@nylorun/runtime 0.20.0-beta → 0.21.0-beta

package/dist/gates/tool-contract.d.ts

@@ -11,7 +11,9 @@
  * Remote MCP. The gate holds the connection and the vault credential; the loop names the
  * server, never a URL or a credential, and the gate finds it in the session's pinned manifest.
  * - `POST /nylorun/v1/mcp/connect` `{server}`: opens the server's connection (vault
- *   authorization included), or keeps the open one.
+ *   authorization included), or keeps the open one. Its result is `{instructions}` when the
+ *   server gave instructions at `initialize` (R2b C10, for the note on its deferred tools), else
+ *   `null`.
  * - `POST /nylorun/v1/mcp/list` `{server, cursor?}`: one page of `tools/list`.
  * - `POST /nylorun/v1/tool-calls` `{server, effectId, name, arguments}`: one
  *   `tools/call`. With an `Idempotency-Key` (the effect id) the call outlives its client and runs
@@ -20,8 +22,12 @@
  *   gate_forbidden` for another session's call under a run token.
  * - `POST /nylorun/v1/mcp/close` `{server}`: closes the server's connection; `204`.
  * Each answers `200 {ok: true, result}` or `200 {ok: false, error}`: an MCP failure is an
- * answer, not a gate error. A keyed call whose earlier attempt was lost with the gateway answers
- * `{ok: false, error: {uncertain: true}}` and is never run again.
+ * answer, not a gate error. A tool call's failure is coded (`error.failure`, R2b C7), and neither
+ * a result nor a failure carries a credential value the gate sent (C8). An answer past 8 MiB is
+ * `mcp.too-large` (C11), as an HTTP tool's is `http.too-large`; core shapes what fits into a
+ * result the model can take (`tenant/tool-results.ts`). A keyed call whose
+ * earlier attempt was lost with the gateway answers `{ok: false, error: {uncertain: true}}` and
+ * is never run again.
  *
  * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
  * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, capabilityId, toolName}`), or a
@@ -33,6 +39,7 @@
  * model sees), or `{ok: false, error: {uncertain: true}}` for a call lost with the gateway.
  */
 import { z } from "zod";
+import type { McpCallFailure } from "../mcp/connect.js";
 export declare const MCP_CONNECT_PATH = "/nylorun/v1/mcp/connect";
 export declare const MCP_LIST_PATH = "/nylorun/v1/mcp/list";
 export declare const MCP_CLOSE_PATH = "/nylorun/v1/mcp/close";
@@ -99,10 +106,19 @@ export interface McpGateError {
     readonly credentialIds?: readonly string[];
     /** The call may have run: its earlier attempt was lost with the gateway. Never re-run. */
     readonly uncertain?: boolean;
+    /**
+     * How the request failed, coded (R2b C1, C7): the loop's `McpCallFailed`, which a tool call
+     * turns into a failed outcome the model sees (`mcp.lost` only for a read-only or idempotent
+     * tool). `credential_rejected` for a `401`, with the server and the scope of the vault whose
+     * credential was sent. Its message has no credential value in it (C8).
+     */
+    readonly failure?: McpCallFailure;
 }
 export type McpAnswer<T> = {
     readonly ok: true;
     readonly result: T;
+    /** A `tools/call`'s: how many credential values its result echoed, replaced (R2b C8). */
+    readonly redacted?: number;
 } | {
     readonly ok: false;
     readonly error: McpGateError;

package/dist/gates/tool-contract.js

@@ -11,7 +11,9 @@
  * Remote MCP. The gate holds the connection and the vault credential; the loop names the
  * server, never a URL or a credential, and the gate finds it in the session's pinned manifest.
  * - `POST /nylorun/v1/mcp/connect` `{server}`: opens the server's connection (vault
- *   authorization included), or keeps the open one.
+ *   authorization included), or keeps the open one. Its result is `{instructions}` when the
+ *   server gave instructions at `initialize` (R2b C10, for the note on its deferred tools), else
+ *   `null`.
  * - `POST /nylorun/v1/mcp/list` `{server, cursor?}`: one page of `tools/list`.
  * - `POST /nylorun/v1/tool-calls` `{server, effectId, name, arguments}`: one
  *   `tools/call`. With an `Idempotency-Key` (the effect id) the call outlives its client and runs
@@ -20,8 +22,12 @@
  *   gate_forbidden` for another session's call under a run token.
  * - `POST /nylorun/v1/mcp/close` `{server}`: closes the server's connection; `204`.
  * Each answers `200 {ok: true, result}` or `200 {ok: false, error}`: an MCP failure is an
- * answer, not a gate error. A keyed call whose earlier attempt was lost with the gateway answers
- * `{ok: false, error: {uncertain: true}}` and is never run again.
+ * answer, not a gate error. A tool call's failure is coded (`error.failure`, R2b C7), and neither
+ * a result nor a failure carries a credential value the gate sent (C8). An answer past 8 MiB is
+ * `mcp.too-large` (C11), as an HTTP tool's is `http.too-large`; core shapes what fits into a
+ * result the model can take (`tenant/tool-results.ts`). A keyed call whose
+ * earlier attempt was lost with the gateway answers `{ok: false, error: {uncertain: true}}` and
+ * is never run again.
  *
  * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
  * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, capabilityId, toolName}`), or a

package/dist/gates/tool-gate.d.ts

@@ -1,8 +1,8 @@
 /**
  * The Tool Gate seam (blueprint §12, F4.1). Every tool call that leaves the loop crosses one
  * `ToolGate`: a remote MCP server's connection and calls, and an HTTP tool's request (R2 M3).
- * The gate owns what those need that the loop must not hold: the MCP and HTTP tool credentials
- * and their OAuth refresh, and the outbound route.
+ * The gate owns what those need that the loop must not hold: the MCP and HTTP tool credentials,
+ * and the outbound route.
  *
  * Two implementations: `inProcessToolGate` (embedding, the ephemeral Runtime, tests), which
  * opens remote servers and calls HTTP tools in this process, and the HTTP client of the gates

package/dist/harness/calls.d.ts

@@ -46,6 +46,8 @@ export declare function invokeModel(route: ModelRoute, request: HostEffect, sign
 export declare function abortOn(signal: AbortSignal, kinds: readonly AbortReason[]): AbortSignal;
 /** True when `request` calls `save_artifact` of the `nylorun.artifacts` capability `manifest` has. */
 export declare function isSaveArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
+/** True when `request` calls `read_artifact` (R2b C11) of the `nylorun.artifacts` capability. */
+export declare function isReadArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
 /** True when `request` calls a tool of a declared MCP server (every one is remote). */
 export declare function isRemoteMcpCall(routing: Pick<ToolRouting, "rootManifest" | "mcpSnapshot">, request: HostEffect): boolean;
 export declare function callMcpTool(mcp: McpPool, routing: ToolRouting, request: HostEffect, signal: AbortSignal): Promise<unknown>;

package/dist/harness/calls.js

@@ -3,7 +3,7 @@
  * Tenant's provider), the Tool Gate, the MCP pool, the SandboxManager. No store, no record: the
  * session's routing comes with the run (`TurnStart.routing`).
  */
-import { ARTIFACTS_CAPABILITY_ID, SAVE_ARTIFACT_TOOL } from "@nylorun/core/define";
+import { ARTIFACTS_CAPABILITY_ID, READ_ARTIFACT_TOOL, SAVE_ARTIFACT_TOOL, } from "@nylorun/core/define";
 import { runAbortKind } from "@nylorun/harness/api";
 import { httpToolRefOf } from "../gates/http-tool.js";
 import { classifyThrown } from "../model/classify.js";
@@ -67,10 +67,18 @@ export function abortOn(signal, kinds) {
 }
 /** True when `request` calls `save_artifact` of the `nylorun.artifacts` capability `manifest` has. */
 export function isSaveArtifactCall(manifest, request) {
+    return isArtifactsToolCall(manifest, request, SAVE_ARTIFACT_TOOL);
+}
+/** True when `request` calls `read_artifact` (R2b C11) of the `nylorun.artifacts` capability. */
+export function isReadArtifactCall(manifest, request) {
+    return isArtifactsToolCall(manifest, request, READ_ARTIFACT_TOOL);
+}
+function isArtifactsToolCall(manifest, request, toolName) {
     return (request.kind === "tool" &&
         request.capabilityId === ARTIFACTS_CAPABILITY_ID &&
-        request.toolName === SAVE_ARTIFACT_TOOL &&
-        manifest?.capabilities.some((capability) => capability.id === ARTIFACTS_CAPABILITY_ID) === true);
+        request.toolName === toolName &&
+        manifest?.capabilities.some((capability) => capability.id === ARTIFACTS_CAPABILITY_ID &&
+            capability.tools?.some((tool) => tool.name === toolName) === true) === true);
 }
 /** True when `request` calls a tool of a declared MCP server (every one is remote). */
 export function isRemoteMcpCall(routing, request) {
@@ -94,6 +102,8 @@ export async function callMcpTool(mcp, routing, request, signal) {
         args: request.input,
         manifest: routing.rootManifest,
         effectId: request.effectId,
+        // A read-only or idempotent tool's lost answer is the model's to retry (R2b C7, Q15).
+        retrySafe: tool.annotations?.readOnlyHint === true || tool.annotations?.idempotentHint === true,
         signal,
     });
 }

package/dist/harness-api/record.d.ts

@@ -1,12 +1,13 @@
 /**
  * The Record seam of the Harness API: core's journal for the effects of a run. `recordIntent`
  * journals an effect before anything runs it, and either answers it from the journal, hands it
- * to core's own executors (flow work, delegation, `save_artifact` and the skill tools), tells
- * the harness to `execute` it (model calls; MCP, HTTP and sandbox tools; a flow's HTTP stages
- * and HTTP verifiers), or fails a tool the Runtime cannot run (one that would run the
- * developer's code, R2 M6). `recordOutcome`
- * records what the harness's call returned. Both run under the advance's lease: every write is
- * epoch-checked (`ownedSession`), and a lost epoch writes nothing.
+ * to core's own executors (flow work, delegation, `save_artifact`, `read_artifact`,
+ * `tool_search` and the skill tools), tells the harness to `execute` it (model calls; MCP, HTTP
+ * and sandbox tools, a deferred MCP tool's `tool_call` among them, whose effect names the tool;
+ * a flow's HTTP stages and HTTP verifiers), or fails a tool the Runtime cannot run (one that
+ * would run the developer's code, R2 M6). `recordOutcome` records what the harness's call returned, an
+ * agent's MCP or HTTP tool result first shaped to fit (R2b C11). Both run under the advance's
+ * lease: every write is epoch-checked (`ownedSession`), and a lost epoch writes nothing.
  *
  * Rows store the request's hash (`requestHash`) and, for a model call, the request without its
  * prompt: drift is a hash compare. Rows written before carry their full request, hashed on read.

package/dist/harness-api/record.js

@@ -1,12 +1,13 @@
 /**
  * The Record seam of the Harness API: core's journal for the effects of a run. `recordIntent`
  * journals an effect before anything runs it, and either answers it from the journal, hands it
- * to core's own executors (flow work, delegation, `save_artifact` and the skill tools), tells
- * the harness to `execute` it (model calls; MCP, HTTP and sandbox tools; a flow's HTTP stages
- * and HTTP verifiers), or fails a tool the Runtime cannot run (one that would run the
- * developer's code, R2 M6). `recordOutcome`
- * records what the harness's call returned. Both run under the advance's lease: every write is
- * epoch-checked (`ownedSession`), and a lost epoch writes nothing.
+ * to core's own executors (flow work, delegation, `save_artifact`, `read_artifact`,
+ * `tool_search` and the skill tools), tells the harness to `execute` it (model calls; MCP, HTTP
+ * and sandbox tools, a deferred MCP tool's `tool_call` among them, whose effect names the tool;
+ * a flow's HTTP stages and HTTP verifiers), or fails a tool the Runtime cannot run (one that
+ * would run the developer's code, R2 M6). `recordOutcome` records what the harness's call returned, an
+ * agent's MCP or HTTP tool result first shaped to fit (R2b C11). Both run under the advance's
+ * lease: every write is epoch-checked (`ownedSession`), and a lost epoch writes nothing.
  *
  * Rows store the request's hash (`requestHash`) and, for a model call, the request without its
  * prompt: drift is a hash compare. Rows written before carry their full request, hashed on read.
@@ -14,9 +15,12 @@
 import { HarnessApiError, effectRequestHash, } from "@nylorun/core/harness-api";
 import { isFlowEffect, isFlowToolEffect, recordVerdict, settleAgentEffect, } from "../core/flow-host.js";
 import { sandboxCapabilityOf } from "../sandbox/capability.js";
-import { isSaveArtifactCall } from "../harness/calls.js";
-import { callSaveArtifact } from "../tenant/artifact-tool.js";
+import { abortOn, isReadArtifactCall, isSaveArtifactCall } from "../harness/calls.js";
+import { callReadArtifact, callSaveArtifact } from "../tenant/artifact-tool.js";
+import { mayNeedShaping, resultBytes, resultLimit, shapeToolOutcome, } from "../tenant/tool-results.js";
 import { callSkillTool, isSkillToolCall } from "../tenant/skill-tool.js";
+import { callToolSearch, isToolSearchCall } from "../tenant/tool-search.js";
+import { turnManifestOf } from "../tenant/session.js";
 import { isOwnershipLost } from "../store/ownership.js";
 import { manifestFor, mcpToolOf } from "../mcp/snapshot.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
@@ -109,17 +113,24 @@ export async function recordIntent(scope, effect, requestHash) {
             throw new Error(`Agent '${request.agent?.id ?? ""}' is not used as a tool`);
         const executed = request.kind === "model" ||
             (request.kind === "tool" &&
-                (mcpToolOf(s.mcpSnapshot, request) !== undefined ||
+                // An MCP tool the turn's manifest disables is not one (R2b C9).
+                (mcpToolOf(s.mcpSnapshot, request, turnManifestOf(s)) !== undefined ||
                     // HTTP tools (R2 M3) cross the Tool Gate.
                     isHttpToolCall(s.manifest, request) ||
                     sandboxCapabilityOf(agentManifest, request.capabilityId, request.toolName) !== undefined ||
-                    // `save_artifact` (F8.1) runs beside the sandbox tools, and the skill tools (R2 M4).
+                    // `save_artifact` (F8.1) runs beside the sandbox tools, as do `read_artifact` (R2b
+                    // C11) and the skill tools (R2 M4).
                     isSaveArtifactCall(agentManifest, request) ||
-                    isSkillToolCall(agentManifest, request)));
+                    isReadArtifactCall(agentManifest, request) ||
+                    isSkillToolCall(agentManifest, request) ||
+                    // `tool_search` (R2b C10) reads the session's pinned MCP snapshot: core serves it.
+                    isToolSearchCall(agentManifest, request)));
         if (!executed) {
             // A tool that would run the developer's code: refused at save (a turn's manifest only
-            // removes tools), so this is a backstop. The model sees the failure; nothing runs.
-            const outcome = { value: unrunnableTool(request) };
+            // removes tools), so this is a backstop, as is an MCP tool the turn disabled, which the
+            // model was never offered. The model sees the failure; nothing runs.
+            const disabled = request.kind === "tool" && mcpToolOf(s.mcpSnapshot, request) !== undefined;
+            const outcome = { value: disabled ? disabledTool(request) : unrunnableTool(request) };
             await t.put("effects", request.effectId, { request, requestHash, status: "completed", outcome });
             const transcript = toolCompleted(request, outcome.value);
             if (transcript)
@@ -135,13 +146,22 @@ export async function recordIntent(scope, effect, requestHash) {
         // workspace capability, wherever the sandbox is.
         if (request.kind === "tool" && isSaveArtifactCall(agentManifest, request))
             return "save";
+        // `read_artifact` reads the session's artifacts: core serves it, with or without a sandbox.
+        if (isReadArtifactCall(agentManifest, request))
+            return "read";
         // The skill tools read the agent's definition files: core serves them.
         if (isSkillToolCall(agentManifest, request))
             return { skill: agentManifest };
+        if (isToolSearchCall(agentManifest, request))
+            return "search";
         return { status: "execute" };
     });
     if (answer === "save")
         return runInCore(scope, request, () => callSaveArtifact(scope.ctx, request, scope.signal));
+    if (answer === "read")
+        return runInCore(scope, request, () => callReadArtifact(scope.ctx, request, scope.signal));
+    if (answer === "search")
+        return runInCore(scope, request, () => callToolSearch(scope.ctx, request));
     if (typeof answer === "object" && "skill" in answer)
         return runInCore(scope, request, () => callSkillTool(scope.ctx, answer.skill, request, scope.signal));
     if (answer !== "flow")
@@ -151,9 +171,10 @@ export async function recordIntent(scope, effect, requestHash) {
     return resolveNewFlowEffect(ctx, request, signal, lease);
 }
 /**
- * Runs a tool core serves (`save_artifact`, F8.1; the skill tools, R2 M4) for the run and records
- * its outcome, as a harness would record a call it ran: the run gets the outcome as the intent's
- * answer.
+ * Runs a tool core serves (`save_artifact`, F8.1; `read_artifact`, R2b C11; `tool_search`, R2b
+ * C10; the skill tools, R2 M4) for the run and records its outcome, as a harness would record a
+ * call it ran: the run gets
+ * the outcome as the intent's answer.
  */
 async function runInCore(scope, request, call) {
     let value;
@@ -169,6 +190,14 @@ async function runInCore(scope, request, call) {
     }
     return recordOutcome(scope, request.effectId, { value });
 }
+/** The failed outcome of an MCP tool the turn's manifest disables (R2b C9). */
+function disabledTool(request) {
+    return {
+        kind: "failed",
+        code: "tool.disabled",
+        message: `Tool '${request.toolName ?? ""}' is disabled by its MCP server's tools settings.`,
+    };
+}
 /** The failed outcome of a tool the Runtime cannot run: it would run the developer's code. */
 function unrunnableTool(request) {
     return {
@@ -199,7 +228,7 @@ export async function recordOutcome(scope, effectId, result) {
         });
         return { status: "uncertain" };
     }
-    const { value } = result;
+    const value = await shaped(scope, effectId, result.value);
     return ctx.store.tx(async (t) => {
         const s = await t.assertEpoch(lease.sessionId, lease.epoch);
         const effect = await t.get("effects", effectId);
@@ -234,6 +263,59 @@ export async function recordOutcome(scope, effectId, result) {
         return { status: "completed", outcome: effect.outcome };
     });
 }
+/**
+ * The outcome of an agent's remote MCP or HTTP tool call, shaped to fit before anything records
+ * it (R2b C11, `tenant/tool-results.ts`): what does not fit becomes the session's artifacts. Any
+ * other outcome, and one a cancel will discard, as it is. Only a cancel stops the upload: after a
+ * shutdown or a deadline the outcome is still recorded, so the next advance replays it.
+ *
+ * Its cap is what its step's budget has left (`resultLimit`): a step's results are one transcript
+ * entry. Parallel results are counted under the session lock, each reserving its share on its
+ * row (`resultBytes`) before it is shaped, so two never spend the same room.
+ */
+async function shaped(scope, effectId, value) {
+    const { ctx, lease, signal } = scope;
+    if (abortKind(signal) === "cancel" || !mayNeedShaping(value))
+        return value;
+    const call = await ctx.store.tx(async (t) => {
+        const s = await t.lockSession(lease.sessionId);
+        const effect = await t.get("effects", effectId);
+        if (!s || !effect || effect.status === "completed")
+            return undefined;
+        const request = effect.request;
+        // An agent's tool; a flow's HTTP stage or verifier names no capability, and its output is data.
+        if (request.kind !== "tool" || request.capabilityId === undefined)
+            return undefined;
+        const mcp = mcpToolOf(s.mcpSnapshot, request) !== undefined;
+        if (!mcp && !isHttpToolCall(s.manifest, request))
+            return undefined;
+        const step = stepOf(request);
+        let used = 0;
+        if (step !== undefined)
+            for (const other of await t.effectsForTurn(s.id, request.turnId, [
+                "invoking",
+                "completed",
+            ])) {
+                if (other.request.effectId === effectId || stepOf(other.request) !== step)
+                    continue;
+                used +=
+                    other.resultBytes ??
+                        (other.status === "completed" ? resultBytes(other.outcome?.value) : 0);
+            }
+        const limit = resultLimit(used);
+        effect.resultBytes = Math.min(resultBytes(value), limit);
+        await t.put("effects", effectId, effect);
+        return { request, session: { id: s.id, ownerUserId: s.ownerUserId }, mcp, limit };
+    });
+    return call ? shapeToolOutcome(ctx, call, value, abortOn(signal, ["cancel"])) : value;
+}
+/** The model step a tool call answers, and whose agent: its results share one transcript entry. */
+function stepOf(request) {
+    if (request.kind !== "tool")
+        return undefined;
+    const stepId = request.context?.stepId;
+    return typeof stepId === "string" ? JSON.stringify([request.agent?.id ?? null, stepId]) : undefined;
+}
 /** What a journal row keeps of a request: a model call without its prompt. */
 function storedRequest(request) {
     if (request.kind !== "model" || request.input === undefined)

package/dist/harness-api/server.js

@@ -29,7 +29,9 @@ import { HARNESS_API_VERSION, HARNESS_CLAIMS, HarnessApiError, } from "@nylorun/
 import { definitionFilesOf } from "@nylorun/core/contracts";
 import { isOwnershipLost } from "../store/ownership.js";
 import { ownedSession } from "../tenant/context.js";
-import { mcpDiscovered, sessionToolsOf } from "../mcp/snapshot.js";
+import { mcpDiscovered, pinDeferral, sessionToolsOf, } from "../mcp/snapshot.js";
+import { contextWindowOf } from "../model/catalog.js";
+import { turnManifestOf } from "../tenant/session.js";
 import { sandboxWorkspaceKey, workspacePrefix } from "../sandbox/records.js";
 import { abortKind } from "../tenant/worker.js";
 import { readDefinitionFile } from "../tenant/definition-files.js";
@@ -194,36 +196,42 @@ export function createHarnessApiServer(ctx, options = {}) {
      * session wins, with `mcp.discovered` in its log; diagnostics replace those of the same server.
      * Answers the session's snapshot and the tools the engine advertises.
      */
-    const recordMcp = (run, params) => ctx.store.tx(async (t) => {
-        const { lease } = run.offer;
-        const current = await ownedSession(t, lease, lease.sessionId);
-        const diagnostics = params.diagnostics;
+    const recordMcp = async (run, params) => {
         const snapshot = params.snapshot;
         if (snapshot !== undefined && !isSnapshot(snapshot))
             throw new HarnessApiError("invalid", "The MCP snapshot is malformed");
-        if (snapshot && !current.mcpSnapshot) {
-            current.mcpSnapshot = snapshot;
-            current.mcpDiagnostics = diagnostics;
-            await t.put("sessions", current.id, current);
-            await t.event(current.id, run.grant.turnId, "mcp.discovered", mcpDiscovered(snapshot, diagnostics));
-        }
-        else if (diagnostics.length > 0) {
-            const prior = [...(current.mcpDiagnostics ?? [])];
-            for (const item of diagnostics) {
-                const index = prior.findIndex((existing) => existing.capabilityId === item.capabilityId && existing.serverName === item.serverName);
-                if (index >= 0)
-                    prior[index] = item;
-                else
-                    prior.push(item);
+        // Which MCP tools the model reaches through tool_search, decided once for the session from
+        // the Tenant's model's context window (R2b C10, Q21).
+        const contextWindow = snapshot ? contextWindowOf(await ctx.vault.getHostModel()) : 0;
+        return ctx.store.tx(async (t) => {
+            const { lease } = run.offer;
+            const current = await ownedSession(t, lease, lease.sessionId);
+            const diagnostics = params.diagnostics;
+            if (snapshot && !current.mcpSnapshot) {
+                current.mcpSnapshot = pinDeferral(snapshot, current.manifest, contextWindow);
+                current.mcpDiagnostics = diagnostics;
+                await t.put("sessions", current.id, current);
+                await t.event(current.id, run.grant.turnId, "mcp.discovered", mcpDiscovered(current.mcpSnapshot, diagnostics));
             }
-            current.mcpDiagnostics = prior;
-            await t.put("sessions", current.id, current);
-        }
-        return {
-            ...(current.mcpSnapshot ? { snapshot: current.mcpSnapshot } : {}),
-            sessionTools: [...(sessionToolsOf(current.mcpSnapshot, current.manifest) ?? [])],
-        };
-    });
+            else if (diagnostics.length > 0) {
+                const prior = [...(current.mcpDiagnostics ?? [])];
+                for (const item of diagnostics) {
+                    const index = prior.findIndex((existing) => existing.capabilityId === item.capabilityId && existing.serverName === item.serverName);
+                    if (index >= 0)
+                        prior[index] = item;
+                    else
+                        prior.push(item);
+                }
+                current.mcpDiagnostics = prior;
+                await t.put("sessions", current.id, current);
+            }
+            return {
+                ...(current.mcpSnapshot ? { snapshot: current.mcpSnapshot } : {}),
+                // The turn's manifest: a variant may have disabled tools or required their approval.
+                sessionTools: [...(sessionToolsOf(current.mcpSnapshot, turnManifestOf(current)) ?? [])],
+            };
+        });
+    };
     /** A definition file the run's definition names (its skills', for its sandbox), base64. */
     const definitionFile = async (run, sha256, signal) => {
         if (!definitionFilesOf(run.offer.start.routing.rootManifest).has(sha256))

package/dist/harness-api/start.js

@@ -57,7 +57,8 @@ export function buildTurnStart(ctx, segment) {
         checkpoint: !flow && cp.state
             ? { ...cp, state: withTranscript(cp.state, []) }
             : cp,
-        ...(flow ? {} : { sessionTools: sessionToolsOf(current.mcpSnapshot, current.manifest) ?? [] }),
+        // The turn's manifest: a variant may have disabled MCP tools or required their approval.
+        ...(flow ? {} : { sessionTools: sessionToolsOf(current.mcpSnapshot, turnManifestOf(current)) ?? [] }),
         outcomes: segment.outcomes,
         transcript: { cursor: segment.cursor },
         options: {

package/dist/host/config-for.d.ts

@@ -14,6 +14,4 @@ export declare function configForFactory(options: {
     delivery?: TenantConfig["delivery"];
     /** The trusted issuers of the identity file (`NYLORUN_IDENTITY_FILE`). */
     issuers?: TenantConfig["issuers"];
-    /** `NYLORUN_PUBLIC_URL`: the base of the MCP OAuth callback (F9 C2). */
-    publicUrl?: string;
 }): (id: string) => TenantConfig;

package/dist/host/config-for.js

@@ -16,7 +16,6 @@ export function configForFactory(options) {
             model: options.model ?? { kind: "vault" },
             ...(options.delivery ? { delivery: options.delivery } : {}),
             ...(options.issuers ? { issuers: options.issuers } : {}),
-            ...(options.publicUrl ? { publicUrl: options.publicUrl } : {}),
             logger: {
                 info: (message, fields) => options.logger.info(message, { tenantId: id, ...fields }),
                 warn: (message, fields) => options.logger.warn(message, { tenantId: id, ...fields }),

package/dist/host/gates.js

@@ -38,7 +38,6 @@ export async function startGates(options) {
         vaults = createTenantVaults({
             sql: database,
             hostRoot: options.hostRoot,
-            ...(gates.resolver ? { resolver: gates.resolver } : {}),
             ...(options.delivery ? { delivery: options.delivery } : {}),
         });
     }

package/dist/host/main.js

@@ -139,6 +139,17 @@ async function ensureBucket(store, bucket, logger) {
         }
     }
 }
+/**
+ * Settings of a removed feature that are still set: logged, never fatal. The credential
+ * resolver (`NYLORUN_RESOLVER_*`) is gone in protocol 10. Never logs the values.
+ */
+function warnRemovedSettings(stack, logger) {
+    if (stack.removedResolverVariables)
+        logger.warn("resolver_removed", {
+            variables: stack.removedResolverVariables,
+            message: "The credential resolver is gone (protocol 10) and these variables are ignored: keep a person's keys in their user vault, or reach their accounts through a gateway",
+        });
+}
 /**
  * The gateway's services: the Model Gate's listener (gates, keys) and egress-gate's (egress), over
  * the Postgres pool and the Host's tenant directory. Writes nothing to the Host root (the local
@@ -153,9 +164,8 @@ async function runGates(stack) {
         ...(stack.packing ? { packing: stack.packing } : {}),
         endpoints: describeEndpoints(stack.endpoints),
         objectStore: stack.objectStore ? "s3" : "none",
-        // Never the resolver's URL or token: only whether one is set (F9 C1).
-        resolver: stack.gates?.resolver ? "configured" : "none",
     });
+    warnRemovedSettings(stack, logger);
     const database = createDatabase(stack);
     const servers = [];
     try {
@@ -234,6 +244,7 @@ export async function main() {
             file: identityFile,
             issuers: issuers.issuers.map((issuer) => issuer.config.name),
         });
+    warnRemovedSettings(stack, logger);
     if (stack.deprecatedRole)
         logger.warn("deprecated_flag", {
             flag: "--role",
@@ -261,7 +272,6 @@ export async function main() {
         logger,
         ...(stack.delivery ? { delivery: stack.delivery } : {}),
         ...(issuers ? { issuers } : {}),
-        ...(stack.publicUrl ? { publicUrl: stack.publicUrl } : {}),
     });
     // The process's Durable Session Execution: Restate when its endpoints are set, else the
     // in-process memory execution. An invocation that arrives while the Tenant opens waits for it.

package/dist/host/stack-config.d.ts

@@ -54,14 +54,6 @@ export interface GatesConfig {
     listen: ContainerListen;
     /** `NYLORUN_GATES_TOKEN`: the bearer the loop presents; at least 32 bytes as hex. */
     token: string;
-    /**
-     * The operator's credential resolver (`NYLORUN_RESOLVER_URL`, `NYLORUN_RESOLVER_TOKEN`), asked
-     * for a person's MCP credential when the session's vaults hold none (F9 C1). Absent: vaults only.
-     */
-    resolver?: {
-        url: string;
-        token: string;
-    };
 }
 /** egress-gate's listener (`NYLORUN_EGRESS_LISTEN_HOST`, `NYLORUN_EGRESS_LISTEN_PORT`). */
 export interface EgressConfig {
@@ -168,6 +160,11 @@ export interface StackConfig {
     packing?: "combined" | "split";
     /** Set when the process was started with the deprecated `--role` (logged at startup). */
     deprecatedRole?: RuntimeRole;
+    /**
+     * The removed credential resolver's variables (`NYLORUN_RESOLVER_*`, protocol 10) the
+     * environment still sets: ignored, and logged at startup as `resolver_removed`.
+     */
+    removedResolverVariables?: string[];
     /** Present in container mode; absent means bind what host.json names. */
     listen?: ContainerListen;
     endpoints: StackEndpoints;

package/dist/host/stack-config.js

@@ -15,8 +15,8 @@
  * `NYLORUN_GATES_TOKEN`. In a container, loop requires the gate: the loop
  * process must never hold a model credential. `egress` (egress-gate, F7.2) joins gates and keys
  * in the gateway and parses its listener (`NYLORUN_EGRESS_LISTEN_*`, default `0.0.0.0:4200`).
- * Only gates reads the operator's credential resolver (`NYLORUN_RESOLVER_URL`,
- * `NYLORUN_RESOLVER_TOKEN`, F9 C1): remote MCP calls are authorized in the gateway.
+ * The credential resolver is gone (protocol 10): its `NYLORUN_RESOLVER_*` variables are ignored,
+ * and the Host logs `resolver_removed` when one is set.
  *
  * `harness` (F6.2) runs alone: it holds the harness credential and nothing else. It connects to
  * core's Harness API listener (`NYLORUN_HARNESS_URL`, `NYLORUN_HARNESS_TOKEN`), calls models and
@@ -304,9 +304,13 @@ export function parseStackConfig(env, argv) {
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
     const objectStore = parseObjectStore(env);
+    const removedResolverVariables = Object.keys(env)
+        .filter((name) => name.startsWith(REMOVED_RESOLVER_PREFIX) && read(env, name) !== undefined)
+        .sort();
     return {
         services,
         ...(deprecatedRole ? { deprecatedRole } : {}),
+        ...(removedResolverVariables.length ? { removedResolverVariables } : {}),
         ...(gates ? { gates } : {}),
         ...(egress ? { egress } : {}),
         ...(modelGate ? { modelGate } : {}),
@@ -509,28 +513,13 @@ function parseGates(env) {
         throw new StackConfigError("NYLORUN_GATES_TOKEN is required for --service gates: the token the loop presents (`nylorun start` sets it)");
     if (!GATES_TOKEN.test(token))
         throw new StackConfigError("NYLORUN_GATES_TOKEN must be at least 32 bytes as hex");
-    const resolver = parseResolver(env);
     return {
         listen: { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] },
         token,
-        ...(resolver ? { resolver } : {}),
     };
 }
-/** `GatesConfig.resolver` from `NYLORUN_RESOLVER_URL` and `NYLORUN_RESOLVER_TOKEN`: both or neither. */
-function parseResolver(env) {
-    const url = parseUrl(env, "NYLORUN_RESOLVER_URL", ["http:", "https:"]);
-    const token = read(env, "NYLORUN_RESOLVER_TOKEN");
-    if (url === undefined) {
-        if (token !== undefined)
-            throw new StackConfigError("NYLORUN_RESOLVER_TOKEN is set without NYLORUN_RESOLVER_URL: set the URL of your credential resolver");
-        return undefined;
-    }
-    if (token === undefined)
-        throw new StackConfigError("NYLORUN_RESOLVER_TOKEN is required with NYLORUN_RESOLVER_URL: the bearer the gateway presents to your credential resolver");
-    if (/\s/.test(token))
-        throw new StackConfigError("NYLORUN_RESOLVER_TOKEN cannot contain whitespace");
-    return { url, token };
-}
+/** The prefix of the credential resolver's variables (removed in protocol 10). */
+const REMOVED_RESOLVER_PREFIX = "NYLORUN_RESOLVER_";
 /** `StackConfig.egress` from `NYLORUN_EGRESS_LISTEN_*`. CONNECT has no Host header to check. */
 function parseEgress(env) {
     const host = read(env, "NYLORUN_EGRESS_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;

package/dist/index.d.ts

@@ -4,7 +4,6 @@ export { parseIdentityFile, IdentityFileError, type TrustedIssuerConfig, } from
 export { createTrustedIssuers, type TrustedIssuers, type TrustedIssuersOptions, } from "./tenant/issuers.js";
 export type { TenantConfig, TenantHandle, TenantPaths, Logger, OpenTenantRuntime, } from "./tenant/types.js";
 export { scriptedModel, gatewayModel, type ModelProvider } from "./core/provider.js";
-export type { ResolverConfig } from "./vault/sources.js";
 export type { RuntimeAgent } from "./contracts.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
 export type { RuntimeModelAdapter } from "./contracts.js";

package/dist/keys/client.js

@@ -12,18 +12,10 @@ import { KEYS_PATH } from "./contract.js";
 import { KEYS_OPERATIONS } from "./keys.js";
 /** Signing and vault writes are short; anything slower is a gateway in trouble. */
 const KEYS_TIMEOUT_MS = 30_000;
-/**
- * MCP OAuth connect calls the authorization server several times (discovery, registration, the
- * code exchange), each bounded by `guardedFetch`'s 30 s: these wait longer.
- */
-const SLOW_OPERATIONS = {
-    startOAuth: 120_000,
-    finishOAuth: 60_000,
-};
 export function httpKeys(options) {
     const where = new URL(options.url).origin;
     function call(operation, args) {
-        const timeoutMs = Math.max(options.timeoutMs ?? KEYS_TIMEOUT_MS, SLOW_OPERATIONS[operation] ?? 0);
+        const timeoutMs = options.timeoutMs ?? KEYS_TIMEOUT_MS;
         const url = new URL(`${KEYS_PATH}/${operation}`, options.url);
         const send = url.protocol === "https:" ? httpsRequest : httpRequest;
         const payload = Buffer.from(JSON.stringify({ args }), "utf8");