@nylorun/runtime 0.17.0-beta → 0.19.1-beta

package/dist/gates/tool-client.js

@@ -1,31 +1,29 @@
 /**
  * The loop's client of the Tool Gate in the gates service (F4.1, `tool-contract.ts`): remote
  * MCP servers opened and called through the gate, which holds their connections and
- * credentials, and Action deliveries POSTed by the gate. Over `node:http`, like the model gate's
- * client (`http-client.ts`): a call answers only when it has finished.
+ * credentials, and HTTP tools called by the gate (R2 M3).
+ * Over `node:http`, like the model gate's client (`http-client.ts`): a call answers only when it
+ * has finished.
  *
  * Failures keep the meaning they had in the loop's own process:
  * - An MCP request that fails, at the server or on the hop, throws, so the pool reports a
- *   diagnostic and `resolveEffect` marks a call `uncertain`, as before.
- * - A delivery never throws. A hop that failed before the request was sent is `not_sent`
- *   (the deliverer sends it again, even a tool); one that failed after is `lost`.
+ *   diagnostic and `resolveEffect` marks a call `uncertain`, as before. An HTTP tool call
+ *   throws only for the hop, or a call lost with the gateway: its own failures are outcomes.
  *
  * Credentials (F5): a session's MCP requests and keyed cancels carry its run token, read per
  * request from the advance's grant, and leave the session out of the body: the gate takes it
- * from the token. Deliveries, pings, and MCP requests made outside a run (closing a pooled
- * connection after the advance ended) carry core's credential, `NYLORUN_GATES_TOKEN`, and name
- * the session in the body.
+ * from the token. MCP requests made outside a run (closing a pooled connection after the
+ * advance ended) carry core's credential, `NYLORUN_GATES_TOKEN`, and name the session in the
+ * body.
  */
 import { randomUUID } from "node:crypto";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { TENANT_HEADER } from "./contract.js";
 import { GATE_CLIENT_TIMEOUT_MS } from "./http-client.js";
-import { DELIVERIES_PATH, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, TOOL_CALLS_PATH, } from "./tool-contract.js";
+import { HTTP_CALLS_PATH, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, TOOL_CALLS_PATH, } from "./tool-contract.js";
 /** How long a close or a cancel may take; neither changes an outcome. */
 const SHORT_TIMEOUT_MS = 2_000;
-/** Extra silence allowed on a delivery beyond the endpoint's own timeout. */
-const DELIVERY_SLACK_MS = 30_000;
 export function httpToolGate(options) {
     const where = new URL(options.url).origin;
     const timeoutMs = options.timeoutMs ?? GATE_CLIENT_TIMEOUT_MS;
@@ -107,8 +105,11 @@ export function httpToolGate(options) {
         const { sessionId: _, ...unnamed } = server;
         return { body: body(unnamed), bearer: token };
     }
-    /** The result of an MCP request, or a throw the pool and `resolveEffect` read as before. */
-    async function mcp(path, scope, request) {
+    /**
+     * The result of an MCP or HTTP tool request, or a throw the pool and `resolveEffect` read as
+     * before: the call's fate is unknown, and the effect becomes `uncertain`.
+     */
+    async function answered(path, scope, request) {
         const result = await exchange(path, scope.body, {
             ...request,
             timeoutMs,
@@ -135,13 +136,13 @@ export function httpToolGate(options) {
         recovers: true,
         async openMcp(server) {
             // The credential is read per request: the connection outlives the advance that opened it.
-            await mcp(MCP_CONNECT_PATH, scoped(server, (named) => ({ server: named })), {});
+            await answered(MCP_CONNECT_PATH, scoped(server, (named) => ({ server: named })), {});
             const client = {
-                listTools: (params, request) => mcp(MCP_LIST_PATH, scoped(server, (named) => ({
+                listTools: (params, request) => answered(MCP_LIST_PATH, scoped(server, (named) => ({
                     server: named,
                     ...(params?.cursor ? { cursor: params.cursor } : {}),
                 })), request?.signal ? { signal: request.signal } : {}),
-                callTool: (params, request) => mcp(TOOL_CALLS_PATH, scoped(server, (named) => ({
+                callTool: (params, request) => answered(TOOL_CALLS_PATH, scoped(server, (named) => ({
                     server: named,
                     effectId: request?.key ?? randomUUID(),
                     name: params.name,
@@ -156,6 +157,12 @@ export function httpToolGate(options) {
                 close: () => fireAndForget(MCP_CLOSE_PATH, scoped(server, (named) => ({ server: named }))),
             };
         },
+        async callHttp(call, signal) {
+            const token = options.runTokens?.token(call.tool.sessionId);
+            const { sessionId: _, ...unnamed } = call.tool;
+            const body = { ...call, tool: token ? unnamed : { ...call.tool } };
+            return answered(HTTP_CALLS_PATH, { body, ...(token ? { bearer: token } : {}) }, { signal, idempotencyKey: call.effectId });
+        },
         async cancel(request) {
             const token = options.runTokens?.token(request.sessionId);
             await fireAndForget(`${TOOL_CALLS_PATH}/${encodeURIComponent(request.effectId)}/cancel`, {
@@ -163,37 +170,6 @@ export function httpToolGate(options) {
                 ...(token ? { bearer: token } : {}),
             });
         },
-        async post(delivery, signal) {
-            const result = await exchange(DELIVERIES_PATH, {
-                url: delivery.url,
-                body: delivery.body,
-                headers: { ...delivery.headers },
-                timeoutMs: delivery.timeoutMs,
-            }, { signal, timeoutMs: delivery.timeoutMs + DELIVERY_SLACK_MS });
-            if (result.kind === "aborted")
-                return {
-                    kind: result.sent ? "lost" : "not_sent",
-                    code: "ABORTED",
-                    message: "The delivery was aborted",
-                };
-            if (result.kind === "unreachable")
-                return { kind: "not_sent", code: "gateway.unreachable", message: result.message };
-            if (result.kind === "lost")
-                return { kind: "lost", code: "gateway.lost", message: result.message };
-            const parsed = parse(result.text);
-            if (result.status !== 200 || !parsed?.result)
-                // The gate refused the request before sending anything.
-                return { kind: "not_sent", code: "gateway.refused", message: gateRefusal(result.status, parsed) };
-            const wire = parsed.result;
-            if (wire.kind !== "response")
-                return wire;
-            return {
-                kind: "response",
-                status: wire.status,
-                headers: wire.headers,
-                body: Buffer.from(wire.body, "base64"),
-            };
-        },
     };
 }
 /** An MCP failure the gate reported, as the loop's own MCP code would have thrown it. */

package/dist/gates/tool-contract.d.ts

@@ -1,12 +1,12 @@
 /**
  * The Tool Gate's wire format (blueprint §12, F4.1): the routes the loop calls on the gates
- * service for remote MCP servers and Action deliveries. Internal, like the model call route
+ * service for remote MCP servers and HTTP tools. Internal, like the model call route
  * (`contract.ts`): same optional Tenant header, not in the published OpenAPI documents.
  *
  * Credentials (F5). A session's MCP requests carry its run token, and the gate takes the
  * session from it: `server.sessionId` is then absent (or the token's). Core's credential
  * (`NYLORUN_GATES_TOKEN`) is accepted too, for requests made outside a run, and then
- * `server.sessionId` names the session. Deliveries accept core's credential only.
+ * `server.sessionId` names the session.
  *
  * Remote MCP. The gate holds the connection and the vault credential; the loop names the
  * server, never a URL or a credential, and the gate finds it in the session's pinned manifest.
@@ -23,22 +23,23 @@
  * answer, not a gate error. A keyed call whose earlier attempt was lost with the gateway answers
  * `{ok: false, error: {uncertain: true}}` and is never run again.
  *
- * Action deliveries. `POST /nylorun/v1/deliveries` `{url, body, headers, timeoutMs}`: the gate
- * POSTs the signed delivery under the gateway's own address policy and answers `200 {result}`,
- * what `tenant/outbound.ts` `post` returned, with the answer's body in base64.
+ * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
+ * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, capabilityId, toolName}`), or a
+ * flow's HTTP stage or HTTP verifier by its stage key (`{sessionId?, stage}`); the gate finds its
+ * URL, method and credential in the session's pinned manifest
+ * (`gates/http-tool.ts`). A run token's turn is the call's; `turnId` counts only under core's
+ * credential. Keyed like a tool call, and cancelled by the same route. It answers
+ * `200 {ok: true, result}` with the tool outcome (a failed request is a failed outcome the
+ * model sees), or `{ok: false, error: {uncertain: true}}` for a call lost with the gateway.
  */
 import { z } from "zod";
 export declare const MCP_CONNECT_PATH = "/nylorun/v1/mcp/connect";
 export declare const MCP_LIST_PATH = "/nylorun/v1/mcp/list";
 export declare const MCP_CLOSE_PATH = "/nylorun/v1/mcp/close";
 export declare const TOOL_CALLS_PATH = "/nylorun/v1/tool-calls";
-export declare const DELIVERIES_PATH = "/nylorun/v1/deliveries";
-/** Largest tool call or delivery body the gate reads. */
+export declare const HTTP_CALLS_PATH = "/nylorun/v1/http-calls";
+/** Largest tool call body the gate reads. */
 export declare const MAX_TOOL_BODY_BYTES: number;
-/** The longest delivery timeout the gate accepts: an endpoint's maximum `timeoutMs`. */
-export declare const MAX_DELIVERY_TIMEOUT_MS: number;
-/** The only headers the gate forwards on a delivery, lower-cased. */
-export declare const DELIVERY_HEADERS: ReadonlySet<string>;
 export declare const McpServerRefSchema: z.ZodObject<{
     sessionId: z.ZodOptional<z.ZodString>;
     agentId: z.ZodOptional<z.ZodString>;
@@ -74,6 +75,21 @@ export declare const ToolCallBodySchema: z.ZodObject<{
     arguments: z.ZodRecord<z.ZodString, z.ZodUnknown>;
 }, z.core.$strip>;
 export type ToolCallBody = z.infer<typeof ToolCallBodySchema>;
+export declare const HttpCallBodySchema: z.ZodObject<{
+    tool: z.ZodUnion<readonly [z.ZodObject<{
+        sessionId: z.ZodOptional<z.ZodString>;
+        agentId: z.ZodOptional<z.ZodString>;
+        capabilityId: z.ZodString;
+        toolName: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        sessionId: z.ZodOptional<z.ZodString>;
+        stage: z.ZodString;
+    }, z.core.$strip>]>;
+    effectId: z.ZodString;
+    turnId: z.ZodString;
+    input: z.ZodUnknown;
+}, z.core.$strip>;
+export type HttpCallBody = z.infer<typeof HttpCallBodySchema>;
 /** Why an MCP request failed, as the loop's diagnostics read it (`mcp/connect.ts`). */
 export interface McpGateError {
     readonly message: string;
@@ -91,31 +107,3 @@ export type McpAnswer<T> = {
     readonly ok: false;
     readonly error: McpGateError;
 };
-export declare const DeliveryBodySchema: z.ZodObject<{
-    url: z.ZodString;
-    body: z.ZodString;
-    headers: z.ZodRecord<z.ZodString, z.ZodString>;
-    timeoutMs: z.ZodNumber;
-}, z.core.$strip>;
-export type DeliveryBody = z.infer<typeof DeliveryBodySchema>;
-/** `OutboundResult` on the wire: the answer's body in base64. */
-export type WireOutboundResult = {
-    readonly kind: "response";
-    readonly status: number;
-    readonly headers: Record<string, string | string[] | undefined>;
-    readonly body: string;
-} | {
-    readonly kind: "too_large";
-    readonly status: number;
-} | {
-    readonly kind: "not_sent";
-    readonly code: string;
-    readonly message: string;
-} | {
-    readonly kind: "lost";
-    readonly code: string;
-    readonly message: string;
-};
-export interface DeliveryAnswer {
-    readonly result: WireOutboundResult;
-}

package/dist/gates/tool-contract.js

@@ -1,12 +1,12 @@
 /**
  * The Tool Gate's wire format (blueprint §12, F4.1): the routes the loop calls on the gates
- * service for remote MCP servers and Action deliveries. Internal, like the model call route
+ * service for remote MCP servers and HTTP tools. Internal, like the model call route
  * (`contract.ts`): same optional Tenant header, not in the published OpenAPI documents.
  *
  * Credentials (F5). A session's MCP requests carry its run token, and the gate takes the
  * session from it: `server.sessionId` is then absent (or the token's). Core's credential
  * (`NYLORUN_GATES_TOKEN`) is accepted too, for requests made outside a run, and then
- * `server.sessionId` names the session. Deliveries accept core's credential only.
+ * `server.sessionId` names the session.
  *
  * Remote MCP. The gate holds the connection and the vault credential; the loop names the
  * server, never a URL or a credential, and the gate finds it in the session's pinned manifest.
@@ -23,27 +23,23 @@
  * answer, not a gate error. A keyed call whose earlier attempt was lost with the gateway answers
  * `{ok: false, error: {uncertain: true}}` and is never run again.
  *
- * Action deliveries. `POST /nylorun/v1/deliveries` `{url, body, headers, timeoutMs}`: the gate
- * POSTs the signed delivery under the gateway's own address policy and answers `200 {result}`,
- * what `tenant/outbound.ts` `post` returned, with the answer's body in base64.
+ * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
+ * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, capabilityId, toolName}`), or a
+ * flow's HTTP stage or HTTP verifier by its stage key (`{sessionId?, stage}`); the gate finds its
+ * URL, method and credential in the session's pinned manifest
+ * (`gates/http-tool.ts`). A run token's turn is the call's; `turnId` counts only under core's
+ * credential. Keyed like a tool call, and cancelled by the same route. It answers
+ * `200 {ok: true, result}` with the tool outcome (a failed request is a failed outcome the
+ * model sees), or `{ok: false, error: {uncertain: true}}` for a call lost with the gateway.
  */
 import { z } from "zod";
-import { PROTOCOL_HEADER, SIGNATURE_HEADER } from "@nylorun/core/compatibility";
 export const MCP_CONNECT_PATH = "/nylorun/v1/mcp/connect";
 export const MCP_LIST_PATH = "/nylorun/v1/mcp/list";
 export const MCP_CLOSE_PATH = "/nylorun/v1/mcp/close";
 export const TOOL_CALLS_PATH = "/nylorun/v1/tool-calls";
-export const DELIVERIES_PATH = "/nylorun/v1/deliveries";
-/** Largest tool call or delivery body the gate reads. */
+export const HTTP_CALLS_PATH = "/nylorun/v1/http-calls";
+/** Largest tool call body the gate reads. */
 export const MAX_TOOL_BODY_BYTES = 8 * 1024 * 1024;
-/** The longest delivery timeout the gate accepts: an endpoint's maximum `timeoutMs`. */
-export const MAX_DELIVERY_TIMEOUT_MS = 15 * 60_000;
-/** The only headers the gate forwards on a delivery, lower-cased. */
-export const DELIVERY_HEADERS = new Set([
-    SIGNATURE_HEADER.toLowerCase(),
-    PROTOCOL_HEADER.toLowerCase(),
-    "idempotency-key",
-]);
 export const McpServerRefSchema = z.object({
     /** Required with core's credential; a run token names the session itself. */
     sessionId: z.string().min(1).optional(),
@@ -62,9 +58,22 @@ export const ToolCallBodySchema = z.object({
     name: z.string().min(1),
     arguments: z.record(z.string(), z.unknown()),
 });
-export const DeliveryBodySchema = z.object({
-    url: z.string().url(),
-    body: z.string(),
-    headers: z.record(z.string(), z.string()),
-    timeoutMs: z.number().int().positive().max(MAX_DELIVERY_TIMEOUT_MS),
+export const HttpCallBodySchema = z.object({
+    tool: z.union([
+        z.object({
+            /** Required with core's credential; a run token names the session itself. */
+            sessionId: z.string().min(1).optional(),
+            agentId: z.string().min(1).optional(),
+            capabilityId: z.string().min(1),
+            toolName: z.string().min(1),
+        }),
+        z.object({
+            sessionId: z.string().min(1).optional(),
+            /** A flow's HTTP stage or HTTP verifier. */
+            stage: z.string().min(1),
+        }),
+    ]),
+    effectId: z.string().min(1),
+    turnId: z.string().min(1),
+    input: z.unknown(),
 });

package/dist/gates/tool-gate.d.ts

@@ -1,46 +1,47 @@
 /**
  * The Tool Gate seam (blueprint §12, F4.1). Every tool call that leaves the loop crosses one
- * `ToolGate`: a remote MCP server's connection and calls, and every Action delivery to an
- * Action endpoint. The gate owns what those need that the loop must not hold: the MCP
- * credential and its OAuth refresh, and the outbound route.
+ * `ToolGate`: a remote MCP server's connection and calls, and an HTTP tool's request (R2 M3).
+ * The gate owns what those need that the loop must not hold: the MCP and HTTP tool credentials
+ * and their OAuth refresh, and the outbound route.
  *
  * Two implementations: `inProcessToolGate` (embedding, the ephemeral Runtime, tests), which
- * opens remote servers and POSTs deliveries in this process, and the HTTP client of the gates
- * service (`tool-client.ts`, the `gateway` container). Stdio MCP servers and the sandbox tools
- * never cross it: they run beside the loop until the session sandbox takes them (P4).
+ * opens remote servers and calls HTTP tools in this process, and the HTTP client of the gates
+ * service (`tool-client.ts`, the `gateway` container). The sandbox tools never cross it.
  */
 import type { LiveConnection } from "../mcp/connect.js";
 import type { McpServerRef } from "../mcp/pool.js";
-import { type OutboundPolicy, type OutboundResult } from "../tenant/outbound.js";
-/** One Action delivery or endpoint ping, signed by the caller. */
-export interface DeliveryRequest {
-    readonly url: string;
-    readonly body: string;
-    /** `Nylorun-Signature`, `Nylorun-Protocol` and `Idempotency-Key`; nothing else. */
-    readonly headers: Readonly<Record<string, string>>;
-    /** How long the endpoint may take to answer. */
-    readonly timeoutMs: number;
-}
+import type { OutboundPolicy } from "../tenant/outbound.js";
+import type { Logger } from "../tenant/types.js";
+import { type HttpOutcome, type HttpToolCall, type HttpToolTenant } from "./http-tool.js";
 export interface ToolGate {
     /**
      * Opens a remote (`streamable-http` or `sse`) MCP server of a session. Absent: the loop's
      * pool opens it itself, with the Tenant vault.
      */
     openMcp?(server: McpServerRef): Promise<LiveConnection>;
-    /** POSTs a delivery. Never throws; `signal` aborts it (see `tenant/outbound.ts`). */
-    post(request: DeliveryRequest, signal: AbortSignal): Promise<OutboundResult>;
     /**
-     * True when a keyed MCP call outlives the caller's process (the gates service, G3): after a
-     * takeover or a shutdown, re-sending it joins the call or returns its outcome, and a call
-     * lost with the gateway answers `uncertain` instead of running again.
+     * Calls an HTTP tool of a session (R2 M3), keyed by the call's effect id. A failed request is
+     * a failed outcome; it throws only when the call's fate is unknown (the gate was lost, or the
+     * call was lost with it) or `signal` aborts. Absent: this Runtime cannot run HTTP tools.
+     */
+    callHttp?(call: HttpToolCall, signal: AbortSignal): Promise<HttpOutcome>;
+    /**
+     * True when a keyed MCP or HTTP tool call outlives the caller's process (the gates service,
+     * G3): after a takeover or a shutdown, re-sending it joins the call or returns its outcome,
+     * and a call lost with the gateway answers `uncertain` instead of running again.
      */
     readonly recovers?: boolean;
-    /** Stops a keyed MCP call that outlives its caller (a user cancel). Never rejects. */
+    /** Stops a keyed tool call that outlives its caller (a user cancel). Never rejects. */
     cancel?(request: {
         tenantId: string;
         sessionId: string;
         effectId: string;
     }): Promise<void>;
 }
-/** The Tool Gate in the caller's process: remote MCP through the pool, deliveries by `post`. */
-export declare function inProcessToolGate(policy?: OutboundPolicy): ToolGate;
+/**
+ * The Tool Gate in the caller's process: remote MCP through the pool, and HTTP tools with
+ * `tenant`'s sessions and vault.
+ */
+export declare function inProcessToolGate(policy?: OutboundPolicy, tenant?: HttpToolTenant & {
+    readonly logger?: Logger;
+}): ToolGate;

package/dist/gates/tool-gate.js

@@ -1,10 +1,14 @@
-import { post } from "../tenant/outbound.js";
-/** The Tool Gate in the caller's process: remote MCP through the pool, deliveries by `post`. */
-export function inProcessToolGate(policy = {}) {
+import { runHttpTool } from "./http-tool.js";
+/**
+ * The Tool Gate in the caller's process: remote MCP through the pool, and HTTP tools with
+ * `tenant`'s sessions and vault.
+ */
+export function inProcessToolGate(policy = {}, tenant) {
     return {
-        post: (request, signal) => post(request.url, request.body, { ...request.headers }, {
-            policy,
-            signal: AbortSignal.any([signal, AbortSignal.timeout(request.timeoutMs)]),
-        }),
+        ...(tenant
+            ? {
+                callHttp: (call, signal) => runHttpTool(tenant, call, { policy, signal, ...(tenant.logger ? { logger: tenant.logger } : {}) }),
+            }
+            : {}),
     };
 }

package/dist/harness/calls.d.ts

@@ -1,13 +1,14 @@
 /**
  * The calls a harness executes, as pure helpers over what routes them: the Model Gate (or the
- * Tenant's provider), the MCP pool, the SandboxManager. No store, no record: the session's
- * routing comes with the run (`TurnStart.routing`).
+ * Tenant's provider), the Tool Gate, the MCP pool, the SandboxManager. No store, no record: the
+ * session's routing comes with the run (`TurnStart.routing`).
  */
 import { type AgentManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
 import type { AbortReason } from "@nylorun/core/harness-api";
 import type { ModelProvider } from "../core/provider.js";
 import type { ModelGate } from "../gates/model-gate.js";
+import type { ToolGate } from "../gates/tool-gate.js";
 import { type McpPool } from "../mcp/pool.js";
 import { type McpSnapshot } from "../mcp/snapshot.js";
 import type { SandboxManager } from "../sandbox/manager.js";
@@ -22,7 +23,6 @@ export interface ModelRoute {
 /** What a session's tool calls are routed by. */
 export interface ToolRouting {
     readonly rootManifest: AgentManifest;
-    readonly pluginRoots: Readonly<Record<string, string>>;
     readonly mcpSnapshot?: McpSnapshot;
     /** The session that owns the tree's sandbox, and the sandbox resource it is attached to. */
     readonly sandboxOwnerId: string;
@@ -46,7 +46,13 @@ export declare function invokeModel(route: ModelRoute, request: HostEffect, sign
 export declare function abortOn(signal: AbortSignal, kinds: readonly AbortReason[]): AbortSignal;
 /** True when `request` calls `save_artifact` of the `nylorun.artifacts` capability `manifest` has. */
 export declare function isSaveArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
-/** True when `request` calls a tool of a remote (`streamable-http` or `sse`) MCP server. */
+/** True when `request` calls a tool of a declared MCP server (every one is remote). */
 export declare function isRemoteMcpCall(routing: Pick<ToolRouting, "rootManifest" | "mcpSnapshot">, request: HostEffect): boolean;
 export declare function callMcpTool(mcp: McpPool, routing: ToolRouting, request: HostEffect, signal: AbortSignal): Promise<unknown>;
+/**
+ * Calls an HTTP tool through the Tool Gate (R2 M3), keyed by the effect id: an agent's (the
+ * effect's agent used as a tool, or the root), or a flow's HTTP stage or HTTP verifier. Its
+ * outcome is the effect's value; a throw leaves the effect `uncertain`.
+ */
+export declare function callHttpTool(gate: Pick<ToolGate, "callHttp">, request: HostEffect, signal: AbortSignal): Promise<unknown>;
 export declare function callSandboxTool(sandbox: SandboxManager, routing: ToolRouting, request: HostEffect, signal: AbortSignal): Promise<unknown>;

package/dist/harness/calls.js

@@ -1,10 +1,11 @@
 /**
  * The calls a harness executes, as pure helpers over what routes them: the Model Gate (or the
- * Tenant's provider), the MCP pool, the SandboxManager. No store, no record: the session's
- * routing comes with the run (`TurnStart.routing`).
+ * Tenant's provider), the Tool Gate, the MCP pool, the SandboxManager. No store, no record: the
+ * session's routing comes with the run (`TurnStart.routing`).
  */
 import { ARTIFACTS_CAPABILITY_ID, SAVE_ARTIFACT_TOOL } from "@nylorun/core/define";
 import { runAbortKind } from "@nylorun/harness/api";
+import { httpToolRefOf } from "../gates/http-tool.js";
 import { classifyThrown } from "../model/classify.js";
 import { findServer } from "../mcp/pool.js";
 import { manifestFor, mcpToolOf } from "../mcp/snapshot.js";
@@ -71,15 +72,14 @@ export function isSaveArtifactCall(manifest, request) {
         request.toolName === SAVE_ARTIFACT_TOOL &&
         manifest?.capabilities.some((capability) => capability.id === ARTIFACTS_CAPABILITY_ID) === true);
 }
-/** True when `request` calls a tool of a remote (`streamable-http` or `sse`) MCP server. */
+/** True when `request` calls a tool of a declared MCP server (every one is remote). */
 export function isRemoteMcpCall(routing, request) {
     if (request.kind !== "tool")
         return false;
     const tool = mcpToolOf(routing.mcpSnapshot, request);
     if (!tool)
         return false;
-    const declared = findServer(routing.rootManifest, tool.agentId, tool.capabilityId, tool.serverName);
-    return declared !== undefined && declared.server.type !== "stdio";
+    return findServer(routing.rootManifest, tool.agentId, tool.capabilityId, tool.serverName) !== undefined;
 }
 export async function callMcpTool(mcp, routing, request, signal) {
     const tool = mcpToolOf(routing.mcpSnapshot, request);
@@ -93,11 +93,20 @@ export async function callMcpTool(mcp, routing, request, signal) {
         serverToolName: tool.serverToolName,
         args: request.input,
         manifest: routing.rootManifest,
-        pluginRoots: routing.pluginRoots,
         effectId: request.effectId,
         signal,
     });
 }
+/**
+ * Calls an HTTP tool through the Tool Gate (R2 M3), keyed by the effect id: an agent's (the
+ * effect's agent used as a tool, or the root), or a flow's HTTP stage or HTTP verifier. Its
+ * outcome is the effect's value; a throw leaves the effect `uncertain`.
+ */
+export async function callHttpTool(gate, request, signal) {
+    if (!gate.callHttp)
+        throw new Error("This Runtime has no Tool Gate for HTTP tools");
+    return gate.callHttp({ tool: httpToolRefOf(request), effectId: request.effectId, turnId: request.turnId, input: request.input }, signal);
+}
 export async function callSandboxTool(sandbox, routing, request, signal) {
     const capability = sandboxCapabilityOf(manifestFor(routing.rootManifest, request.agent), request.capabilityId, request.toolName);
     if (!capability)

package/dist/harness/executors.d.ts

@@ -6,7 +6,7 @@ import { type ModelRoute, type ToolRouting } from "./calls.js";
 export interface HarnessExecutorsOptions {
     /** Where model calls go. Read per call: a harness process learns its Tenant at `hello`. */
     readonly model: ModelRoute;
-    readonly toolGate: Pick<ToolGate, "recovers" | "cancel">;
+    readonly toolGate: Pick<ToolGate, "recovers" | "cancel" | "callHttp">;
     readonly mcp: McpPool;
     /** The SandboxManager; a harness process creates it once `hello` names the Tenant. */
     readonly sandbox: () => SandboxManager;

package/dist/harness/executors.js

@@ -1,7 +1,8 @@
 /**
- * A harness's executors (F6.1, F6.2): the model route, the Tool Gate, an MCP pool and a
- * SandboxManager, injected. They reach no store: a run's routing comes with its `turn.start`,
- * and the session's MCP discovery is recorded through core (`session.mcp`, `prepare`).
+ * A harness's executors (F6.1, F6.2): the model route, the Tool Gate (remote MCP and HTTP
+ * tools), an MCP pool and a SandboxManager, injected. They reach no store: a run's routing comes
+ * with its `turn.start`, and the session's MCP discovery is recorded through core (`session.mcp`,
+ * `prepare`).
  *
  * The in-process harness gets the Tenant's own pool and SandboxManager; a harness process
  * (`--service harness`, `main.ts`) its own, whose sandbox events it claims from core.
@@ -10,27 +11,34 @@ import { hashManifest } from "@nylorun/core/define";
 import { toolFixtureModel } from "../core/provider.js";
 import { serversOf } from "../mcp/pool.js";
 import { mcpToolOf } from "../mcp/snapshot.js";
-import { abortOn, callMcpTool, callSandboxTool, invokeModel, isRemoteMcpCall, isSaveArtifactCall, } from "./calls.js";
+import { isHttpToolCall } from "../gates/http-tool.js";
+import { abortOn, callHttpTool, callMcpTool, callSandboxTool, invokeModel, isRemoteMcpCall, isSaveArtifactCall, } from "./calls.js";
 /** The Tenant's model of the fixture-model setting. Stateless. */
 const fixture = toolFixtureModel();
 export function harnessExecutors(options) {
-    const recoversMcp = options.toolGate.recovers === true;
-    const remote = (effect, run) => recoversMcp && isRemoteMcpCall(routingOf(run), effect);
+    const recoversTools = options.toolGate.recovers === true;
+    const atGate = (effect, run) => {
+        const routing = routingOf(run);
+        return isRemoteMcpCall(routing, effect) || isHttpToolCall(routing.rootManifest, effect);
+    };
+    const recovered = (effect, run) => recoversTools && atGate(effect, run);
     return {
         model: (effect, signal, run) => invokeModel(options.model, effect, signal, run.start.options.fixtureModel ? fixture : undefined),
         tool(effect, signal, run) {
             const routing = routingOf(run);
+            // A call at the Tool Gate outlives a shutdown there; a local one finishes and is recorded.
+            const kinds = recovered(effect, run) ? ["cancel", "shutdown"] : ["cancel"];
+            if (isHttpToolCall(routing.rootManifest, effect))
+                return callHttpTool(options.toolGate, effect, abortOn(signal, kinds));
             if (!mcpToolOf(routing.mcpSnapshot, effect))
                 return callSandboxTool(options.sandbox(), routing, effect, signal);
-            // A call at the Tool Gate outlives a shutdown there; a local one finishes and is recorded.
-            const kinds = remote(effect, run) ? ["cancel", "shutdown"] : ["cancel"];
             return callMcpTool(options.mcp, routing, effect, abortOn(signal, kinds));
         },
         recovers: {
             get model() {
                 return options.model.useVaultModel && options.model.modelGate.recovers === true;
             },
-            remoteMcp: remote,
+            tool: recovered,
         },
         async cancelAtGate(effect) {
             await options.toolGate.cancel?.({
@@ -59,7 +67,6 @@ export async function prepareMcp(pool, run, record) {
             sessionId,
             manifest,
             manifestHash: hashManifest(manifest),
-            pluginRoots: routing.pluginRoots,
             signal: run.signal,
         });
         answer = await record({ snapshot: found.snapshot, diagnostics: found.diagnostics });
@@ -68,7 +75,6 @@ export async function prepareMcp(pool, run, record) {
         const diagnostics = await pool.reconnect({
             sessionId,
             manifest,
-            pluginRoots: routing.pluginRoots,
             tools: routing.mcpSnapshot.mcpTools,
             signal: run.signal,
         });
@@ -86,7 +92,6 @@ export function routingOf(run) {
     const { routing } = run.start;
     return {
         rootManifest: routing.rootManifest,
-        pluginRoots: routing.pluginRoots,
         ...(routing.mcpSnapshot ? { mcpSnapshot: routing.mcpSnapshot } : {}),
         sandboxOwnerId: routing.sandbox?.ownerId ?? run.grant.sessionId,
         ...(routing.sandbox?.sandboxId === undefined ? {} : { sandboxId: routing.sandbox.sandboxId }),

package/dist/harness/main.d.ts

@@ -1,6 +1,6 @@
 import type { StackConfig } from "../host/stack-config.js";
 /**
- * `baseline` is the allowlisted environment of MCP stdio servers (`baselineEnvironment`), read
- * by `host/main.ts`: nothing here reads the process environment.
+ * `baseline` is the allowlisted environment of a pod's sandbox tools (`baselineEnvironment`),
+ * read by `host/main.ts`: nothing here reads the process environment.
  */
 export declare function runHarness(stack: StackConfig, baseline: Readonly<Record<string, string>>): Promise<void>;

package/dist/harness/main.js

@@ -6,8 +6,7 @@
  * database, no Restate, no keys.
  *
  * Its files live under `NYLORUN_HARNESS_ROOT` (`/harness`): `sandboxes/` (workspaces and their
- * records), `plugin-data/`, and `home/` and `tmp/` for MCP stdio servers. `/health` answers on
- * 127.0.0.1 only.
+ * records). `/health` answers on 127.0.0.1 only.
  *
  * In a pod sandbox (`NYLORUN_SANDBOX_KIND=pod`, F7.2) it is that sandbox's engine: it first waits
  * until the pod's NetworkPolicy is in force (`awaitNetworkPolicy`), then joins with the
@@ -28,20 +27,14 @@ import { podHost } from "./pod.js";
 import { harnessRunTokens } from "./run-tokens.js";
 import { startHarnessService } from "./service.js";
 /**
- * `baseline` is the allowlisted environment of MCP stdio servers (`baselineEnvironment`), read
- * by `host/main.ts`: nothing here reads the process environment.
+ * `baseline` is the allowlisted environment of a pod's sandbox tools (`baselineEnvironment`),
+ * read by `host/main.ts`: nothing here reads the process environment.
  */
 export async function runHarness(stack, baseline) {
     const config = stack.harness;
     const logger = createHostLogger();
-    const paths = {
-        sandboxes: join(config.root, "sandboxes"),
-        pluginData: join(config.root, "plugin-data"),
-        home: join(config.root, "home"),
-        tmp: join(config.root, "tmp"),
-    };
-    for (const dir of Object.values(paths))
-        mkdirSync(dir, { recursive: true });
+    const paths = { sandboxes: join(config.root, "sandboxes") };
+    mkdirSync(paths.sandboxes, { recursive: true });
     logger.info("host_stack_config", { services: [...stack.services], harness: config.url, gates: config.gatesUrl });
     // A pod's engine trusts the network only once its NetworkPolicy blocks what it must.
     let pod;
@@ -62,7 +55,6 @@ export async function runHarness(stack, baseline) {
         token,
         ...(pod ? { sandboxBackends: [localBackend({ env: baseline, proxyEnv: () => pod.proxyEnv() })] } : {}),
         paths,
-        childEnv: { ...baseline, HOME: paths.home, TMPDIR: paths.tmp },
         modelGate: httpModelGate({ url: config.gatesUrl, runTokens }),
         useVaultModel: true,
         toolGate: httpToolGate({ url: config.gatesUrl, runTokens }),