@nylorun/runtime 0.20.0-beta → 0.21.0-beta

package/dist/store/postgres/tenant.d.ts

@@ -11,6 +11,8 @@
  *    tables of a pre-release build of it. It is never touched: this release starts fresh.
  * 2. Apply the missing migrations (`migrate.ts`). A database with migrations this Runtime
  *    does not know is `schema-too-new`; a migration Postgres rejects is `migration-failed`.
+ *    `0016_mcp_oauth_removed` deletes the vault's MCP OAuth credentials (protocol 10), each
+ *    with an audit row; the open returns them (`removedCredentials`) for a boot warning.
  * 3. When `nylorun.tenant` is empty, create the Tenant: its row (id, name, created time) and
  *    its first principals. A database whose row is gone but that holds a Tenant's data
  *    (principals, sessions, agents, vaults, keys) is `envelope-invalid`, never given a new
@@ -74,6 +76,18 @@ export interface OpenedTenantDatabase {
         from: number;
         to: number;
     };
+    /**
+     * The MCP OAuth credentials this call's migration `0016_mcp_oauth_removed` deleted (protocol
+     * 10), from the audit rows it wrote: the Host names each in a boot warning. Empty otherwise.
+     */
+    removedCredentials: RemovedCredential[];
+}
+/** A vault credential a migration deleted. */
+export interface RemovedCredential {
+    vaultId: string;
+    credentialId: string;
+    /** The URL it was bound to. */
+    url: string | null;
 }
 /**
  * Migrates the database, creates its Tenant when it has none, and opens its Session Store.

package/dist/store/postgres/tenant.js

@@ -4,8 +4,10 @@ import { TenantEnvelopeSchema, } from "@nylorun/core/contracts";
 import { openError, TenantOpenError } from "../../tenant/cause.js";
 import { database, driverError } from "./db.js";
 import { applyMigrations, assertCurrentLayout, isStatementError, lockMigrations, shippedMigrations, } from "./migrate.js";
-import { definitions, principals, sessions, signingKeys, TENANT_SCHEMA, tenant, vaults, } from "./schema.js";
+import { definitions, principals, sessions, signingKeys, TENANT_SCHEMA, tenant, vaultAudit, vaults, } from "./schema.js";
 import { createPostgresSessionStore } from "./store.js";
+/** The migration that deletes the vault's `oauth` credentials, each with an audit row. */
+const OAUTH_REMOVED_MIGRATION = "0016_mcp_oauth_removed";
 /**
  * Migrates the database, creates its Tenant when it has none, and opens its Session Store.
  * Throws a `TenantOpenError` with the cause when the Tenant cannot be opened (see above).
@@ -22,7 +24,8 @@ export async function openTenantDatabase(options) {
             await assertCurrentLayout(tx);
             const migrated = await applyMigrations(tx, migrations);
             const created = await ensureTenant(tx, options.create, migrated, now);
-            return { created, migrated };
+            const removedCredentials = await removedBy(tx, migrations, migrated);
+            return { created, migrated, removedCredentials };
         });
     }
     catch (thrown) {
@@ -82,6 +85,23 @@ export async function readTenantEnvelope(q) {
         throw driverError(error);
     }
 }
+/**
+ * The credentials `0016_mcp_oauth_removed` deleted, when this transaction applied it: its
+ * audit rows (actor `migration`). Empty when it ran before, or is not among `migrations`.
+ */
+async function removedBy(tx, migrations, migrated) {
+    const index = migrations.findIndex((migration) => migration.tag === OAUTH_REMOVED_MIGRATION);
+    if (index < migrated.from || index >= migrated.to)
+        return [];
+    const rows = await tx
+        .select({ vaultId: vaultAudit.vaultId, credentialId: vaultAudit.credentialId, url: vaultAudit.target })
+        .from(vaultAudit)
+        .where(and(eq(vaultAudit.actor, "migration"), eq(vaultAudit.action, "delete")))
+        .orderBy(vaultAudit.ord);
+    return rows.flatMap((row) => row.vaultId && row.credentialId
+        ? [{ vaultId: row.vaultId, credentialId: row.credentialId, url: row.url }]
+        : []);
+}
 /**
  * Creates the Tenant when there is none, and adds the principals it is missing. Records the
  * schema version on the Tenant row when this transaction migrated.

package/dist/store/types.d.ts

@@ -59,7 +59,7 @@ import type { RecordReader } from "../streams/relay/types.js";
 import type { EventPayload, EventType, LiveEvent, SandboxEvent, SandboxEventPayload, SandboxEventType, SandboxKind, SandboxPodDesired, SandboxPodObserved, SessionEventOf } from "@nylorun/core/contracts";
 import type { SandboxManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
-import type { ArtifactRow, ArtifactVersionRow, DefinitionFileRow, ModelBudgetRow, ModelUsageRow, ModelUsageWrite, PrincipalRow, ToolCrossingRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, OAuthPendingRow } from "./postgres/schema.js";
+import type { ArtifactRow, ArtifactVersionRow, DefinitionFileRow, ModelBudgetRow, ModelUsageRow, ModelUsageWrite, PrincipalRow, ToolCrossingRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow } from "./postgres/schema.js";
 /** Tables holding JSON documents keyed by `id`. */
 export type DocTable = "definitions" | "sessions" | "commands" | "effects" | "sandboxes" | "links";
 export declare const DOC_TABLES: readonly DocTable[];
@@ -195,7 +195,7 @@ export type CommitListener = (commit: Commit) => void;
  * `bytea` columns, never inside a JSON body), the vault's audit and idempotency records, the
  * Tenant's signing keys, a model call in the usage ledger and a model budget.
  */
-export type { ArtifactRow, ArtifactVersionRow, DefinitionFileRow, ModelBudgetRow, ModelUsageRow, ModelUsageWrite, ToolCrossingRow, PrincipalRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, OAuthPendingRow, };
+export type { ArtifactRow, ArtifactVersionRow, DefinitionFileRow, ModelBudgetRow, ModelUsageRow, ModelUsageWrite, ToolCrossingRow, PrincipalRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, };
 /** Which rows of the usage ledger a total covers. */
 export interface ModelUsageQuery {
     scope: "tenant" | "agent" | "turn";
@@ -483,12 +483,6 @@ export interface Tx {
     getVaultIdempotency(id: string): Promise<VaultIdempotencyRow | undefined>;
     /** Rejects when the id exists. */
     insertVaultIdempotency(row: VaultIdempotencyRow): Promise<void>;
-    /** An MCP OAuth connect's start (F9 C2). Rejects on a duplicate state or an unknown vault. */
-    insertOAuthPending(row: OAuthPendingRow): Promise<void>;
-    /** Deletes and returns the pending connect of `stateHash`, expired or not: each is used once. */
-    takeOAuthPending(stateHash: string): Promise<OAuthPendingRow | undefined>;
-    /** Deletes the pending connects that expired before `now` (ISO); returns how many. */
-    deleteExpiredOAuthPending(now: string): Promise<number>;
     /**
      * Serializes signing key changes: held until the transaction ends. Take it before reading
      * the keys a change depends on, so concurrent first uses or rotations do not collide.

package/dist/tenant/artifact-tool.d.ts

@@ -1,5 +1,13 @@
 import type { SandboxToolOutcome } from "@nylorun/core/contracts";
+import { type ToolResultFile } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
 import { type TenantContext } from "./context.js";
-export { isSaveArtifactCall } from "../harness/calls.js";
+export { isReadArtifactCall, isSaveArtifactCall } from "../harness/calls.js";
 export declare function callSaveArtifact(ctx: TenantContext, request: HostEffect, signal: AbortSignal): Promise<SandboxToolOutcome>;
+/** What `read_artifact` returns: a page of a text artifact, or an image as a file. */
+interface ReadOutcome {
+    readonly kind: "completed";
+    readonly output: Record<string, unknown>;
+    readonly files?: readonly ToolResultFile[];
+}
+export declare function callReadArtifact(ctx: TenantContext, request: HostEffect, signal: AbortSignal): Promise<ReadOutcome | SandboxToolOutcome>;

package/dist/tenant/artifact-tool.js

@@ -1,20 +1,28 @@
 /**
- * `nylorun.save_artifact` (F8.1): our engine's built-in tool that saves a file as an artifact
- * of its session. The `nylorun.artifacts` capability comes with a session's sandbox
- * (`sandbox/session-sandbox.ts`); the Runtime runs the tool itself, like the sandbox tools:
+ * Our engine's built-in artifact tools, of the `nylorun.artifacts` capability
+ * (`sandbox/session-sandbox.ts`). The Runtime runs them itself, like the sandbox tools.
  *
+ * `save_artifact` (F8.1), which comes with a session's sandbox, saves a file as an artifact of
+ * its session:
  * - `path`: a file in the session's sandbox, read as bytes in the sandbox's queue;
  * - `content`: text the model passes.
- *
  * The version commits with `artifact.created` (or `artifact.version.created`) on the session's
- * stream, carrying the turn and the tool call. Expected problems (no such file, too large, the
- * Tenant's total reached) are failed outcomes the model sees; only infrastructure errors throw.
+ * stream, carrying the turn and the tool call.
+ *
+ * `read_artifact` (R2b C11, Q24), which an agent with a remote MCP server or an HTTP tool has,
+ * reads a text artifact of its own session in pages of at most 32 KiB, from a byte `offset`:
+ * how the model reads a tool result the Runtime stored because it was too large to show
+ * (`tool-results.ts`). An image is shown to a model that reads images, as a file of the result.
+ * It reaches only the session's own artifacts, never a Tenant-wide one or another session's.
+ *
+ * Expected problems (no such file, too large, the Tenant's total reached, not text) are failed
+ * outcomes the model sees; only infrastructure errors throw.
  */
 import { basename } from "node:path";
-import { SANDBOX_CAPABILITY_ID } from "@nylorun/core/define";
+import { READ_ARTIFACT_MAX_BYTES, SANDBOX_CAPABILITY_ID, } from "@nylorun/core/define";
 import { isArtifactId } from "@nylorun/core/compatibility";
 import { readArtifactLimits } from "../artifacts/config.js";
-import { contentTypeFor, normalizeContentType } from "../artifacts/media-types.js";
+import { MODEL_FILE_MAX_BYTES, contentTypeFor, essence, isModelImage, isText, normalizeContentType, } from "../artifacts/media-types.js";
 import { uploadArtifact } from "../artifacts/service.js";
 import { DEFAULT_CONTENT_TYPE } from "../blob/index.js";
 import { sandboxCapabilityOf } from "../sandbox/manager.js";
@@ -22,8 +30,9 @@ import { sandboxWorkspaceOf } from "../sandbox/share.js";
 import { sandboxLookup, sessionOf } from "./context.js";
 import { HttpError } from "./http.js";
 import { manifestFor } from "./session.js";
+import { jsonBytes, utf8Boundary } from "./tool-results.js";
 import { toolIds } from "./transcript.js";
-export { isSaveArtifactCall } from "../harness/calls.js";
+export { isReadArtifactCall, isSaveArtifactCall } from "../harness/calls.js";
 const failed = (code, message) => ({
     kind: "failed",
     code,
@@ -117,3 +126,98 @@ export async function callSaveArtifact(ctx, request, signal) {
         throw error;
     }
 }
+export async function callReadArtifact(ctx, request, signal) {
+    const input = (request.input ?? {});
+    const artifactId = typeof input.artifactId === "string" ? input.artifactId : "";
+    const offset = input.offset ?? 0;
+    const length = input.length ?? READ_ARTIFACT_MAX_BYTES;
+    if (artifactId === "" ||
+        typeof offset !== "number" ||
+        !Number.isSafeInteger(offset) ||
+        offset < 0 ||
+        typeof length !== "number" ||
+        !Number.isSafeInteger(length) ||
+        length < 1 ||
+        length > READ_ARTIFACT_MAX_BYTES)
+        return failed("artifact.invalid_input", `Give artifactId, an offset of 0 or more, and a length of 1 to ${READ_ARTIFACT_MAX_BYTES}.`);
+    const found = await ctx.store.tx(async (t) => {
+        const s = await sessionOf(t, request.sessionId);
+        if (!isArtifactId(artifactId))
+            return undefined;
+        // Only an artifact of this session: never a Tenant-wide one, nor another session's.
+        const artifact = await t.artifact(artifactId);
+        if (!artifact || artifact.sessionId !== s.id)
+            return undefined;
+        const version = await t.artifactVersion(artifact.id, artifact.latestVersion);
+        return version ? { artifact, version } : undefined;
+    });
+    if (!found)
+        return failed("artifact.not_found", `Artifact ${artifactId} is not an artifact of this session.`);
+    const { artifact, version } = found;
+    const about = {
+        artifactId: artifact.id,
+        version: version.version,
+        name: artifact.name,
+        contentType: version.contentType,
+        size: version.size,
+    };
+    if (artifact.kind !== "file")
+        return failed("artifact.not_text", `${artifact.name} is a folder; read_artifact reads a file.`);
+    if (isModelImage(version.contentType) && version.size <= MODEL_FILE_MAX_BYTES)
+        return {
+            kind: "completed",
+            output: about,
+            files: [
+                {
+                    mediaType: version.contentType,
+                    reference: { artifactId: artifact.id, version: version.version, name: artifact.name },
+                },
+            ],
+        };
+    if (!isText(version.contentType))
+        return failed("artifact.not_text", `${artifact.name} is ${essence(version.contentType)}, not text; read_artifact reads text and shows images.`);
+    if (offset > version.size || (offset === version.size && version.size > 0))
+        return failed("artifact.invalid_input", `Offset ${offset} is past the end of ${artifact.name}, which is ${version.size} bytes.`);
+    const end = Math.min(offset + length, version.size);
+    const bytes = end === offset ? new Uint8Array() : await readRange(ctx, version.blobKey, offset, end - 1, signal);
+    const page = textPage(bytes, end === version.size);
+    const next = offset + page.bytes;
+    return {
+        kind: "completed",
+        output: {
+            ...about,
+            offset,
+            content: page.text,
+            ...(next < version.size ? { nextOffset: next } : {}),
+        },
+    };
+}
+/** Bytes `start` to `end` (both inclusive) of a version's blob. */
+async function readRange(ctx, blobKey, start, end, signal) {
+    const got = await ctx.blobs.get(blobKey, { range: { start, end }, signal });
+    if (!got)
+        throw new Error("The artifact's bytes are missing from the Object store");
+    return new Uint8Array(await new Response(got.body).arrayBuffer());
+}
+/**
+ * The text of a page of UTF-8 `bytes` in whole characters, at most `READ_ARTIFACT_MAX_BYTES`
+ * once escaped as JSON, and how many bytes it used: the next page starts there. A page that
+ * starts inside a character skips its rest, and one that ends inside one (not `last`) stops
+ * before it.
+ */
+function textPage(bytes, last) {
+    const from = utf8Boundary(bytes, 0, "up");
+    let to = last ? bytes.byteLength : utf8Boundary(bytes, bytes.byteLength, "down");
+    // A page shorter than one character: take what there is.
+    if (to <= from)
+        to = bytes.byteLength;
+    const decode = () => Buffer.from(bytes.subarray(from, to)).toString("utf8");
+    let text = decode();
+    // Escaped (quotes, newlines, control characters), text takes more room than its bytes: each
+    // byte left out frees at least one.
+    for (let size = jsonBytes(text); to > from && size > READ_ARTIFACT_MAX_BYTES; size = jsonBytes(text)) {
+        to = utf8Boundary(bytes, Math.max(from, to - (size - READ_ARTIFACT_MAX_BYTES)), "down");
+        text = decode();
+    }
+    return { text, bytes: to };
+}

package/dist/tenant/context.d.ts

@@ -24,7 +24,6 @@ import type { ModelGate } from "../gates/model-gate.js";
 import type { ToolGate } from "../gates/tool-gate.js";
 import type { Keys } from "../keys/keys.js";
 import type { VaultService } from "../vault/service.js";
-import type { CredentialSources } from "../vault/sources.js";
 import type { McpPool } from "../mcp/pool.js";
 import type { McpDiagnostic, McpSnapshot } from "../mcp/snapshot.js";
 import type { HarnessApiServer } from "../harness-api/server.js";
@@ -46,6 +45,11 @@ export interface Session {
     /** Session pin — the manifest the session was created with. */
     manifest: any;
     manifestHash: string;
+    /**
+     * The hash of the definition the session was opened from; `manifestHash` differs when the
+     * Runtime pinned its own capabilities beside it (R2b C11). Absent on older sessions.
+     */
+    definitionHash?: string;
     /** Validated turn-manifest variants, keyed by hash (loops.md §4.2). */
     variants?: Record<string, AgentManifest>;
     implementationVersion: string;
@@ -139,11 +143,6 @@ export interface TenantContext {
     readonly envelope: TenantEnvelope;
     readonly store: SessionStore;
     readonly vault: VaultService;
-    /**
-     * A session's MCP credentials, for the in-process MCP pool: its attached vaults, then the
-     * operator's credential resolver (`TenantConfig.resolver`, F9 C1).
-     */
-    readonly credentials: CredentialSources;
     /**
      * The MCP pool of the Tenant's in-process harness. Absent when harnesses run elsewhere
      * (`NYLORUN_HARNESS=remote`): each keeps its own (F6.2).

package/dist/tenant/effects.d.ts

@@ -14,7 +14,7 @@ import type { EffectOutcome } from "@nylorun/core/contracts";
 import type { EffectResolution, HostEffect } from "@nylorun/harness/run";
 import type { Tx } from "../store/types.js";
 import type { AuthorizeResult } from "../vault/service.js";
-import type { McpCredentialRequest } from "../vault/sources.js";
+import { type McpCredentialRequest } from "../vault/sources.js";
 import { type Lease, type Session, type TenantContext } from "./context.js";
 /**
  * The outcome of a flow `agent` effect once the linked turn it started ended, or undefined
@@ -42,6 +42,6 @@ export declare function recoversModelCalls(ctx: TenantContext): boolean;
 export declare function resolveNewFlowEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease): Promise<EffectResolution>;
 /**
  * The credential of an MCP server or HTTP tool request made on behalf of a session: from its
- * attached vaults, else the operator's credential resolver (`vault/sources.ts`).
+ * attached vaults (`vault/sources.ts`).
  */
 export declare function authorize(ctx: TenantContext, sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;

package/dist/tenant/effects.js

@@ -1,10 +1,11 @@
 import { embeddedAgent, flowDelegateManifest, hashManifest, } from "@nylorun/core/define";
 import { countActiveFlowWork, deriveAgentEffectSessionId, isFlowToolEffect, isWorkflowManifest, linkedMessageInput, linkedMessageKey, linkedTurnEnd, settleAgentEffect, } from "../core/flow-host.js";
 import { mayDispatchMore } from "../core/limits.js";
+import { sessionCredentials } from "../vault/sources.js";
 import { isRemoteMcpCall } from "../harness/calls.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
 import { owningSandboxSessionId, sandboxSpecOf, sessionSandboxSpec, } from "../sandbox/share.js";
-import { withSandboxCapability } from "../sandbox/session-sandbox.js";
+import { withPlatformTools, withSandboxCapability } from "../sandbox/session-sandbox.js";
 import { loadSession, ownedSession, sandboxLookup, sessionOf, } from "./context.js";
 import { fail } from "./http.js";
 import { turnManifestOf } from "./session.js";
@@ -150,12 +151,15 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
             : undefined;
         // A sandbox chosen when the tree was opened reaches every agent in it, with its tools.
         const inherited = inheritedSandbox(sandboxOwnerId === undefined ? undefined : lookup(sandboxOwnerId) ?? workflow, definition);
+        // Without one, an agent with MCP or HTTP tools still reads its stored results (R2b C11).
+        const pinned = inherited?.manifest ? inherited : platformTools(definition.manifest);
         const created = {
             id: agentSessionId,
             agentId: body.agentId,
             ownerUserId: workflow.ownerUserId,
-            manifest: inherited?.manifest ?? definition.manifest,
-            manifestHash: inherited?.manifestHash ?? definition.manifestHash,
+            manifest: pinned?.manifest ?? definition.manifest,
+            manifestHash: pinned?.manifestHash ?? definition.manifestHash,
+            definitionHash: definition.manifestHash,
             implementationVersion: definition.implementationVersion,
             status: "idle",
             activeTurnId: null,
@@ -241,13 +245,24 @@ function inheritedSandbox(owner, definition) {
         throw new Error(sandboxed.message);
     return { spec, manifest: sandboxed.manifest, manifestHash: sandboxed.manifestHash };
 }
+/** A linked agent session's `read_artifact` without a sandbox (R2b C11); undefined for none. */
+function platformTools(manifest) {
+    if (isWorkflowManifest(manifest))
+        return undefined;
+    const pinned = withPlatformTools(manifest);
+    if (pinned === undefined)
+        return undefined;
+    if (!pinned.ok)
+        throw new Error(pinned.message);
+    return { manifest: pinned.manifest, manifestHash: pinned.manifestHash };
+}
 /**
  * The credential of an MCP server or HTTP tool request made on behalf of a session: from its
- * attached vaults, else the operator's credential resolver (`vault/sources.ts`).
+ * attached vaults (`vault/sources.ts`).
  */
 export async function authorize(ctx, sessionId, request) {
     const s = await loadSession(ctx, sessionId);
-    return ctx.credentials.authorize({ ...s, id: sessionId }, request);
+    return sessionCredentials(ctx.vault, { ...s, id: sessionId }, request);
 }
 /**
  * The definition a flow leaf's session runs. A flow agent embeds its leaves, so they come

package/dist/tenant/ephemeral.d.ts

@@ -2,7 +2,6 @@ import { type PostgresClient } from "../store/postgres/connect.js";
 import type { TrustedIssuerConfig } from "./identity-file.js";
 import { type TrustedIssuers } from "./issuers.js";
 import type { Logger, TenantModelConfig } from "./types.js";
-import type { ResolverConfig } from "../vault/sources.js";
 export interface StartEphemeralRuntimeOptions {
     /**
      * Absolute Host root for `host.json`, the admin key and the Tenant's files (vault key,
@@ -37,11 +36,6 @@ export interface StartEphemeralRuntimeOptions {
      * `createTrustedIssuers`. Default none.
      */
     issuers?: readonly TrustedIssuerConfig[] | TrustedIssuers;
-    /**
-     * The operator's credential resolver (F9 C1): asked for a person's MCP credential when the
-     * session's vaults hold none. Default: none (vaults only).
-     */
-    resolver?: ResolverConfig;
     logger?: Logger;
     /**
      * The Postgres database of the Tenant (one Tenant per database): a pool, which the caller

package/dist/tenant/ephemeral.js

@@ -82,7 +82,6 @@ export async function startEphemeralRuntime(options) {
             sandbox: { backend: sandboxBackend },
             model,
             ...(issuers ? { issuers } : {}),
-            ...(options.resolver ? { resolver: options.resolver } : {}),
             logger: createTenantLogger({
                 tenantId,
                 logPath: tenant.log,

package/dist/tenant/outbound.d.ts

@@ -58,9 +58,19 @@ export declare class OutboundRefused extends Error {
 /** A request `guardedFetch` sent that failed: refused connection, reset, timeout, redirect. */
 export declare class OutboundFailed extends Error {
     readonly code: string;
-    constructor(message: string, code: string);
+    /**
+     * The request was sent in full before it failed, as `post()`'s `lost` (R2b C7): the server
+     * may have acted on it. False for a failure to resolve or connect.
+     */
+    readonly sent: boolean;
+    constructor(message: string, code: string, 
+    /**
+     * The request was sent in full before it failed, as `post()`'s `lost` (R2b C7): the server
+     * may have acted on it. False for a failure to resolve or connect.
+     */
+    sent?: boolean);
 }
-/** The largest answer `guardedFetch` reads. OAuth metadata and tokens are small. */
+/** The largest answer `guardedFetch` reads. */
 export declare const MAX_FETCH_RESPONSE_BYTES: number;
 /** How long a `guardedFetch` request may take without a signal of its own. */
 export declare const FETCH_TIMEOUT_MS = 30000;
@@ -68,9 +78,8 @@ export declare const FETCH_TIMEOUT_MS = 30000;
  * A `fetch` under the Host's address policy (F9 C2): the literal-IP and DNS checks of `post`
  * on the address actually connected to, `localhost` rewritten for the local stack, no
  * redirects (`redirect: "error"`; a 3xx answer rejects), a bounded answer and a 30 s timeout
- * unless the caller passes a signal. The gateway calls OAuth discovery, registration, the code
- * exchange and refresh with it. A refused URL or address rejects with `OutboundRefused`, any
- * other failure with `OutboundFailed`.
+ * unless the caller passes a signal. A refused URL or address rejects with `OutboundRefused`,
+ * any other failure with `OutboundFailed`.
  *
  * `stream`: the Response resolves once the headers arrive and its body streams, unbounded and
  * with no timeout but the caller's signal: remote MCP servers, whose answers and event streams

package/dist/tenant/outbound.js

@@ -1,6 +1,6 @@
 /**
  * The Runtime's requests to developer URLs: HTTP tools (`gates/http-tool.ts`) and, through
- * `guardedFetch`, remote MCP servers and OAuth: one request, no redirects, a bounded answer, and
+ * `guardedFetch`, remote MCP servers: one request, no redirects, a bounded answer, and
  * the Host's address policy checked on the address actually connected to, so a DNS answer cannot
  * steer a request somewhere the Host forbids.
  *
@@ -153,13 +153,20 @@ export class OutboundRefused extends Error {
 /** A request `guardedFetch` sent that failed: refused connection, reset, timeout, redirect. */
 export class OutboundFailed extends Error {
     code;
-    constructor(message, code) {
+    sent;
+    constructor(message, code, 
+    /**
+     * The request was sent in full before it failed, as `post()`'s `lost` (R2b C7): the server
+     * may have acted on it. False for a failure to resolve or connect.
+     */
+    sent = false) {
         super(message);
         this.code = code;
+        this.sent = sent;
         this.name = "OutboundFailed";
     }
 }
-/** The largest answer `guardedFetch` reads. OAuth metadata and tokens are small. */
+/** The largest answer `guardedFetch` reads. */
 export const MAX_FETCH_RESPONSE_BYTES = 1024 * 1024;
 /** How long a `guardedFetch` request may take without a signal of its own. */
 export const FETCH_TIMEOUT_MS = 30_000;
@@ -167,9 +174,8 @@ export const FETCH_TIMEOUT_MS = 30_000;
  * A `fetch` under the Host's address policy (F9 C2): the literal-IP and DNS checks of `post`
  * on the address actually connected to, `localhost` rewritten for the local stack, no
  * redirects (`redirect: "error"`; a 3xx answer rejects), a bounded answer and a 30 s timeout
- * unless the caller passes a signal. The gateway calls OAuth discovery, registration, the code
- * exchange and refresh with it. A refused URL or address rejects with `OutboundRefused`, any
- * other failure with `OutboundFailed`.
+ * unless the caller passes a signal. A refused URL or address rejects with `OutboundRefused`,
+ * any other failure with `OutboundFailed`.
  *
  * `stream`: the Response resolves once the headers arrive and its body streams, unbounded and
  * with no timeout but the caller's signal: remote MCP servers, whose answers and event streams
@@ -217,6 +223,9 @@ export function guardedFetch(policy, options = {}) {
             outgoing["content-length"] = String(body.byteLength);
         return await new Promise((resolve, reject) => {
             let settled = false;
+            // Set when the request is fully sent, as `post()` does: a failure after it may follow
+            // the server acting on the request.
+            let delivered = false;
             const settle = (fn) => {
                 if (settled)
                     return;
@@ -225,12 +234,12 @@ export function guardedFetch(policy, options = {}) {
             };
             const failed = (error) => settle(() => reject(error instanceof RefusedAddress
                 ? new OutboundRefused(error.message)
-                : new OutboundFailed(signal?.aborted ? `The request to ${originalHost} was aborted or timed out` : error.message, signal?.aborted ? "ABORTED" : (error.code ?? error.name))));
+                : new OutboundFailed(signal?.aborted ? `The request to ${originalHost} was aborted or timed out` : error.message, signal?.aborted ? "ABORTED" : (error.code ?? error.name), delivered)));
             const sent = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, { method, headers: outgoing, lookup: lookup, ...(signal ? { signal } : {}) }, (response) => {
                 const status = response.statusCode ?? 0;
                 if (status >= 300 && status < 400 && response.headers.location !== undefined) {
                     response.resume();
-                    return settle(() => reject(new OutboundFailed(`${originalHost} answered a redirect, which this Runtime does not follow`, "REDIRECT")));
+                    return settle(() => reject(new OutboundFailed(`${originalHost} answered a redirect, which this Runtime does not follow`, "REDIRECT", true)));
                 }
                 const noBody = status === 204 || status === 304 || method === "HEAD";
                 const answer = (body) => {
@@ -258,7 +267,7 @@ export function guardedFetch(policy, options = {}) {
                 response.on("data", (chunk) => {
                     size += chunk.length;
                     if (size > limit) {
-                        settle(() => reject(new OutboundFailed(`The answer from ${originalHost} is larger than ${limit} bytes`, "TOO_LARGE")));
+                        settle(() => reject(new OutboundFailed(`The answer from ${originalHost} is larger than ${limit} bytes`, "TOO_LARGE", true)));
                         response.destroy();
                         return;
                     }
@@ -268,6 +277,9 @@ export function guardedFetch(policy, options = {}) {
                 response.on("error", failed);
                 response.on("aborted", () => failed(Object.assign(new Error("The answer was cut off"), { code: "ECONNRESET" })));
             });
+            sent.on("finish", () => {
+                delivered = true;
+            });
             sent.on("error", failed);
             sent.end(body);
         });

package/dist/tenant/runtime.js

@@ -5,7 +5,6 @@ import { tenantModelGate } from "../gates/in-process.js";
 import { createKekFile, readVaultKek } from "../vault/kek.js";
 import { SigningKeys } from "./signing-keys.js";
 import { VaultService } from "../vault/service.js";
-import { CredentialSources } from "../vault/sources.js";
 import { McpPool } from "../mcp/pool.js";
 import { SandboxManager } from "../sandbox/manager.js";
 import { storeSandboxRecords } from "../sandbox/records.js";
@@ -22,7 +21,6 @@ import { sweep } from "./sweep.js";
 import { TenantWorkers, WORKER_ID, } from "./worker.js";
 import { authorize } from "./effects.js";
 import { inProcessToolGate } from "../gates/tool-gate.js";
-import { guardedFetch } from "./outbound.js";
 import { inProcessKeys } from "../keys/keys.js";
 import { tenantApi } from "../api/http/app.js";
 import { createFsBlobStore } from "../blob/index.js";
@@ -118,16 +116,7 @@ export class TenantRuntime {
             const opened = store;
             // A seeded Tenant setting wins over the Host default (A18).
             const seededBackend = await opened.tx((t) => t.getSetting("sandbox.backend"));
-            const vault = new VaultService({
-                store: opened,
-                kek: ensureKek,
-                // OAuth refresh and connect follow the Host's address policy (F9 C2).
-                fetch: config.vaultFetch ?? guardedFetch(config.delivery ?? {}),
-            });
-            const credentials = new CredentialSources({
-                vault,
-                ...(config.resolver ? { resolver: config.resolver } : {}),
-            });
+            const vault = new VaultService({ store: opened, kek: ensureKek });
             // `ctx` is assigned below; these callbacks only run once the Tenant is open.
             let ctx;
             const toolGate = hooks.toolGate ??
@@ -137,7 +126,14 @@ export class TenantRuntime {
                     logger: config.logger,
                 });
             const signingKeys = new SigningKeys({ tenantId: config.tenantId, kek: ensureKek });
-            const keys = hooks.keys ?? inProcessKeys({ store: opened, vault, signingKeys, kek: ensureKek });
+            const keys = hooks.keys ??
+                inProcessKeys({
+                    store: opened,
+                    vault,
+                    signingKeys,
+                    kek: ensureKek,
+                    policy: config.delivery ?? {},
+                });
             const harnessMode = hooks.harness ?? "memory";
             const inProcess = harnessMode === "memory" || harnessMode === "json";
             const preference = seededBackend ?? config.sandbox.backend;
@@ -242,7 +238,6 @@ export class TenantRuntime {
                 reads: hooks.reads,
                 store: opened,
                 vault,
-                credentials,
                 ...(mcp ? { mcp } : {}),
                 sandbox,
                 flowLimits,

package/dist/tenant/sessions.js

@@ -10,7 +10,7 @@ import { aggregateWaits, isWorkflowManifest } from "../core/flow-host.js";
 import { canonical } from "../store/canonical.js";
 import { validateSandboxAttach } from "../core/sandbox-routes.js";
 import { resolveSandbox } from "../sandbox/resolve.js";
-import { withSandboxCapability } from "../sandbox/session-sandbox.js";
+import { withPlatformTools, withSandboxCapability } from "../sandbox/session-sandbox.js";
 import { declaredSandboxes, sandboxSpecOf, sessionSandboxSpec, } from "../sandbox/share.js";
 import { effectiveSandboxConfig, readSandboxConfig } from "../sandbox/tenant-config.js";
 import { checkPlacement, requirePods } from "../sandbox/placement.js";
@@ -156,12 +156,14 @@ export async function putSession(ctx, id, body, access, options = {}) {
         checkPlacement(await readSandboxConfig(t), sandbox.kind);
         if (sandbox.kind === "pod")
             await requirePods(ctx.pods, `Sandbox ${sandbox.sandboxId}`);
+        const pinned = sandbox.manifest === undefined ? platformTools(definition) : sandbox;
         const created = {
             id,
             agentId: body.agentId,
             ownerUserId: body.ownerUserId,
-            manifest: sandbox.manifest ?? definition.manifest,
-            manifestHash: sandbox.manifestHash ?? definition.manifestHash,
+            manifest: pinned.manifest ?? definition.manifest,
+            manifestHash: pinned.manifestHash ?? definition.manifestHash,
+            definitionHash: definition.manifestHash,
             implementationVersion: definition.implementationVersion,
             info: body.info,
             status: "idle",
@@ -232,6 +234,20 @@ async function sessionSandbox(t, body, definition, options) {
         return fail(resolved.status, resolved.errors.join(" "));
     return pin(definition, resolved.spec, resolved.source);
 }
+/**
+ * The manifest a session without a sandbox pins: its agents' `read_artifact` (R2b C11), when
+ * one has a remote MCP server or an HTTP tool; nothing otherwise, and for a workflow.
+ */
+function platformTools(definition) {
+    if (isWorkflowManifest(definition.manifest))
+        return {};
+    const pinned = withPlatformTools(definition.manifest);
+    if (pinned === undefined)
+        return {};
+    if (!pinned.ok)
+        return fail(400, pinned.message);
+    return { manifest: pinned.manifest, manifestHash: pinned.manifestHash };
+}
 async function pin(definition, spec, source) {
     // A workflow's manifest stays as registered: its agents inherit the sandbox when they start.
     if (isWorkflowManifest(definition.manifest))
@@ -269,6 +285,7 @@ export async function sessionView(t, s) {
         agentId: s.agentId,
         ownerUserId: s.ownerUserId,
         manifestHash: s.manifestHash,
+        ...(s.definitionHash === undefined ? {} : { definitionHash: s.definitionHash }),
         implementationVersion: s.implementationVersion,
         status: s.status,
         activeTurnId: s.activeTurnId,