@nylorun/runtime 0.17.0-beta → 0.19.0-beta

package/dist/mcp/connect.d.ts

@@ -1,5 +1,6 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import type { McpServerManifest } from "@nylorun/core/define";
+import { type OutboundPolicy } from "../tenant/outbound.js";
 import type { AuthorizeResult } from "../vault/service.js";
 import { type McpDiagnostic, type McpToolRecord } from "./snapshot.js";
 /** Options of one MCP request. */
@@ -47,10 +48,13 @@ export interface LiveConnection {
 export declare function sdkClient(client: Client): McpClient;
 export declare function openMcpServer(input: {
     server: McpServerManifest;
-    authorize?: (url: string) => Promise<AuthorizeResult>;
-    pluginRoot?: string;
-    pluginData: string;
-    childEnv?: Readonly<Record<string, string>>;
+    authorize: (url: string) => Promise<AuthorizeResult>;
+    /**
+     * How a remote server is reached: the Host's address policy for developer URLs
+     * (`TenantConfig.delivery`), so `localhost` means the Docker host in the local stack and a
+     * Host that refuses private addresses refuses them here too. Default: no limits.
+     */
+    policy?: OutboundPolicy;
 }): Promise<LiveConnection>;
 export declare function listMcpTools(client: McpClient, input: {
     capabilityId: string;

package/dist/mcp/connect.js

@@ -1,10 +1,9 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { schemaFromJSON } from "@nylorun/core/define";
+import { guardedFetch } from "../tenant/outbound.js";
 import { modelToolName, } from "./snapshot.js";
-import { prepareStdioLaunch } from "./stdio.js";
 /** An SDK `Client` as an `McpClient`. */
 export function sdkClient(client) {
     return {
@@ -13,28 +12,7 @@ export function sdkClient(client) {
     };
 }
 export async function openMcpServer(input) {
-    if (input.server.type === "stdio") {
-        const launch = prepareStdioLaunch(input.server, {
-            pluginRoot: input.pluginRoot,
-            pluginData: input.pluginData,
-            childEnv: input.childEnv,
-        });
-        const transport = new StdioClientTransport({
-            command: launch.command,
-            args: [...launch.args],
-            cwd: launch.cwd,
-            // Full explicit env so HOME/TMPDIR from the Tenant override getDefaultEnvironment().
-            env: { ...launch.env },
-            stderr: "pipe",
-        });
-        transport.stderr?.on("data", () => { });
-        const client = createClient();
-        await client.connect(transport);
-        return { client: sdkClient(client), close: () => client.close() };
-    }
     const authorize = input.authorize;
-    if (!authorize)
-        throw new Error("HTTP MCP server requires authorization");
     const initial = await authorize(input.server.url);
     if (initial.status === "refused") {
         const error = new Error(`MCP authorization refused: ${initial.reason}`);
@@ -42,7 +20,7 @@ export async function openMcpServer(input) {
             initial.credentialIds;
         throw error;
     }
-    const fetchImpl = authorizedFetch(input.server, authorize);
+    const fetchImpl = authorizedFetch(input.server, authorize, input.policy ?? {});
     const url = new URL(input.server.url);
     const transport = input.server.type === "sse"
         ? new SSEClientTransport(url, { fetch: fetchImpl })
@@ -145,7 +123,8 @@ export function diagnosticFromError(capabilityId, serverName, error) {
 function createClient() {
     return new Client({ name: "nylorun-runtime", version: "0.6.0" }, { capabilities: {} });
 }
-function authorizedFetch(server, authorize) {
+function authorizedFetch(server, authorize, policy) {
+    const send = guardedFetch(policy, { stream: true });
     return async (url, init) => {
         const target = typeof url === "string" ? url : url.href;
         if (!sameOrigin(target, server.url))
@@ -164,7 +143,8 @@ function authorizedFetch(server, authorize) {
         if (result.status === "authorized")
             for (const [key, value] of Object.entries(result.headers))
                 headers.set(key, value);
-        return fetch(target, { ...init, headers, redirect: "error" });
+        // No redirects, and the address checked on what is connected to (`tenant/outbound.ts`).
+        return send(target, { ...init, headers });
     };
 }
 function sameOrigin(requestUrl, serverUrl) {

package/dist/mcp/pool.d.ts

@@ -1,4 +1,5 @@
 import type { AgentManifest, McpServerManifest } from "@nylorun/core/define";
+import type { OutboundPolicy } from "../tenant/outbound.js";
 import type { AuthorizeResult } from "../vault/service.js";
 import { callMcpTool, openMcpServer, type LiveConnection } from "./connect.js";
 import { type McpDiagnostic, type McpSnapshot, type McpToolRecord } from "./snapshot.js";
@@ -13,9 +14,6 @@ export declare class McpPool {
     private readonly now;
     private readonly open;
     constructor(options: {
-        /** Absolute Tenant `plugin-data` directory. */
-        readonly pluginData: string;
-        readonly childEnv: Readonly<Record<string, string>>;
         readonly authorize: (sessionId: string, request: {
             url: string;
             serverName: string;
@@ -26,11 +24,12 @@ export declare class McpPool {
         readonly now?: () => number;
         /** Tests replace how a declared server is opened. */
         readonly open?: typeof openMcpServer;
+        /** How remote servers opened in this process are reached (`TenantConfig.delivery`). */
+        readonly policy?: OutboundPolicy;
         /**
          * Opens a remote (`streamable-http` or `sse`) server somewhere else: the gates service
          * holds the connection and its credential, and the loop never sees either (F4.1).
-         * Absent: remote servers are opened in this process, with `authorize`. Stdio servers
-         * always run here.
+         * Absent: they are opened in this process, with `authorize`.
          */
         readonly openRemote?: (server: McpServerRef) => Promise<LiveConnection>;
     });
@@ -38,7 +37,6 @@ export declare class McpPool {
         sessionId: string;
         manifest: AgentManifest;
         manifestHash: string;
-        pluginRoots: Readonly<Record<string, string>>;
         signal?: AbortSignal;
     }): Promise<{
         snapshot: McpSnapshot;
@@ -47,7 +45,6 @@ export declare class McpPool {
     reconnect(input: {
         sessionId: string;
         manifest: AgentManifest;
-        pluginRoots: Readonly<Record<string, string>>;
         tools: readonly McpToolRecord[];
         signal?: AbortSignal;
     }): Promise<McpDiagnostic[]>;
@@ -59,14 +56,13 @@ export declare class McpPool {
         serverToolName: string;
         args: unknown;
         manifest: AgentManifest;
-        pluginRoots: Readonly<Record<string, string>>;
         /** The effect id: a gate runs the call once under it (F4.1). */
         effectId?: string;
         signal?: AbortSignal;
     }): Promise<Awaited<ReturnType<typeof callMcpTool>>>;
     /**
      * Closes connections unused for the idle timeout (the Tenant sweep). A session that calls
-     * one again reconnects, as after a restart; this bounds the stdio processes a Tenant keeps.
+     * one again reconnects, as after a restart; this bounds the connections a Tenant keeps.
      */
     sweep(): Promise<void>;
     close(): Promise<void>;

package/dist/mcp/pool.js

@@ -1,4 +1,3 @@
-import { join } from "node:path";
 import { delegatesOf } from "@nylorun/core/define";
 import { callMcpTool, diagnosticFromError, listMcpTools, openMcpServer, } from "./connect.js";
 import { declaredToolNames, } from "./snapshot.js";
@@ -131,7 +130,7 @@ export class McpPool {
     }
     /**
      * Closes connections unused for the idle timeout (the Tenant sweep). A session that calls
-     * one again reconnects, as after a restart; this bounds the stdio processes a Tenant keeps.
+     * one again reconnects, as after a restart; this bounds the connections a Tenant keeps.
      */
     async sweep() {
         const now = this.now();
@@ -173,7 +172,7 @@ export class McpPool {
     }
     async connectDeclared(input, declared) {
         try {
-            if (declared.server.type !== "stdio" && this.options.openRemote) {
+            if (this.options.openRemote) {
                 const connection = await this.options.openRemote({
                     sessionId: input.sessionId,
                     ...ownerOf(declared),
@@ -184,16 +183,12 @@ export class McpPool {
             }
             const connection = await this.open({
                 server: declared.server,
-                pluginRoot: input.pluginRoots[pluginKey(declared)],
-                pluginData: join(this.options.pluginData, ...pluginKey(declared).split("/")),
-                childEnv: this.options.childEnv,
-                authorize: declared.server.type === "stdio"
-                    ? undefined
-                    : (url) => this.options.authorize(input.sessionId, {
-                        url,
-                        serverName: declared.server.name,
-                        ...ownerOf(declared),
-                    }),
+                ...(this.options.policy ? { policy: this.options.policy } : {}),
+                authorize: (url) => this.options.authorize(input.sessionId, {
+                    url,
+                    serverName: declared.server.name,
+                    ...ownerOf(declared),
+                }),
             });
             return { ok: true, connection };
         }
@@ -228,12 +223,6 @@ export function findServer(manifest, agentId, capabilityId, serverName) {
         item.capabilityId === capabilityId &&
         item.server.name === serverName);
 }
-/** Plugin roots of agents used as tools are registered as `<agent>/<capability>`. */
-function pluginKey(declared) {
-    return declared.agentId === undefined
-        ? declared.capabilityId
-        : `${declared.agentId}/${declared.capabilityId}`;
-}
 function ownerOf(declared) {
     return declared.agentId === undefined ? {} : { agentId: declared.agentId };
 }

package/dist/mcp/snapshot.d.ts

@@ -1,3 +1,4 @@
+import type { EventPayload } from "@nylorun/core/contracts";
 import type { JsonObject } from "@nylorun/core/define";
 import { type AgentManifest } from "@nylorun/core/define";
 import type { DurableSessionTool, HostEffect } from "@nylorun/harness/run";
@@ -26,10 +27,15 @@ export interface McpDiagnostic {
     readonly message: string;
     readonly credentialIds?: readonly string[];
 }
+/** The `mcp.discovered` payload: each server's outcome, with the tools it added to the snapshot. */
+export declare function mcpDiscovered(snapshot: McpSnapshot, diagnostics: readonly McpDiagnostic[]): EventPayload<"mcp.discovered">;
 export declare function modelToolName(serverName: string, serverToolName: string): string;
 export declare function declaredToolNames(manifest: AgentManifest): Set<string>;
-/** The tools of a snapshot, as the engine advertises them. */
-export declare function sessionToolsOf(snapshot: McpSnapshot | undefined): readonly DurableSessionTool[] | undefined;
+/**
+ * The tools of a snapshot, as the engine advertises them. A tool of a server whose `approval` is
+ * `always` in the session's `manifest` waits for approval on each call.
+ */
+export declare function sessionToolsOf(snapshot: McpSnapshot | undefined, manifest: AgentManifest): readonly DurableSessionTool[] | undefined;
 /** The snapshot's record of an MCP tool call, or undefined when the call is not an MCP tool. */
 export declare function mcpToolOf(snapshot: McpSnapshot | undefined, request: Pick<HostEffect, "agent" | "capabilityId" | "toolName">): McpToolRecord | undefined;
 /** The manifest of the agent an effect belongs to: the root, or an agent it uses as a tool. */

package/dist/mcp/snapshot.js

@@ -1,4 +1,22 @@
 import { delegateManifest } from "@nylorun/core/define";
+/** The `mcp.discovered` payload: each server's outcome, with the tools it added to the snapshot. */
+export function mcpDiscovered(snapshot, diagnostics) {
+    const key = (item) => JSON.stringify([item.agentId ?? null, item.capabilityId, item.serverName]);
+    const tools = new Map();
+    for (const tool of snapshot.mcpTools)
+        tools.set(key(tool), (tools.get(key(tool)) ?? 0) + 1);
+    return {
+        servers: diagnostics.map((item) => ({
+            ...(item.agentId === undefined ? {} : { agentId: item.agentId }),
+            capabilityId: item.capabilityId,
+            serverName: item.serverName,
+            outcome: item.outcome,
+            message: item.message,
+            tools: tools.get(key(item)) ?? 0,
+            ...(item.credentialIds === undefined ? {} : { credentialIds: [...item.credentialIds] }),
+        })),
+    };
+}
 export function modelToolName(serverName, serverToolName) {
     return `${serverName}__${serverToolName}`;
 }
@@ -9,10 +27,18 @@ export function declaredToolNames(manifest) {
             names.add(tool.name);
     return names;
 }
-/** The tools of a snapshot, as the engine advertises them. */
-export function sessionToolsOf(snapshot) {
+/**
+ * The tools of a snapshot, as the engine advertises them. A tool of a server whose `approval` is
+ * `always` in the session's `manifest` waits for approval on each call.
+ */
+export function sessionToolsOf(snapshot, manifest) {
     if (!snapshot?.mcpTools.length)
         return undefined;
+    const approved = (tool) => {
+        const agent = tool.agentId === undefined ? manifest : delegateManifest(manifest, tool.agentId);
+        const server = agent?.capabilities.find((item) => item.id === tool.capabilityId)?.mcpServers?.[tool.serverName];
+        return server !== undefined && "approval" in server && server.approval === "always";
+    };
     return snapshot.mcpTools.map((tool) => ({
         ...(tool.agentId === undefined ? {} : { agentId: tool.agentId }),
         capabilityId: tool.capabilityId,
@@ -24,6 +50,7 @@ export function sessionToolsOf(snapshot) {
         ...(tool.outputSchema === undefined
             ? {}
             : { outputSchema: tool.outputSchema }),
+        ...(approved(tool) ? { approval: "always" } : {}),
     }));
 }
 /** The snapshot's record of an MCP tool call, or undefined when the call is not an MCP tool. */

package/dist/media.d.ts

@@ -1,5 +1,5 @@
 /**
- * Image checks for code that handles image bytes itself (an image tool in an Action endpoint):
+ * Image checks for code that handles image bytes itself (a service behind an HTTP tool):
  * the supported types, the size cap and a signature check. Storing images is the job of file
  * artifacts (`artifacts/`, protocol 6), which replaced `MediaStore`.
  */

package/dist/media.js

@@ -1,5 +1,5 @@
 /**
- * Image checks for code that handles image bytes itself (an image tool in an Action endpoint):
+ * Image checks for code that handles image bytes itself (a service behind an HTTP tool):
  * the supported types, the size cap and a signature check. Storing images is the job of file
  * artifacts (`artifacts/`, protocol 6), which replaced `MediaStore`.
  */

package/dist/model/pi-model.js

@@ -207,6 +207,9 @@ export function piModel(options = {}) {
             evidence: {
                 resolvedModel: response.responseModel ?? selected.id,
                 extras: {
+                    // pi-ai initializes missing counters to zero; reporting provenance is unknown.
+                    tokensReported: null,
+                    costKnown: !selection.custom,
                     producer: {
                         provider: selected.provider,
                         api: selected.api,