@nylorun/runtime 0.19.1-beta → 0.21.0-beta

package/dist/tenant/resource-server.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The Runtime API as an OAuth 2.1 resource server (protocol 9, Host feature `resource-server`).
+ * Nylorun is never the authorization server: the operator's identity providers are, listed in
+ * the identity file, and this module only says so in the standard places.
+ *
+ * - `GET /.well-known/oauth-protected-resource` (RFC 9728): the resource (`NYLORUN_PUBLIC_URL`,
+ *   else the origin the request reached), every trusted issuer in the file's order, and the
+ *   scopes their tokens may carry. Without trusted issuers there is none: the Runtime takes no
+ *   OAuth tokens.
+ * - `WWW-Authenticate: Bearer` challenges (OAuth 2.1 §5.3, RFC 6750): a missing credential
+ *   carries no error code; a rejected one `error="invalid_token"`; a token missing a route's
+ *   scope `error="insufficient_scope"` with the scopes that would do. On the Runtime API they
+ *   point at the metadata (`resource_metadata`); the Management API takes management keys only
+ *   and is no OAuth resource, so its challenge is a bare `Bearer`.
+ */
+import type { IncomingMessage } from "node:http";
+import type { TrustedIssuers } from "./issuers.js";
+/** Where the protected resource metadata is served (RFC 9728 §3). */
+export declare const PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
+/** What the metadata and the challenges are made of: `TenantConfig`'s fields of the same names. */
+export interface ResourceServerConfig {
+    /** The URL clients reach the Runtime API at (`NYLORUN_PUBLIC_URL`, no trailing slash). */
+    readonly publicUrl?: string;
+    /** The identity file's trusted issuers. */
+    readonly issuers?: TrustedIssuers;
+}
+/** RFC 9728 protected resource metadata. */
+export interface ProtectedResourceMetadata {
+    readonly resource: string;
+    readonly authorization_servers: readonly string[];
+    readonly scopes_supported: readonly string[];
+    readonly bearer_methods_supported: readonly ["header"];
+    readonly resource_name: string;
+}
+/** The metadata, or undefined when the Runtime trusts no issuer. */
+export declare function protectedResourceMetadata(config: ResourceServerConfig, incoming: IncomingMessage): ProtectedResourceMetadata | undefined;
+/**
+ * The metadata's URL for a challenge's `resource_metadata`, or undefined when there is none.
+ * A resource with a path has its metadata at the origin, the path after the well-known part.
+ */
+export declare function protectedResourceMetadataUrl(config: ResourceServerConfig, incoming: IncomingMessage): string | undefined;
+interface Challenge {
+    readonly error?: "invalid_token" | "insufficient_scope";
+    readonly description?: string;
+    readonly scope?: string;
+    readonly resourceMetadata?: string | undefined;
+}
+/** A `WWW-Authenticate: Bearer` value. Every parameter value is plain ASCII without quotes. */
+export declare function bearerChallenge(challenge?: Challenge): string;
+/**
+ * The `401` for a request without a usable credential: `credential_required` when it sent
+ * none (no error code, OAuth 2.1 §5.3.2), `credential_invalid` when the Tenant refused the one
+ * it sent. The reason is the Runtime's log's, never the client's.
+ */
+export declare function failCredential(kind: "required" | "invalid", resourceMetadata: string | undefined): never;
+export {};

package/dist/tenant/resource-server.js

@@ -0,0 +1,62 @@
+import { TOKEN_SCOPES } from "@nylorun/core/contracts";
+import { HttpError } from "./http.js";
+/** Where the protected resource metadata is served (RFC 9728 §3). */
+export const PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
+/** The origin `incoming` reached, as `@hono/node-server` builds a request's URL. */
+function requestOrigin(incoming) {
+    const scheme = incoming.socket?.encrypted ? "https" : "http";
+    return `${scheme}://${incoming.headers.host ?? "localhost"}`;
+}
+/** This Runtime API's resource identifier: the public URL, else the request's origin. */
+function resourceOf(config, incoming) {
+    return config.publicUrl ?? requestOrigin(incoming);
+}
+/** The metadata, or undefined when the Runtime trusts no issuer. */
+export function protectedResourceMetadata(config, incoming) {
+    const issuers = config.issuers?.issuers ?? [];
+    if (issuers.length === 0)
+        return undefined;
+    // `studio` signs a person in to Studio; no Runtime API route asks for it.
+    const granted = new Set(issuers.flatMap((issuer) => issuer.config.allowedScopes));
+    return {
+        resource: resourceOf(config, incoming),
+        authorization_servers: issuers.map((issuer) => issuer.config.issuer),
+        scopes_supported: TOKEN_SCOPES.filter((scope) => granted.has(scope)),
+        bearer_methods_supported: ["header"],
+        resource_name: "Nylorun Runtime API",
+    };
+}
+/**
+ * The metadata's URL for a challenge's `resource_metadata`, or undefined when there is none.
+ * A resource with a path has its metadata at the origin, the path after the well-known part.
+ */
+export function protectedResourceMetadataUrl(config, incoming) {
+    if ((config.issuers?.issuers.length ?? 0) === 0)
+        return undefined;
+    const url = new URL(resourceOf(config, incoming));
+    const path = url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "");
+    return `${url.origin}${PROTECTED_RESOURCE_PATH}${path}`;
+}
+/** A `WWW-Authenticate: Bearer` value. Every parameter value is plain ASCII without quotes. */
+export function bearerChallenge(challenge = {}) {
+    const params = [];
+    if (challenge.error)
+        params.push(`error="${challenge.error}"`);
+    if (challenge.description)
+        params.push(`error_description="${challenge.description}"`);
+    if (challenge.scope)
+        params.push(`scope="${challenge.scope}"`);
+    if (challenge.resourceMetadata)
+        params.push(`resource_metadata="${challenge.resourceMetadata}"`);
+    return params.length === 0 ? "Bearer" : `Bearer ${params.join(", ")}`;
+}
+/**
+ * The `401` for a request without a usable credential: `credential_required` when it sent
+ * none (no error code, OAuth 2.1 §5.3.2), `credential_invalid` when the Tenant refused the one
+ * it sent. The reason is the Runtime's log's, never the client's.
+ */
+export function failCredential(kind, resourceMetadata) {
+    if (kind === "required")
+        throw new HttpError(401, "A bearer credential is required", { code: "credential_required" }, { "www-authenticate": bearerChallenge({ resourceMetadata }) });
+    throw new HttpError(401, "The credential is not valid here", { code: "credential_invalid" }, { "www-authenticate": bearerChallenge({ error: "invalid_token", resourceMetadata }) });
+}

package/dist/tenant/runtime.d.ts

@@ -108,7 +108,7 @@ export declare class TenantRuntime implements TenantHandle {
     drain(activeWork: "drain" | "cancel", timeoutMs?: number): Promise<void>;
     /**
      * Aborts the advance of `sessionId` if it runs on this process. Cancel calls it after
-     * committing `cancelled`; the control stream calls it for cancels made elsewhere.
+     * committing `cancelled`; the control bus calls it for cancels made elsewhere.
      */
     abortLocal(sessionId: string): void;
     /**

package/dist/tenant/runtime.js

@@ -5,7 +5,6 @@ import { tenantModelGate } from "../gates/in-process.js";
 import { createKekFile, readVaultKek } from "../vault/kek.js";
 import { SigningKeys } from "./signing-keys.js";
 import { VaultService } from "../vault/service.js";
-import { CredentialSources } from "../vault/sources.js";
 import { McpPool } from "../mcp/pool.js";
 import { SandboxManager } from "../sandbox/manager.js";
 import { storeSandboxRecords } from "../sandbox/records.js";
@@ -13,6 +12,7 @@ import { defaultSandboxBackends } from "../sandbox/select.js";
 import { MemoryExecution } from "../execution/memory.js";
 import { openError } from "./cause.js";
 import { MemoryStreams } from "../streams/memory.js";
+import { closeControl, wireControl } from "./control.js";
 import { createSessionStreams, endAllStreams, } from "./session-streams.js";
 import { closeStreams, streamsStatus, wireStreams, } from "./streams.js";
 import { abortAll, abortLocal, createWorkState, drain, waitForIdle, } from "./scheduler.js";
@@ -21,7 +21,6 @@ import { sweep } from "./sweep.js";
 import { TenantWorkers, WORKER_ID, } from "./worker.js";
 import { authorize } from "./effects.js";
 import { inProcessToolGate } from "../gates/tool-gate.js";
-import { guardedFetch } from "./outbound.js";
 import { inProcessKeys } from "../keys/keys.js";
 import { tenantApi } from "../api/http/app.js";
 import { createFsBlobStore } from "../blob/index.js";
@@ -85,6 +84,7 @@ export class TenantRuntime {
         mkdirSync(paths.logs, { recursive: true });
         const store = hooks.store;
         let wired;
+        let control;
         let detach;
         let harness;
         try {
@@ -116,16 +116,7 @@ export class TenantRuntime {
             const opened = store;
             // A seeded Tenant setting wins over the Host default (A18).
             const seededBackend = await opened.tx((t) => t.getSetting("sandbox.backend"));
-            const vault = new VaultService({
-                store: opened,
-                kek: ensureKek,
-                // OAuth refresh and connect follow the Host's address policy (F9 C2).
-                fetch: config.vaultFetch ?? guardedFetch(config.delivery ?? {}),
-            });
-            const credentials = new CredentialSources({
-                vault,
-                ...(config.resolver ? { resolver: config.resolver } : {}),
-            });
+            const vault = new VaultService({ store: opened, kek: ensureKek });
             // `ctx` is assigned below; these callbacks only run once the Tenant is open.
             let ctx;
             const toolGate = hooks.toolGate ??
@@ -135,7 +126,14 @@ export class TenantRuntime {
                     logger: config.logger,
                 });
             const signingKeys = new SigningKeys({ tenantId: config.tenantId, kek: ensureKek });
-            const keys = hooks.keys ?? inProcessKeys({ store: opened, vault, signingKeys, kek: ensureKek });
+            const keys = hooks.keys ??
+                inProcessKeys({
+                    store: opened,
+                    vault,
+                    signingKeys,
+                    kek: ensureKek,
+                    policy: config.delivery ?? {},
+                });
             const harnessMode = hooks.harness ?? "memory";
             const inProcess = harnessMode === "memory" || harnessMode === "json";
             const preference = seededBackend ?? config.sandbox.backend;
@@ -240,7 +238,6 @@ export class TenantRuntime {
                 reads: hooks.reads,
                 store: opened,
                 vault,
-                credentials,
                 ...(mcp ? { mcp } : {}),
                 sandbox,
                 flowLimits,
@@ -303,6 +300,8 @@ export class TenantRuntime {
                 ...(hooks.hostRelay ? { hostRelay: true } : {}),
                 ...(hooks.retireGraceMs !== undefined ? { retireGraceMs: hooks.retireGraceMs } : {}),
             });
+            await wireControl(ctx);
+            control = ctx.control;
             // Register the handlers, then arm the sweep: its first pass runs at once and re-wakes
             // sessions a previous process left runnable or running (takeover handles the rest).
             const worker = {
@@ -324,6 +323,7 @@ export class TenantRuntime {
             await detach?.().catch(() => undefined);
             await harness?.stop().catch(() => undefined);
             await wired?.close().catch(() => undefined);
+            await control?.close().catch(() => undefined);
             await hooks.reads?.close().catch(() => undefined);
             await store.close().catch(() => undefined);
             throw error;
@@ -350,7 +350,7 @@ export class TenantRuntime {
     }
     /**
      * Aborts the advance of `sessionId` if it runs on this process. Cancel calls it after
-     * committing `cancelled`; the control stream calls it for cancels made elsewhere.
+     * committing `cancelled`; the control bus calls it for cancels made elsewhere.
      */
     abortLocal(sessionId) {
         this.ctx.abortLocal(sessionId);
@@ -402,6 +402,7 @@ export class TenantRuntime {
                     return closeStreams(ctx);
                 },
             ],
+            ["control", () => closeControl(ctx)],
             ["reads", () => ctx.reads?.close()],
             ["store", () => ctx.store.close()],
         ];

package/dist/tenant/scheduler.d.ts

@@ -9,7 +9,7 @@ export interface WorkState {
 export declare function createWorkState(): WorkState;
 /**
  * Abort the advance of `id` if it runs on this process.
- * Cancel calls it after committing `cancelled`, and so does the control stream for cancels made
+ * Cancel calls it after committing `cancelled`, and so does the control bus for cancels made
  * elsewhere. With `turnId`, an advance of another turn keeps running: the signal came late.
  */
 export declare function abortLocal(ctx: TenantContext, id: string, kind?: AdvanceAbortKind, turnId?: string): void;

package/dist/tenant/scheduler.js

@@ -27,7 +27,7 @@ function abortWith(controller, kind) {
 }
 /**
  * Abort the advance of `id` if it runs on this process.
- * Cancel calls it after committing `cancelled`, and so does the control stream for cancels made
+ * Cancel calls it after committing `cancelled`, and so does the control bus for cancels made
  * elsewhere. With `turnId`, an advance of another turn keeps running: the signal came late.
  */
 export function abortLocal(ctx, id, kind = "cancel", turnId) {

package/dist/tenant/sessions.js

@@ -10,7 +10,7 @@ import { aggregateWaits, isWorkflowManifest } from "../core/flow-host.js";
 import { canonical } from "../store/canonical.js";
 import { validateSandboxAttach } from "../core/sandbox-routes.js";
 import { resolveSandbox } from "../sandbox/resolve.js";
-import { withSandboxCapability } from "../sandbox/session-sandbox.js";
+import { withPlatformTools, withSandboxCapability } from "../sandbox/session-sandbox.js";
 import { declaredSandboxes, sandboxSpecOf, sessionSandboxSpec, } from "../sandbox/share.js";
 import { effectiveSandboxConfig, readSandboxConfig } from "../sandbox/tenant-config.js";
 import { checkPlacement, requirePods } from "../sandbox/placement.js";
@@ -156,12 +156,14 @@ export async function putSession(ctx, id, body, access, options = {}) {
         checkPlacement(await readSandboxConfig(t), sandbox.kind);
         if (sandbox.kind === "pod")
             await requirePods(ctx.pods, `Sandbox ${sandbox.sandboxId}`);
+        const pinned = sandbox.manifest === undefined ? platformTools(definition) : sandbox;
         const created = {
             id,
             agentId: body.agentId,
             ownerUserId: body.ownerUserId,
-            manifest: sandbox.manifest ?? definition.manifest,
-            manifestHash: sandbox.manifestHash ?? definition.manifestHash,
+            manifest: pinned.manifest ?? definition.manifest,
+            manifestHash: pinned.manifestHash ?? definition.manifestHash,
+            definitionHash: definition.manifestHash,
             implementationVersion: definition.implementationVersion,
             info: body.info,
             status: "idle",
@@ -232,6 +234,20 @@ async function sessionSandbox(t, body, definition, options) {
         return fail(resolved.status, resolved.errors.join(" "));
     return pin(definition, resolved.spec, resolved.source);
 }
+/**
+ * The manifest a session without a sandbox pins: its agents' `read_artifact` (R2b C11), when
+ * one has a remote MCP server or an HTTP tool; nothing otherwise, and for a workflow.
+ */
+function platformTools(definition) {
+    if (isWorkflowManifest(definition.manifest))
+        return {};
+    const pinned = withPlatformTools(definition.manifest);
+    if (pinned === undefined)
+        return {};
+    if (!pinned.ok)
+        return fail(400, pinned.message);
+    return { manifest: pinned.manifest, manifestHash: pinned.manifestHash };
+}
 async function pin(definition, spec, source) {
     // A workflow's manifest stays as registered: its agents inherit the sandbox when they start.
     if (isWorkflowManifest(definition.manifest))
@@ -269,6 +285,7 @@ export async function sessionView(t, s) {
         agentId: s.agentId,
         ownerUserId: s.ownerUserId,
         manifestHash: s.manifestHash,
+        ...(s.definitionHash === undefined ? {} : { definitionHash: s.definitionHash }),
         implementationVersion: s.implementationVersion,
         status: s.status,
         activeTurnId: s.activeTurnId,

package/dist/tenant/store-pg.js

@@ -55,6 +55,15 @@ export function createPostgresTenantOpener(options) {
                 from: opened.migrated.from,
                 to: opened.migrated.to,
             });
+        // Protocol 10 removed the vault's `oauth` credential type: the migration deleted them.
+        for (const removed of opened.removedCredentials)
+            logger?.warn("oauth_credential_removed", {
+                tenantId,
+                vaultId: removed.vaultId,
+                credentialId: removed.credentialId,
+                url: removed.url,
+                message: "MCP OAuth credentials are gone (protocol 10): store a key for this server in a vault, or reach it through a gateway",
+            });
         let reads;
         try {
             reads = createPostgresReadStore(options.sql, tenantId);

package/dist/tenant/streams.d.ts

@@ -8,23 +8,24 @@
  *   otherwise (tests, a Host without S2) this module runs a relay of the Tenant's own commits,
  *   which reconciles the record with the streams when it starts.
  * - **Basin generations.** The Tenant's session streams live in its current basin generation
- *   (`streams/basin.ts`). A reset moves it to the next one (`tenantReset`): the old basin gets
- *   a `sessions.reset` signal, every process moves its readers, and the old basin is deleted
- *   after a grace period (again when the Tenant opens, until it is gone).
+ *   (`streams/basin.ts`). A reset moves it to the next one: its transaction puts a
+ *   `sessions.reset` signal on the control bus (`control.ts`), every process moves its readers
+ *   (`tenantReset` here, `checkSessionStreams` elsewhere), and the old basin is deleted after a
+ *   grace period (again when the Tenant opens, until it is gone).
  * - **Basin.** The current basin is created when the Tenant opens. A missing basin (S2 down
  *   then, or deleted since) is repaired on first use: a failed `ensureTenant` retries in the background with backoff,
  *   and `streamsStatus` reports the basin's state.
  * - **Readers.** History and session SSE read the session's stream
- *   (`tenant/session-streams.ts`). This module runs one `tenant/control` reader per Tenant per
- *   process, on the current basin, which calls `ctx.abortLocal` for each `session.cancel`
- *   and checks the session streams for each `sessions.reset`.
+ *   (`tenant/session-streams.ts`). Those are the only readers: S2 serves API listeners, and
+ *   nothing internal reads or writes it (D48). Signals between processes go over the control
+ *   bus on Postgres (`control.ts`).
  *
  * The caller passes the streams: the Host's S2 streams, or `MemoryStreams` for tests and a
  * local development Host (not durable).
  */
 import type { SessionStore } from "../store/types.js";
 import { type StreamRelay, type StreamRelayStatus } from "../streams/relay/core.js";
-import { type DurableStreams } from "../streams/types.js";
+import type { DurableStreams } from "../streams/types.js";
 import type { TenantContext } from "./context.js";
 export interface WireStreamsOptions {
     tenantId: string;
@@ -56,7 +57,7 @@ export interface StreamsWiring {
     readonly relay: StreamRelay | undefined;
     /** The current basin's state (`streamsStatus`). */
     basin(): BasinStatus;
-    /** Moves this process's readers and control reader to basin generation `generation`. */
+    /** Moves this process's readers to basin generation `generation`. */
     moveTo(generation: number): void;
     /** Deletes the basins of retired generations after the grace period. */
     retire(generations: readonly number[]): void;
@@ -65,23 +66,16 @@ export interface StreamsWiring {
 }
 /**
  * Wires the Tenant to Durable Streams: reads its basin generation, checks the basin, starts
- * the Tenant's relay (unless the Host relays), the control reader and the retired basins'
- * deletion, and records the handles on `ctx.sessionStreams.wiring`. Call it once, after
- * `ctx` is built and before the Tenant serves requests.
+ * the Tenant's relay (unless the Host relays) and the retired basins' deletion, and records
+ * the handles on `ctx.sessionStreams.wiring`. Call it once, after `ctx` is built and before
+ * the Tenant serves requests.
  */
 export declare function wireStreams(ctx: TenantContext, options: WireStreamsOptions): Promise<StreamsWiring>;
 /**
- * Appends `session.cancel` for `sessionId` and its cancelled turn to `tenant/control`, so the
- * process running that turn's advance aborts it. Call it from `t.afterCommit` after a cancel
- * commits. A lost signal costs latency only (the advance checks the Session Store before every
- * effect), so failures are logged, never thrown.
- */
-export declare function signalSessionCancel(ctx: TenantContext, sessionId: string, turnId: string | null): void;
-/**
- * After a reset deleted the Tenant's sessions and moved it to a new basin generation: tells
- * every process with the Tenant open (`sessions.reset` on the old basin's control stream),
- * moves this process's readers, and deletes the old basin after the grace period. Failures
- * are logged; the periodic check and the next open finish the job.
+ * After a reset deleted the Tenant's sessions and moved it to a new basin generation: moves
+ * this process's readers at once and deletes the old basin after the grace period. The other
+ * processes move on the reset's `sessions.reset` signal (`control.ts`); the periodic check
+ * and the next open finish the job.
  */
 export declare function tenantReset(ctx: TenantContext): Promise<void>;
 /** Tenant status of the streams seam (for `GET /v1/tenant`). */

package/dist/tenant/streams.js

@@ -1,7 +1,5 @@
 import { basinOf } from "../streams/basin.js";
-import { signalCancel, signalSessionsReset } from "../streams/control.js";
 import { createStreamRelay, } from "../streams/relay/core.js";
-import { CONTROL_STREAM, } from "../streams/types.js";
 import { checkSessionStreams, currentBasin, sleep, } from "./session-streams.js";
 const RETRY_MIN_MS = 100;
 const RETRY_MAX_MS = 2000;
@@ -16,9 +14,9 @@ const RETIRE_GRACE_MS = 60_000;
 const messageOf = (error) => error instanceof Error ? error.message : String(error);
 /**
  * Wires the Tenant to Durable Streams: reads its basin generation, checks the basin, starts
- * the Tenant's relay (unless the Host relays), the control reader and the retired basins'
- * deletion, and records the handles on `ctx.sessionStreams.wiring`. Call it once, after
- * `ctx` is built and before the Tenant serves requests.
+ * the Tenant's relay (unless the Host relays) and the retired basins' deletion, and records
+ * the handles on `ctx.sessionStreams.wiring`. Call it once, after `ctx` is built and before
+ * the Tenant serves requests.
  */
 export async function wireStreams(ctx, options) {
     if (ctx.sessionStreams.wiring)
@@ -53,17 +51,6 @@ export async function wireStreams(ctx, options) {
             },
         });
     relay?.start();
-    // One control reader, on the current basin; moving to a new generation restarts it there.
-    let control = new AbortController();
-    const startControl = () => follow(streams, currentBasin(ctx), CONTROL_STREAM, AbortSignal.any([stop.signal, control.signal]), (body) => {
-        const signal = body;
-        if (signal?.type === "session.cancel" && typeof signal.sessionId === "string")
-            ctx.abortLocal(signal.sessionId, typeof signal.turnId === "string" ? signal.turnId : undefined);
-        else if (signal?.type === "sessions.reset")
-            void checkSessionStreams(ctx).catch(report("session stream check failed"));
-    }, report("control stream read failed; retrying"));
-    // Signals appended from here on reach this process.
-    await startControl();
     // Streams whose session was reset end on the `sessions.reset` signal; this catches lost ones.
     const feedCheck = setInterval(() => void checkSessionStreams(ctx).catch(report("session stream check failed")), FEED_CHECK_MS);
     feedCheck.unref();
@@ -78,9 +65,6 @@ export async function wireStreams(ctx, options) {
                 return;
             ctx.sessionStreams.generation = generation;
             basin.repair();
-            control.abort();
-            control = new AbortController();
-            void startControl();
         },
         retire(retired) {
             for (const generation of retired) {
@@ -153,33 +137,16 @@ function commitSource(store, tenantId) {
     };
 }
 /**
- * Appends `session.cancel` for `sessionId` and its cancelled turn to `tenant/control`, so the
- * process running that turn's advance aborts it. Call it from `t.afterCommit` after a cancel
- * commits. A lost signal costs latency only (the advance checks the Session Store before every
- * effect), so failures are logged, never thrown.
- */
-export function signalSessionCancel(ctx, sessionId, turnId) {
-    const streams = ctx.sessionStreams.wiring?.streams;
-    if (!streams)
-        return;
-    void signalCancel(streams, currentBasin(ctx), sessionId, turnId ?? undefined).catch((error) => ctx.config.logger.warn("cancel signal failed", {
-        sessionId,
-        message: messageOf(error),
-    }));
-}
-/**
- * After a reset deleted the Tenant's sessions and moved it to a new basin generation: tells
- * every process with the Tenant open (`sessions.reset` on the old basin's control stream),
- * moves this process's readers, and deletes the old basin after the grace period. Failures
- * are logged; the periodic check and the next open finish the job.
+ * After a reset deleted the Tenant's sessions and moved it to a new basin generation: moves
+ * this process's readers at once and deletes the old basin after the grace period. The other
+ * processes move on the reset's `sessions.reset` signal (`control.ts`); the periodic check
+ * and the next open finish the job.
  */
 export async function tenantReset(ctx) {
     const wiring = ctx.sessionStreams.wiring;
     if (!wiring)
         return;
-    const previous = currentBasin(ctx);
     const generations = await ctx.store.tx((t) => t.basinGenerations());
-    await signalSessionsReset(wiring.streams, previous, generations.current).catch((error) => ctx.config.logger.warn("sessions.reset signal failed", { message: messageOf(error) }));
     wiring.moveTo(generations.current);
     wiring.retire(generations.retired);
 }
@@ -283,50 +250,3 @@ function basinKeeper(streams, basinKey, signal, onError) {
         status: () => ({ ready, failures, lastError }),
     };
 }
-/**
- * Follows a signal stream from its tail at start, calling `onRecord` for each record, until
- * `signal` aborts. Failed reads retry with backoff; a read that ends by itself (the basin was
- * deleted) starts again from the new tail. Resolves once the first tail is known (or failed).
- */
-function follow(streams, basin, stream, signal, onRecord, onError) {
-    let started;
-    const ready = new Promise((resolve) => (started = resolve));
-    void (async () => {
-        let from;
-        let delay = RETRY_MIN_MS;
-        while (!signal.aborted) {
-            try {
-                try {
-                    from ??= await streams.tail(basin, stream);
-                }
-                finally {
-                    started();
-                }
-                for await (const record of streams.read(basin, stream, from, {
-                    signal,
-                })) {
-                    from = record.seq + 1;
-                    delay = RETRY_MIN_MS;
-                    try {
-                        onRecord(record.body);
-                    }
-                    catch (error) {
-                        onError(error);
-                    }
-                }
-                if (signal.aborted)
-                    return;
-                from = undefined;
-            }
-            catch (error) {
-                if (signal.aborted)
-                    return;
-                onError(error);
-            }
-            await sleep(delay, signal);
-            delay = Math.min(delay * 2, RETRY_MAX_MS);
-        }
-        started();
-    })();
-    return ready;
-}

package/dist/tenant/sweep.js

@@ -13,7 +13,9 @@
  *    stopped, and sandboxes whose session or sandbox resource is gone are removed, by the
  *    workspace capability (`harness-api/workspace.ts`: here, or in the harness that serves
  *    workspaces). Idle MCP connections of the in-process harness are closed.
- * 4. **Hooks.** Callbacks registered with `ctx.onSweep`.
+ * 4. **Control signals.** Signals on the control bus older than `SIGNAL_RETENTION_MS` are
+ *    deleted: followers read back only the last two minutes (`store/postgres/control.ts`).
+ * 5. **Hooks.** Callbacks registered with `ctx.onSweep`.
  *
  * Every step runs one transaction per session it changes (a linked agent and its workflow
  * share one, child first), so the sweep follows the lock order in `store/types.ts`. A failing
@@ -22,6 +24,8 @@
  */
 import { pendingAgentEffects, reconcilePendingAgentEffect, } from "../core/flow-host.js";
 const BATCH = 100;
+/** How long a control signal is kept after it was written. */
+const SIGNAL_RETENTION_MS = 60 * 60 * 1000;
 export async function sweep(ctx) {
     if (ctx.closing || ctx.closed)
         return;
@@ -40,6 +44,10 @@ export async function sweep(ctx) {
         ["pods", () => reconcileStalePods(ctx, now)],
         // A harness elsewhere closes its own idle MCP connections.
         ["mcp", async () => ctx.mcp?.sweep()],
+        [
+            "signals",
+            () => ctx.store.tx((t) => t.pruneSignals(new Date(now.getTime() - SIGNAL_RETENTION_MS))),
+        ],
         ...[...ctx.sweepHooks].map((hook) => ["hook", hook]),
     ];
     let failure;

package/dist/tenant/tool-results.d.ts

@@ -0,0 +1,57 @@
+import type { HostEffect } from "@nylorun/harness/run";
+import type { TenantContext } from "./context.js";
+/** The most of one tool result that is recorded inline (Q22): 32 KiB, as JSON. */
+export declare const TOOL_RESULT_INLINE_BYTES: number;
+/** How much of a stored result's start, and of its end, the preview keeps. */
+export declare const PREVIEW_HEAD_BYTES: number;
+export declare const PREVIEW_TAIL_BYTES = 1024;
+/**
+ * The most one step's results may hold together: a step's results are one transcript entry, so
+ * one event, which must stay well under S2's 1 MiB record.
+ */
+export declare const STEP_RESULTS_BUDGET_BYTES: number;
+/** A result's cap once its step's budget is spent: a stub naming its artifact. */
+export declare const TOOL_RESULT_STUB_BYTES = 512;
+/** A result this small is never shaped, nor counted against its step's budget. */
+export declare const TOOL_RESULT_SMALL_BYTES = 1024;
+/** The call whose outcome is shaped, and the session its artifacts belong to. */
+export interface ShapedCall {
+    readonly request: HostEffect;
+    readonly session: {
+        readonly id: string;
+        readonly ownerUserId: string;
+    };
+    /** A remote MCP tool's: its output may be the server's content parts. */
+    readonly mcp: boolean;
+    /** This result's cap (`resultLimit`). Default `TOOL_RESULT_INLINE_BYTES`. */
+    readonly limit?: number;
+}
+/** A result's cap when the other results of its step already took `used` bytes. */
+export declare function resultLimit(used: number): number;
+/** The JSON size of `value` in bytes: what it adds to an event or a prompt. */
+export declare function jsonBytes(value: unknown): number;
+/**
+ * What a tool outcome's result weighs in its step's transcript entry: a completed one's output,
+ * a failed one's message; 0 for anything else, such as a model call's outcome.
+ */
+export declare function resultBytes(value: unknown): number;
+/**
+ * False for an outcome `shapeToolOutcome` returns as it is, whatever made it: a model call's, a
+ * small tool result with no parts. Spares a look at the effect for most outcomes.
+ */
+export declare function mayNeedShaping(value: unknown): boolean;
+/**
+ * The outcome `value` of `call`, shaped to fit its cap (see the module comment). An outcome that
+ * fits and has no binary part comes back as it is.
+ */
+export declare function shapeToolOutcome(ctx: TenantContext, call: ShapedCall, value: unknown, signal: AbortSignal): Promise<unknown>;
+/**
+ * The start and end of `text` in whole characters, `budget` bytes split four to one: by default
+ * the first `PREVIEW_HEAD_BYTES` and the last `PREVIEW_TAIL_BYTES`.
+ */
+export declare function previewOf(text: string, budget?: number): string;
+/**
+ * The nearest character boundary of the UTF-8 `bytes` at or before (`down`) or at or after
+ * (`up`) byte `at`: never inside a character.
+ */
+export declare function utf8Boundary(bytes: Uint8Array, at: number, direction: "down" | "up"): number;