        child.once("close", (code, by) => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", onAbort);
+            resolve({
+                exitCode: killed ? (timedOut ? 124 : 130) : (code ?? (by ? 128 : 1)),
+                stdout: stdout.text(),
+                stderr: stderr.text(),
+                killed,
+                timedOut,
+            });
+        });
+    });
+    const missing = (error) => error?.code === "ENOENT" || error?.code === "ENOTDIR";
+    const handle = {
+        workspace,
+        exec,
+        async readFile(path) {
+            try {
+                return await readFile(path, "utf8");
+            }
+            catch (error) {
+                if (missing(error))
+                    return undefined;
+                throw error;
+            }
+        },
+        async readBytes(path, maxBytes) {
+            let size;
+            try {
+                size = (await stat(path)).size;
+            }
+            catch (error) {
+                if (missing(error))
+                    return undefined;
+                throw error;
+            }
+            if (size > maxBytes)
+                throw new SandboxFileTooLargeError(path, size, maxBytes);
+            return new Uint8Array(await readFile(path));
+        },
+        async listFiles(dir, maxEntries) {
+            try {
+                if (!(await lstat(dir)).isDirectory())
+                    return undefined;
+            }
+            catch (error) {
+                if (missing(error))
+                    return undefined;
+                throw error;
+            }
+            const entries = [];
+            const walk = async (absolute, relative) => {
+                for (const name of (await readdir(absolute)).sort()) {
+                    const path = posix.join(absolute, name);
+                    const inFolder = relative === "" ? name : `${relative}/${name}`;
+                    const info = await lstat(path);
+                    if (info.isSymbolicLink())
+                        continue;
+                    if (info.isDirectory()) {
+                        if (!(await walk(path, inFolder)))
+                            return false;
+                    }
+                    else if (info.isFile()) {
+                        entries.push({ path: inFolder, size: info.size });
+                        if (entries.length > maxEntries)
+                            return false;
+                    }
+                }
+                return true;
+            };
+            const complete = await walk(dir, "");
+            return { entries, truncated: !complete };
+        },
+        async writeFile(path, content) {
+            await writeFile(path, content, "utf8");
+        },
+        async stop() { },
+    };
+    return {
+        name: "local",
+        isolation: "container",
+        async probe() {
+            const base = { name: "local", isolation: "container" };
+            try {
+                accessSync(workspace, constants.W_OK);
+                return { ...base, available: true, reason: `the pod sandbox's ${workspace}` };
+            }
+            catch (error) {
+                return {
+                    ...base,
+                    available: false,
+                    reason: `${workspace} is not writable: ${error instanceof Error ? error.message : String(error)}`,
+                };
+            }
+        },
+        unmet: () => undefined,
+        open: async () => handle,
+        async remove() { },
+        async list() {
+            return [];
+        },
+    };
+}

package/dist/adapters/sandbox/virtual.js

@@ -4,8 +4,9 @@
  * It is not a VM boundary; it exists so the first run and CI work on any machine.
  */
 import { mkdirSync, readdirSync, rmSync } from "node:fs";
-import { join } from "node:path";
+import { join, posix } from "node:path";
 import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
+import { SandboxFileTooLargeError } from "../../sandbox/types.js";
 const ENV = Object.freeze({
     PATH: "/usr/local/bin:/usr/bin:/bin",
     HOME: SANDBOX_WORKSPACE,
@@ -104,6 +105,40 @@ export function virtualBackend(options) {
                         return undefined;
                     return fs.readFile(path, "utf8");
                 },
+                async readBytes(path, maxBytes) {
+                    if (!(await fs.exists(path)))
+                        return undefined;
+                    const stat = await fs.stat(path);
+                    if (stat.size > maxBytes)
+                        throw new SandboxFileTooLargeError(path, stat.size, maxBytes);
+                    return fs.readFileBuffer(path);
+                },
+                async listFiles(dir, maxEntries) {
+                    if (!(await fs.exists(dir)) || !(await fs.lstat(dir)).isDirectory)
+                        return undefined;
+                    const entries = [];
+                    const walk = async (absolute, relative) => {
+                        for (const name of (await fs.readdir(absolute)).sort()) {
+                            const path = posix.join(absolute, name);
+                            const inFolder = relative === "" ? name : `${relative}/${name}`;
+                            const stat = await fs.lstat(path);
+                            if (stat.isSymbolicLink)
+                                continue;
+                            if (stat.isDirectory) {
+                                if (!(await walk(path, inFolder)))
+                                    return false;
+                            }
+                            else if (stat.isFile) {
+                                entries.push({ path: inFolder, size: stat.size });
+                                if (entries.length > maxEntries)
+                                    return false;
+                            }
+                        }
+                        return true;
+                    };
+                    const complete = await walk(dir, "");
+                    return { entries, truncated: !complete };
+                },
                 async writeFile(path, content) {
                     await fs.writeFile(path, content, "utf8");
                 },

package/dist/admin-openapi.json

@@ -2,25 +2,27 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime: Admin API",
-    "version": "0.15.2-beta",
-    "description": "The Host's status, its Tenant's state and shutdown, with the admin key. Served on the operator listener when the Host has one; the public listener answers these routes with the opaque 404.",
+    "version": "0.17.0-beta",
+    "description": "The Host's status, its Tenant's state, shutdown and the Tenant's operator keys, with the admin key. Served on the operator listener when the Host has one; the public listener answers these routes with the opaque 404.",
     "x-nylorun-protocol": {
       "min": 4,
-      "max": 5,
+      "max": 7,
       "features": [
         "runtime-tenants",
         "admin-status",
         "studio-principal",
         "action-endpoints",
+        "artifacts",
         "tenant-fixture-model",
         "transcript-events",
-        "derived-principals",
         "subject-headers",
-        "subject-tokens",
-        "browser-access",
         "ag-ui-endpoint",
         "a2a-endpoint",
-        "action-endpoints"
+        "action-endpoints",
+        "sandboxes",
+        "sandbox-pods",
+        "trusted-issuers",
+        "operator-keys"
       ]
     }
   },
@@ -238,6 +240,31 @@
                   "lastError"
                 ],
                 "additionalProperties": false
+              },
+              "harness": {
+                "type": "object",
+                "properties": {
+                  "mode": {
+                    "type": "string",
+                    "enum": [
+                      "in-process",
+                      "remote"
+                    ]
+                  },
+                  "connected": {
+                    "type": "integer",
+                    "minimum": 0
+                  },
+                  "workspace": {
+                    "type": "boolean"
+                  }
+                },
+                "required": [
+                  "mode",
+                  "connected",
+                  "workspace"
+                ],
+                "additionalProperties": false
               }
             },
             "required": [
@@ -306,6 +333,16 @@
               "request_rejected",
               "invalid_request",
               "subject_required",
+              "sandbox_not_granted",
+              "sandbox_busy",
+              "sandbox_unavailable",
+              "placement_refused",
+              "sandbox_lost",
+              "sandbox_expired",
+              "issuer_unavailable",
+              "oauth_client_required",
+              "oauth_state_invalid",
+              "oauth_failed",
               "internal_error"
             ]
           },
@@ -386,6 +423,93 @@
           "status"
         ],
         "additionalProperties": false
+      },
+      "ListOperatorKeysResponse": {
+        "type": "object",
+        "properties": {
+          "keys": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "id": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "role": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "createdAt": {
+                  "type": "string",
+                  "minLength": 1
+                }
+              },
+              "required": [
+                "id",
+                "role",
+                "createdAt"
+              ],
+              "additionalProperties": false
+            }
+          }
+        },
+        "required": [
+          "keys"
+        ],
+        "additionalProperties": false
+      },
+      "PutOperatorKeyResponse": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1
+          },
+          "role": {
+            "type": "string",
+            "minLength": 1
+          },
+          "createdAt": {
+            "type": "string",
+            "minLength": 1
+          },
+          "key": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{64}$"
+          },
+          "rotated": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "id",
+          "role",
+          "createdAt",
+          "key",
+          "rotated"
+        ],
+        "additionalProperties": false
+      },
+      "DeleteOperatorKeyResponse": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1
+          },
+          "deleted": {
+            "type": "boolean",
+            "enum": [
+              true
+            ]
+          }
+        },
+        "required": [
+          "id",
+          "deleted"
+        ],
+        "additionalProperties": false
       }
     },
     "parameters": {}
@@ -527,6 +651,216 @@
         }
       }
     },
+    "/v1/admin/keys": {
+      "get": {
+        "summary": "List the Tenant's keys",
+        "description": "Every application key of the Tenant by name, with its role and when it was issued. Keys themselves are never shown again.",
+        "tags": [
+          "Admin"
+        ],
+        "security": [
+          {
+            "adminKey": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The keys, by id",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListOperatorKeysResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found: an unknown admin key, or the public listener",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "426": {
+            "description": "`Nylorun-Protocol` missing or unsupported",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProtocolRejected"
+                }
+              }
+            }
+          },
+          "503": {
+            "description": "The Tenant is not open",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/admin/keys/{id}": {
+      "put": {
+        "summary": "Create or rotate a key",
+        "description": "Issues a new key named `id` and returns it this once. A key of that name is replaced: the old one stops authenticating at once. `studio` is refused.",
+        "tags": [
+          "Admin"
+        ],
+        "security": [
+          {
+            "adminKey": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio`"
+            },
+            "required": true,
+            "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio`",
+            "name": "id",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The new key, shown once",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PutOperatorKeyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Not a key name, or `studio`",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found: an unknown admin key, or the public listener",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "426": {
+            "description": "`Nylorun-Protocol` missing or unsupported",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProtocolRejected"
+                }
+              }
+            }
+          },
+          "503": {
+            "description": "The Tenant is not open",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          }
+        }
+      },
+      "delete": {
+        "summary": "Delete a key",
+        "description": "The key stops authenticating at once. `studio` is refused.",
+        "tags": [
+          "Admin"
+        ],
+        "security": [
+          {
+            "adminKey": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio`"
+            },
+            "required": true,
+            "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio`",
+            "name": "id",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The key is deleted",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DeleteOperatorKeyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Not a key name, or `studio`",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "No key of that name; or an unknown admin key, or the public listener",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "426": {
+            "description": "`Nylorun-Protocol` missing or unsupported",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProtocolRejected"
+                }
+              }
+            }
+          },
+          "503": {
+            "description": "The Tenant is not open",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/v1/admin/openapi.json": {
       "get": {
         "summary": "Get this document",

package/dist/api/a2a/tasks.js

@@ -86,7 +86,12 @@ export function historyOf(events, contextId, taskId) {
         const payload = (event.payload ?? {});
         switch (event.type) {
             case "command.message":
-                add(clientMessageId(event), "ROLE_USER", ["content" in payload ? { text: String(payload.content) } : valuePart(payload.data)]);
+                add(clientMessageId(event), "ROLE_USER", "content" in payload
+                    ? [{ text: String(payload.content) }]
+                    : Array.isArray(payload.parts)
+                        ? // Parts (protocol 6): text as text, a file part as its artifact reference.
+                            payload.parts.map((part) => part.type === "text" ? valuePart(part.text) : valuePart(part))
+                        : [valuePart(payload.data)]);
                 break;
             case "command.respond":
                 add(clientMessageId(event), "ROLE_USER", [valuePart(payload.value)]);

package/dist/api/ag-ui/endpoint.js

@@ -29,7 +29,6 @@ function registerComponents(api) {
 const FOR_A_PERSON = {
     credentials: ["subject", "token"],
     scopes: ["sessions:own"],
-    browser: true,
 };
 const events = (description) => ({
     description,
@@ -50,7 +49,7 @@ export function agUiRoutes(api) {
         path: "/v1/ag-ui/agents/{agentId}",
         tags: TAGS,
         summary: "Run an agent",
-        description: "For a person, named by a subject token or by `Nylorun-Subject`. The thread is one session per person, agent and thread, created on its first run with `forwardedProps.nylorun.session`. The trailing user message starts a turn (its id is the idempotency key); `resume` answers interrupts. A busy session or a turn limit is a `RUN_ERROR` in the stream.",
+        description: "For a person, named by a trusted issuer's token or by `Nylorun-Subject`. The thread is one session per person, agent and thread, created on its first run with `forwardedProps.nylorun.session`. The trailing user message starts a turn (its id is the idempotency key); `resume` answers interrupts. A busy session is a `RUN_ERROR` in the stream.",
         request: {
             params: agentId,
             body: {

package/dist/api/ag-ui/history.js

@@ -11,7 +11,12 @@ export function messagesFromEvents(items) {
                 // The AG-UI endpoint sends the client's message id as the idempotency key.
                 id: p.idempotencyKey ?? raw.eventId,
                 role: "user",
-                content: typeof p.content === "string" ? p.content : JSON.stringify(p.data),
+                content: typeof p.content === "string"
+                    ? p.content
+                    : Array.isArray(p.parts)
+                        ? // A message with parts (protocol 6): its text; files are artifacts, not text.
+                            p.parts.flatMap((part) => (typeof part.text === "string" ? [part.text] : [])).join("\n")
+                        : JSON.stringify(p.data),
             });
             sawAssistant = false;
             continue;