@nylorun/runtime 0.20.0-beta → 0.21.1-beta

package/dist/redact.d.ts

@@ -1 +1,19 @@
-export declare function scrub(value: unknown, secrets: readonly string[]): unknown;
+export interface ScrubOptions {
+    /**
+     * Replace only `secrets` (R2b C8, Q16): no value under a secret-looking key, and no inline
+     * image data. A tool's answer keeps fields such as `nextToken`.
+     */
+    readonly valuesOnly?: boolean;
+    /** Told how many times a secret was replaced. */
+    readonly counted?: (replacements: number) => void;
+}
+/**
+ * `value` with each of `secrets` (those of at least 8 characters) replaced by `[redacted]`. By
+ * default also any value under a key such as `token` or `secret`, and inline image data.
+ */
+export declare function scrub(value: unknown, secrets: readonly string[], options?: ScrubOptions): unknown;
+/** `value` with `secrets` alone replaced (`valuesOnly`), and how many replacements were made. */
+export declare function scrubValues<T>(value: T, secrets: readonly string[]): {
+    value: T;
+    redacted: number;
+};

package/dist/redact.js

@@ -1,14 +1,43 @@
-export function scrub(value, secrets) {
-    if (typeof value === "string")
-        return secrets.reduce((text, secret) => secret.length >= 8 ? text.split(secret).join("[redacted]") : text, value.replace(/data:image\/[a-z0-9.+-]+;base64,[A-Za-z0-9+/=]+/giu, "[inline image data redacted]"));
-    if (Array.isArray(value))
-        return value.map((item) => scrub(item, secrets));
-    if (value && typeof value === "object")
-        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-            key,
-            /^(authorization|api[_-]?key|(?:access|refresh|id|auth)[_-]?token|token|secret|password|cookie|credentials?)$/iu.test(key)
-                ? "[redacted]"
-                : scrub(item, secrets),
-        ]));
-    return value;
+/**
+ * `value` with each of `secrets` (those of at least 8 characters) replaced by `[redacted]`. By
+ * default also any value under a key such as `token` or `secret`, and inline image data.
+ */
+export function scrub(value, secrets, options = {}) {
+    // The longest first, so a header value goes whole before the token inside it.
+    const sorted = secrets.filter((secret) => secret.length >= 8).sort((a, b) => b.length - a.length);
+    let replaced = 0;
+    const walk = (item) => {
+        if (typeof item === "string") {
+            const text = options.valuesOnly
+                ? item
+                : item.replace(/data:image\/[a-z0-9.+-]+;base64,[A-Za-z0-9+/=]+/giu, "[inline image data redacted]");
+            return sorted.reduce((current, secret) => {
+                const parts = current.split(secret);
+                replaced += parts.length - 1;
+                return parts.join("[redacted]");
+            }, text);
+        }
+        if (Array.isArray(item))
+            return item.map(walk);
+        if (item && typeof item === "object")
+            return Object.fromEntries(Object.entries(item).map(([key, entry]) => [
+                key,
+                !options.valuesOnly &&
+                    /^(authorization|api[_-]?key|(?:access|refresh|id|auth)[_-]?token|token|secret|password|cookie|credentials?)$/iu.test(key)
+                    ? "[redacted]"
+                    : walk(entry),
+            ]));
+        return item;
+    };
+    const result = walk(value);
+    options.counted?.(replaced);
+    return result;
+}
+/** `value` with `secrets` alone replaced (`valuesOnly`), and how many replacements were made. */
+export function scrubValues(value, secrets) {
+    if (secrets.length === 0)
+        return { value, redacted: 0 };
+    let redacted = 0;
+    const scrubbed = scrub(value, secrets, { valuesOnly: true, counted: (count) => (redacted = count) });
+    return { value: redacted === 0 ? value : scrubbed, redacted };
 }

package/dist/sandbox/session-sandbox.d.ts

@@ -9,3 +9,10 @@ export type SandboxedManifest = {
 };
 /** The agent's manifest with the sandbox capability added, or why it cannot take one. */
 export declare function withSandboxCapability(manifest: AgentManifest, spec: SandboxManifest): SandboxedManifest;
+/**
+ * The pinned manifest of an agent session without a sandbox: `read_artifact` for each agent of
+ * the tree with a remote MCP server or an HTTP tool (R2b C11), and `nylorun.tools` for each with
+ * a remote MCP server (R2b C10). Undefined when nothing is added, and the session pins its
+ * definition as it is.
+ */
+export declare function withPlatformTools(manifest: AgentManifest): SandboxedManifest | undefined;

package/dist/sandbox/session-sandbox.js

@@ -1,13 +1,23 @@
 /**
- * Gives a session the sandbox chosen when it was opened. An agent session's pinned manifest is
- * its definition plus the `nylorun.sandbox` capability (the six built-in tools, the sandbox
- * instructions and the resolved spec) and the `nylorun.artifacts` capability (`save_artifact`),
- * also added to each agent it uses as a tool, so the tree shares one spec. The sandbox's
- * instructions name the agent's skills' folders (`/skills/<name>/`). The definition in the
- * registry never changes.
+ * Gives a session the sandbox chosen when it was opened, and the platform tools its agents
+ * need. An agent session's pinned manifest is its definition plus:
+ *
+ * - with a sandbox, the `nylorun.sandbox` capability (the six built-in tools, the sandbox
+ *   instructions and the resolved spec) and the `nylorun.artifacts` capability
+ *   (`save_artifact`), also added to each agent it uses as a tool, so the tree shares one spec.
+ *   The sandbox's instructions name the agent's skills' folders (`/skills/<name>/`);
+ * - for each agent of the tree with a remote MCP server or an HTTP tool, `read_artifact` in its
+ *   `nylorun.artifacts` capability (R2b C11), with or without a sandbox: the Runtime stores a
+ *   result of those tools too large to show as an artifact, and the model reads it in pages.
+ *   An agent that declares a tool named `read_artifact` keeps its own, and sees previews only;
+ * - for each agent of the tree with a remote MCP server, the `nylorun.tools` capability (R2b
+ *   C10), empty: when the session defers some of the agent's MCP tools, its session tools put
+ *   `tool_search` and `tool_call` there. An agent that declares either name defers nothing.
+ *
+ * The definition in the registry never changes.
  */
 import { AgentManifestSchema } from "@nylorun/core/contracts";
-import { artifactsCapabilityManifest, hashManifest, sandboxCapabilityManifest, } from "@nylorun/core/define";
+import { READ_ARTIFACT_TOOL, TOOL_CALL_TOOL, TOOL_SEARCH_TOOL, TOOLS_CAPABILITY_ID, artifactsCapabilityManifest, hashManifest, sandboxCapabilityManifest, toolsCapabilityManifest, } from "@nylorun/core/define";
 import { sandboxSpecOf } from "./share.js";
 function isAgentManifest(value) {
     return (typeof value === "object" &&
@@ -19,35 +29,72 @@ function isAgentManifest(value) {
 function skillNamesOf(manifest) {
     return manifest.capabilities.flatMap((capability) => Object.keys(capability.skills ?? {})).sort();
 }
-function addCapability(manifest, spec) {
-    const capabilities = manifest.capabilities.map((capability) => capability.tools === undefined
-        ? capability
-        : {
-            ...capability,
-            tools: capability.tools.map((tool) => {
-                // Agents used as tools share the session's sandbox; flow agents used as tools run
-                // in linked sessions that inherit it.
-                if (tool.agent === undefined || !isAgentManifest(tool.agent))
-                    return tool;
-                if (sandboxSpecOf(tool.agent) !== undefined)
-                    return tool;
-                return { ...tool, agent: addCapability(tool.agent, spec) };
-            }),
+/**
+ * True when the agent itself declares a remote MCP server or an HTTP tool, whose results the
+ * Runtime may store as artifacts (R2b C11), and no tool of its own is named `read_artifact`.
+ */
+function readsStoredResults(manifest) {
+    const remote = manifest.capabilities.some((capability) => Object.keys(capability.mcpServers ?? {}).length > 0 ||
+        (capability.tools ?? []).some((tool) => tool.http !== undefined));
+    const taken = manifest.capabilities.some((capability) => (capability.tools ?? []).some((tool) => tool.name === READ_ARTIFACT_TOOL));
+    return remote && !taken;
+}
+/**
+ * True when the agent itself declares a remote MCP server, some of whose tools the session may
+ * defer (R2b C10), and names no tool `tool_search` or `tool_call` (it then keeps every tool in
+ * its list).
+ */
+function defersTools(manifest) {
+    const servers = manifest.capabilities.some((capability) => Object.keys(capability.mcpServers ?? {}).length > 0);
+    const taken = manifest.capabilities.some((capability) => capability.id === TOOLS_CAPABILITY_ID ||
+        (capability.tools ?? []).some((tool) => tool.name === TOOL_SEARCH_TOOL || tool.name === TOOL_CALL_TOOL));
+    return servers && !taken;
+}
+/** `manifest` with the session's capabilities added; the same object when none are. */
+function addCapabilities(manifest, spec) {
+    let changed = false;
+    const capabilities = manifest.capabilities.map((capability) => {
+        if (capability.tools === undefined)
+            return capability;
+        let toolsChanged = false;
+        const tools = capability.tools.map((tool) => {
+            // Agents used as tools share the session's sandbox; flow agents used as tools run in
+            // linked sessions that inherit it. One that declares its own sandbox keeps it.
+            if (tool.agent === undefined || !isAgentManifest(tool.agent))
+                return tool;
+            const agent = addCapabilities(tool.agent, sandboxSpecOf(tool.agent) === undefined ? spec : undefined);
+            if (agent === tool.agent)
+                return tool;
+            toolsChanged = true;
+            return { ...tool, agent };
         });
+        if (!toolsChanged)
+            return capability;
+        changed = true;
+        return { ...capability, tools };
+    });
+    const save = spec !== undefined;
+    const read = readsStoredResults(manifest);
+    const defer = defersTools(manifest);
+    if (!save && !read && !defer && !changed)
+        return manifest;
     return {
         ...manifest,
         // With a sandbox comes `save_artifact`, so files the agent makes reach the user (F8.1). The
         // sandbox's instructions name where the agent's skills are (R2 M4).
         capabilities: [
             ...capabilities,
-            sandboxCapabilityManifest(spec, { skills: skillNamesOf(manifest) }),
-            artifactsCapabilityManifest(),
+            ...(spec === undefined
+                ? []
+                : [sandboxCapabilityManifest(spec, { skills: skillNamesOf(manifest) })]),
+            ...(save || read ? [artifactsCapabilityManifest({ save, read })] : []),
+            // Empty: when the session defers MCP tools, its tools put tool_search and tool_call here.
+            ...(defer ? [toolsCapabilityManifest()] : []),
         ],
     };
 }
-/** The agent's manifest with the sandbox capability added, or why it cannot take one. */
-export function withSandboxCapability(manifest, spec) {
-    const sandboxed = addCapability(manifest, spec);
+/** `sandboxed` checked as a manifest, with its hash. */
+function checked(original, sandboxed) {
     const parsed = AgentManifestSchema.safeParse(sandboxed);
     if (!parsed.success) {
         const issues = parsed.error.issues.map((issue) => issue.message);
@@ -55,9 +102,23 @@ export function withSandboxCapability(manifest, spec) {
         return {
             ok: false,
             message: clash
-                ? `'${manifest.id}' declares a tool named like a sandbox tool (bash, read, write, edit, grep, glob, save_artifact). Rename it, or open the session with sandbox: false.`
-                : `'${manifest.id}' cannot take this sandbox: ${[...new Set(issues)].join("; ")}`,
+                ? `'${original.id}' declares a tool named like a sandbox tool (bash, read, write, edit, grep, glob, save_artifact). Rename it, or open the session with sandbox: false.`
+                : `'${original.id}' cannot take this sandbox: ${[...new Set(issues)].join("; ")}`,
         };
     }
     return { ok: true, manifest: sandboxed, manifestHash: hashManifest(sandboxed) };
 }
+/** The agent's manifest with the sandbox capability added, or why it cannot take one. */
+export function withSandboxCapability(manifest, spec) {
+    return checked(manifest, addCapabilities(manifest, spec));
+}
+/**
+ * The pinned manifest of an agent session without a sandbox: `read_artifact` for each agent of
+ * the tree with a remote MCP server or an HTTP tool (R2b C11), and `nylorun.tools` for each with
+ * a remote MCP server (R2b C10). Undefined when nothing is added, and the session pins its
+ * definition as it is.
+ */
+export function withPlatformTools(manifest) {
+    const pinned = addCapabilities(manifest, undefined);
+    return pinned === manifest ? undefined : checked(manifest, pinned);
+}

package/dist/store/postgres/drizzle/0016_mcp_oauth_removed.sql

@@ -0,0 +1,5 @@
+DROP TABLE "nylorun"."oauth_pending" CASCADE;--> statement-breakpoint
+INSERT INTO "nylorun"."vault_audit" ("id", "at", "actor", "action", "vault_id", "credential_id", "target", "outcome")
+SELECT gen_random_uuid()::text, to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'), 'migration', 'delete', "vault_id", "id", "binding_json"::jsonb ->> 'url', 'deleted'
+FROM "nylorun"."vault_credentials" WHERE "type" = 'oauth' ORDER BY "vault_id", "id";--> statement-breakpoint
+DELETE FROM "nylorun"."vault_credentials" WHERE "type" = 'oauth';

package/dist/store/postgres/drizzle/0017_wake_outbox.sql

@@ -0,0 +1,9 @@
+CREATE TABLE "nylorun"."wakes" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"session_id" text COLLATE "C" NOT NULL,
+	"reason" text NOT NULL,
+	"dedupe_key" text,
+	"created_at" timestamp with time zone DEFAULT clock_timestamp() NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX "wakes_created_at" ON "nylorun"."wakes" USING btree ("created_at");

package/dist/store/postgres/drizzle/meta/_journal.json

@@ -113,6 +113,20 @@
       "when": 1791296131735,
       "tag": "0015_control_signals",
       "breakpoints": true
+    },
+    {
+      "idx": 16,
+      "version": "7",
+      "when": 1791395759051,
+      "tag": "0016_mcp_oauth_removed",
+      "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "7",
+      "when": 1791455573196,
+      "tag": "0017_wake_outbox",
+      "breakpoints": true
     }
   ]
 }