@nylorun/runtime 0.20.0-beta → 0.21.1-beta

package/dist/harness-api/server.js

@@ -29,7 +29,9 @@ import { HARNESS_API_VERSION, HARNESS_CLAIMS, HarnessApiError, } from "@nylorun/
 import { definitionFilesOf } from "@nylorun/core/contracts";
 import { isOwnershipLost } from "../store/ownership.js";
 import { ownedSession } from "../tenant/context.js";
-import { mcpDiscovered, sessionToolsOf } from "../mcp/snapshot.js";
+import { mcpDiscovered, pinDeferral, sessionToolsOf, } from "../mcp/snapshot.js";
+import { contextWindowOf } from "../model/catalog.js";
+import { turnManifestOf } from "../tenant/session.js";
 import { sandboxWorkspaceKey, workspacePrefix } from "../sandbox/records.js";
 import { abortKind } from "../tenant/worker.js";
 import { readDefinitionFile } from "../tenant/definition-files.js";
@@ -194,36 +196,42 @@ export function createHarnessApiServer(ctx, options = {}) {
      * session wins, with `mcp.discovered` in its log; diagnostics replace those of the same server.
      * Answers the session's snapshot and the tools the engine advertises.
      */
-    const recordMcp = (run, params) => ctx.store.tx(async (t) => {
-        const { lease } = run.offer;
-        const current = await ownedSession(t, lease, lease.sessionId);
-        const diagnostics = params.diagnostics;
+    const recordMcp = async (run, params) => {
         const snapshot = params.snapshot;
         if (snapshot !== undefined && !isSnapshot(snapshot))
             throw new HarnessApiError("invalid", "The MCP snapshot is malformed");
-        if (snapshot && !current.mcpSnapshot) {
-            current.mcpSnapshot = snapshot;
-            current.mcpDiagnostics = diagnostics;
-            await t.put("sessions", current.id, current);
-            await t.event(current.id, run.grant.turnId, "mcp.discovered", mcpDiscovered(snapshot, diagnostics));
-        }
-        else if (diagnostics.length > 0) {
-            const prior = [...(current.mcpDiagnostics ?? [])];
-            for (const item of diagnostics) {
-                const index = prior.findIndex((existing) => existing.capabilityId === item.capabilityId && existing.serverName === item.serverName);
-                if (index >= 0)
-                    prior[index] = item;
-                else
-                    prior.push(item);
+        // Which MCP tools the model reaches through tool_search, decided once for the session from
+        // the Tenant's model's context window (R2b C10, Q21).
+        const contextWindow = snapshot ? contextWindowOf(await ctx.vault.getHostModel()) : 0;
+        return ctx.store.tx(async (t) => {
+            const { lease } = run.offer;
+            const current = await ownedSession(t, lease, lease.sessionId);
+            const diagnostics = params.diagnostics;
+            if (snapshot && !current.mcpSnapshot) {
+                current.mcpSnapshot = pinDeferral(snapshot, current.manifest, contextWindow);
+                current.mcpDiagnostics = diagnostics;
+                await t.put("sessions", current.id, current);
+                await t.event(current.id, run.grant.turnId, "mcp.discovered", mcpDiscovered(current.mcpSnapshot, diagnostics));
             }
-            current.mcpDiagnostics = prior;
-            await t.put("sessions", current.id, current);
-        }
-        return {
-            ...(current.mcpSnapshot ? { snapshot: current.mcpSnapshot } : {}),
-            sessionTools: [...(sessionToolsOf(current.mcpSnapshot, current.manifest) ?? [])],
-        };
-    });
+            else if (diagnostics.length > 0) {
+                const prior = [...(current.mcpDiagnostics ?? [])];
+                for (const item of diagnostics) {
+                    const index = prior.findIndex((existing) => existing.capabilityId === item.capabilityId && existing.serverName === item.serverName);
+                    if (index >= 0)
+                        prior[index] = item;
+                    else
+                        prior.push(item);
+                }
+                current.mcpDiagnostics = prior;
+                await t.put("sessions", current.id, current);
+            }
+            return {
+                ...(current.mcpSnapshot ? { snapshot: current.mcpSnapshot } : {}),
+                // The turn's manifest: a variant may have disabled tools or required their approval.
+                sessionTools: [...(sessionToolsOf(current.mcpSnapshot, turnManifestOf(current)) ?? [])],
+            };
+        });
+    };
     /** A definition file the run's definition names (its skills', for its sandbox), base64. */
     const definitionFile = async (run, sha256, signal) => {
         if (!definitionFilesOf(run.offer.start.routing.rootManifest).has(sha256))

package/dist/harness-api/start.js

@@ -57,7 +57,8 @@ export function buildTurnStart(ctx, segment) {
         checkpoint: !flow && cp.state
             ? { ...cp, state: withTranscript(cp.state, []) }
             : cp,
-        ...(flow ? {} : { sessionTools: sessionToolsOf(current.mcpSnapshot, current.manifest) ?? [] }),
+        // The turn's manifest: a variant may have disabled MCP tools or required their approval.
+        ...(flow ? {} : { sessionTools: sessionToolsOf(current.mcpSnapshot, turnManifestOf(current)) ?? [] }),
         outcomes: segment.outcomes,
         transcript: { cursor: segment.cursor },
         options: {

package/dist/host/config-for.d.ts

@@ -14,6 +14,4 @@ export declare function configForFactory(options: {
     delivery?: TenantConfig["delivery"];
     /** The trusted issuers of the identity file (`NYLORUN_IDENTITY_FILE`). */
     issuers?: TenantConfig["issuers"];
-    /** `NYLORUN_PUBLIC_URL`: the base of the MCP OAuth callback (F9 C2). */
-    publicUrl?: string;
 }): (id: string) => TenantConfig;

package/dist/host/config-for.js

@@ -16,7 +16,6 @@ export function configForFactory(options) {
             model: options.model ?? { kind: "vault" },
             ...(options.delivery ? { delivery: options.delivery } : {}),
             ...(options.issuers ? { issuers: options.issuers } : {}),
-            ...(options.publicUrl ? { publicUrl: options.publicUrl } : {}),
             logger: {
                 info: (message, fields) => options.logger.info(message, { tenantId: id, ...fields }),
                 warn: (message, fields) => options.logger.warn(message, { tenantId: id, ...fields }),

package/dist/host/create-host.d.ts

@@ -1,7 +1,7 @@
 import type { ResourceServerConfig } from "../tenant/resource-server.js";
 import type { Logger, TenantModule } from "../tenant/types.js";
 import type { HostConfigFile } from "./config.js";
-import type { ContainerListen } from "./stack-config.js";
+import { type ContainerListen } from "./stack-config.js";
 export interface CreateHostOptions {
     hostRoot: string;
     module: TenantModule;

package/dist/host/create-host.js

@@ -1,7 +1,8 @@
 import { createServer, } from "node:http";
 import { getRequestListener, RequestError } from "@hono/node-server";
 import { createHostApp } from "./app.js";
-import { bindListener as bind, EXIT_NON_LOOPBACK, headerValue, HostListenError, isAllowedRequestHost, isLoopbackHost, pathnameIsLogged, redactRoutePath, rejectedResponse, sendRejected, } from "./http.js";
+import { isLoopbackHost } from "./stack-config.js";
+import { bindListener as bind, EXIT_NON_LOOPBACK, headerValue, HostListenError, isAllowedRequestHost, pathnameIsLogged, redactRoutePath, rejectedResponse, sendRejected, } from "./http.js";
 export function createHost(options) {
     const { module, config, logger, coreVersion } = options;
     const pid = options.pid ?? process.pid;

package/dist/host/gates.js

@@ -38,7 +38,6 @@ export async function startGates(options) {
         vaults = createTenantVaults({
             sql: database,
             hostRoot: options.hostRoot,
-            ...(gates.resolver ? { resolver: gates.resolver } : {}),
             ...(options.delivery ? { delivery: options.delivery } : {}),
         });
     }

package/dist/host/http.d.ts

@@ -54,4 +54,3 @@ export declare function adminKeyMatches(presented: string | undefined, adminKey:
 export declare function headerValue(incoming: IncomingMessage, name: string): string | undefined;
 /** A JSON request body, capped at `limit` bytes (413); `undefined` when there is none. */
 export declare function readJsonBody(request: Request, limit?: number): Promise<unknown>;
-export declare function isLoopbackHost(host: string): boolean;

package/dist/host/http.js

@@ -191,9 +191,3 @@ export async function readJsonBody(request, limit = 1024 * 1024) {
         throw Object.assign(new Error("Invalid JSON"), { status: 400 });
     }
 }
-export function isLoopbackHost(host) {
-    const normalized = host.trim().toLowerCase();
-    return (normalized === "127.0.0.1" ||
-        normalized === "::1" ||
-        normalized === "localhost");
-}

package/dist/host/main.js

@@ -139,6 +139,17 @@ async function ensureBucket(store, bucket, logger) {
         }
     }
 }
+/**
+ * Settings of a removed feature that are still set: logged, never fatal. The credential
+ * resolver (`NYLORUN_RESOLVER_*`) is gone in protocol 10. Never logs the values.
+ */
+function warnRemovedSettings(stack, logger) {
+    if (stack.removedResolverVariables)
+        logger.warn("resolver_removed", {
+            variables: stack.removedResolverVariables,
+            message: "The credential resolver is gone (protocol 10) and these variables are ignored: keep a person's keys in their user vault, or reach their accounts through a gateway",
+        });
+}
 /**
  * The gateway's services: the Model Gate's listener (gates, keys) and egress-gate's (egress), over
  * the Postgres pool and the Host's tenant directory. Writes nothing to the Host root (the local
@@ -153,9 +164,8 @@ async function runGates(stack) {
         ...(stack.packing ? { packing: stack.packing } : {}),
         endpoints: describeEndpoints(stack.endpoints),
         objectStore: stack.objectStore ? "s3" : "none",
-        // Never the resolver's URL or token: only whether one is set (F9 C1).
-        resolver: stack.gates?.resolver ? "configured" : "none",
     });
+    warnRemovedSettings(stack, logger);
     const database = createDatabase(stack);
     const servers = [];
     try {
@@ -234,6 +244,7 @@ export async function main() {
             file: identityFile,
             issuers: issuers.issuers.map((issuer) => issuer.config.name),
         });
+    warnRemovedSettings(stack, logger);
     if (stack.deprecatedRole)
         logger.warn("deprecated_flag", {
             flag: "--role",
@@ -261,7 +272,6 @@ export async function main() {
         logger,
         ...(stack.delivery ? { delivery: stack.delivery } : {}),
         ...(issuers ? { issuers } : {}),
-        ...(stack.publicUrl ? { publicUrl: stack.publicUrl } : {}),
     });
     // The process's Durable Session Execution: Restate when its endpoints are set, else the
     // in-process memory execution. An invocation that arrives while the Tenant opens waits for it.

package/dist/host/stack-config.d.ts

@@ -54,14 +54,6 @@ export interface GatesConfig {
     listen: ContainerListen;
     /** `NYLORUN_GATES_TOKEN`: the bearer the loop presents; at least 32 bytes as hex. */
     token: string;
-    /**
-     * The operator's credential resolver (`NYLORUN_RESOLVER_URL`, `NYLORUN_RESOLVER_TOKEN`), asked
-     * for a person's MCP credential when the session's vaults hold none (F9 C1). Absent: vaults only.
-     */
-    resolver?: {
-        url: string;
-        token: string;
-    };
 }
 /** egress-gate's listener (`NYLORUN_EGRESS_LISTEN_HOST`, `NYLORUN_EGRESS_LISTEN_PORT`). */
 export interface EgressConfig {
@@ -168,6 +160,11 @@ export interface StackConfig {
     packing?: "combined" | "split";
     /** Set when the process was started with the deprecated `--role` (logged at startup). */
     deprecatedRole?: RuntimeRole;
+    /**
+     * The removed credential resolver's variables (`NYLORUN_RESOLVER_*`, protocol 10) the
+     * environment still sets: ignored, and logged at startup as `resolver_removed`.
+     */
+    removedResolverVariables?: string[];
     /** Present in container mode; absent means bind what host.json names. */
     listen?: ContainerListen;
     endpoints: StackEndpoints;
@@ -240,6 +237,8 @@ export declare function parseServices(argv: readonly string[]): ServiceSelection
  * IPv6 literals must be bracketed (`[::1]:4000`).
  */
 export declare function normalizeAllowedHost(name: string, entry: string): string;
+/** A loopback bind address: `127.0.0.1`, `::1` or `localhost`. */
+export declare function isLoopbackHost(host: string): boolean;
 /** Parse the stack configuration; throws `StackConfigError` naming the variable. */
 export declare function parseStackConfig(env: EnvSnapshot, argv: readonly string[]): StackConfig;
 /** Endpoint summary for logs: which endpoints are set, never their values. */

package/dist/host/stack-config.js

@@ -15,8 +15,8 @@
  * `NYLORUN_GATES_TOKEN`. In a container, loop requires the gate: the loop
  * process must never hold a model credential. `egress` (egress-gate, F7.2) joins gates and keys
  * in the gateway and parses its listener (`NYLORUN_EGRESS_LISTEN_*`, default `0.0.0.0:4200`).
- * Only gates reads the operator's credential resolver (`NYLORUN_RESOLVER_URL`,
- * `NYLORUN_RESOLVER_TOKEN`, F9 C1): remote MCP calls are authorized in the gateway.
+ * The credential resolver is gone (protocol 10): its `NYLORUN_RESOLVER_*` variables are ignored,
+ * and the Host logs `resolver_removed` when one is set.
  *
  * `harness` (F6.2) runs alone: it holds the harness credential and nothing else. It connects to
  * core's Harness API listener (`NYLORUN_HARNESS_URL`, `NYLORUN_HARNESS_TOKEN`), calls models and
@@ -179,9 +179,10 @@ export function normalizeAllowedHost(name, entry) {
 function loopbackForms(port) {
     return [`localhost:${port}`, `127.0.0.1:${port}`, `[::1]:${port}`];
 }
-function isLoopbackAddress(host) {
-    const value = host.toLowerCase();
-    return value === "127.0.0.1" || value === "::1" || value === "localhost";
+/** A loopback bind address: `127.0.0.1`, `::1` or `localhost`. */
+export function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase();
+    return normalized === "127.0.0.1" || normalized === "::1" || normalized === "localhost";
 }
 function parseUrl(env, name, protocols) {
     const raw = read(env, name);
@@ -198,32 +199,37 @@ function parseUrl(env, name, protocols) {
         throw new StackConfigError(`${name} must use ${protocols.map((p) => p.replace(/:$/, "")).join(" or ")}; got ${url.protocol.replace(/:$/, "")}`);
     return raw;
 }
-function parseListen(env) {
-    const rawHost = read(env, "NYLORUN_LISTEN_HOST");
-    const rawPort = read(env, "NYLORUN_LISTEN_PORT");
-    const rawAllowed = read(env, "NYLORUN_ALLOWED_HOSTS");
-    if (rawHost === undefined && rawPort === undefined && rawAllowed === undefined)
-        return undefined;
-    const host = rawHost ?? DEFAULT_CONTAINER_LISTEN_HOST;
+function parseListener(env, prefix, defaultPort, hosts) {
+    const hostName = `${prefix}LISTEN_HOST`;
+    const host = read(env, hostName) ?? DEFAULT_CONTAINER_LISTEN_HOST;
     if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_LISTEN_HOST is not an address: ${host}`);
-    const port = rawPort === undefined
-        ? DEFAULT_CONTAINER_LISTEN_PORT
-        : parsePort("NYLORUN_LISTEN_PORT", rawPort);
-    const explicit = rawAllowed === undefined
-        ? []
-        : rawAllowed
-            .split(",")
-            .map((entry) => entry.trim())
-            .filter((entry) => entry !== "")
-            .map((entry) => normalizeAllowedHost("NYLORUN_ALLOWED_HOSTS", entry));
-    if (explicit.length === 0 && !isLoopbackAddress(host))
-        throw new StackConfigError(`NYLORUN_ALLOWED_HOSTS is required when NYLORUN_LISTEN_HOST is ${host}: list the Host headers clients send, e.g. runtime:${port},localhost:<published port>`);
+        throw new StackConfigError(`${hostName} is not an address: ${host}`);
+    const portName = `${prefix}LISTEN_PORT`;
+    const rawPort = read(env, portName);
+    const port = rawPort === undefined ? defaultPort : parsePort(portName, rawPort);
+    if (!hosts)
+        return { host, port };
+    const allowedName = `${prefix}ALLOWED_HOSTS`;
+    const explicit = (read(env, allowedName) ?? "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== "")
+        .map((entry) => normalizeAllowedHost(allowedName, entry));
+    if (explicit.length === 0 && !isLoopbackHost(host))
+        throw new StackConfigError(`${allowedName} is required when ${hostName} is ${host}: list the Host headers ${hosts.senders}, e.g. ${hosts.example(port)}`);
     // Loopback forms of the listen port serve probes from inside the container
     // (health checks). A browser on the Docker host never sends them: it sends
     // the published port.
-    const allowedHosts = [...new Set([...explicit, ...loopbackForms(port)])];
-    return { host, port, allowedHosts };
+    return { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] };
+}
+/** The API's listener (`NYLORUN_LISTEN_*`, `NYLORUN_ALLOWED_HOSTS`): none when none is set. */
+function parseListen(env) {
+    if (["NYLORUN_LISTEN_HOST", "NYLORUN_LISTEN_PORT", "NYLORUN_ALLOWED_HOSTS"].every((name) => read(env, name) === undefined))
+        return undefined;
+    return parseListener(env, "NYLORUN_", DEFAULT_CONTAINER_LISTEN_PORT, {
+        senders: "clients send",
+        example: (port) => `runtime:${port},localhost:<published port>`,
+    });
 }
 const IDENTITY_KEY = /^publickeyv1_[1-9A-HJ-NP-Za-km-z]{32,64}$/;
 function parseIdentityKeys(env) {
@@ -304,9 +310,13 @@ export function parseStackConfig(env, argv) {
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
     const objectStore = parseObjectStore(env);
+    const removedResolverVariables = Object.keys(env)
+        .filter((name) => name.startsWith(REMOVED_RESOLVER_PREFIX) && read(env, name) !== undefined)
+        .sort();
     return {
         services,
         ...(deprecatedRole ? { deprecatedRole } : {}),
+        ...(removedResolverVariables.length ? { removedResolverVariables } : {}),
         ...(gates ? { gates } : {}),
         ...(egress ? { egress } : {}),
         ...(modelGate ? { modelGate } : {}),
@@ -394,30 +404,14 @@ function parseSandboxes(env) {
  * (required with `NYLORUN_HARNESS=remote`; optional when only sandbox pods connect).
  */
 function parseHarnessListener(env, tokenRequired = true) {
-    const host = read(env, "NYLORUN_HARNESS_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;
-    if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_HARNESS_LISTEN_HOST is not an address: ${host}`);
-    const rawPort = read(env, "NYLORUN_HARNESS_LISTEN_PORT");
-    const port = rawPort === undefined
-        ? DEFAULT_HARNESS_LISTEN_PORT
-        : parsePort("NYLORUN_HARNESS_LISTEN_PORT", rawPort);
-    const rawAllowed = read(env, "NYLORUN_HARNESS_ALLOWED_HOSTS");
-    const explicit = rawAllowed === undefined
-        ? []
-        : rawAllowed
-            .split(",")
-            .map((entry) => entry.trim())
-            .filter((entry) => entry !== "")
-            .map((entry) => normalizeAllowedHost("NYLORUN_HARNESS_ALLOWED_HOSTS", entry));
-    if (explicit.length === 0 && !isLoopbackAddress(host))
-        throw new StackConfigError(`NYLORUN_HARNESS_ALLOWED_HOSTS is required when NYLORUN_HARNESS_LISTEN_HOST is ${host}: list the Host headers harnesses send, e.g. runtime:${port}`);
+    const listen = parseListener(env, "NYLORUN_HARNESS_", DEFAULT_HARNESS_LISTEN_PORT, {
+        senders: "harnesses send",
+        example: (port) => `runtime:${port}`,
+    });
     const token = tokenRequired || read(env, "NYLORUN_HARNESS_TOKEN") !== undefined
         ? parseHarnessToken(env, "with NYLORUN_HARNESS=remote: the credential harnesses present")
         : undefined;
-    return {
-        listen: { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] },
-        ...(token ? { token } : {}),
-    };
+    return { listen, ...(token ? { token } : {}) };
 }
 /** What a harness process must not hold: it runs next to agent code. */
 const HARNESS_REFUSED = ["NYLORUN_DATABASE_URL", "NYLORUN_GATES_TOKEN", "NYLORUN_KEYS_URL"];
@@ -487,58 +481,22 @@ function parsePodHost(env, url) {
 }
 /** `StackConfig.gates` from `NYLORUN_GATES_*`. */
 function parseGates(env) {
-    const host = read(env, "NYLORUN_GATES_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;
-    if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_GATES_LISTEN_HOST is not an address: ${host}`);
-    const rawPort = read(env, "NYLORUN_GATES_LISTEN_PORT");
-    const port = rawPort === undefined
-        ? DEFAULT_GATES_LISTEN_PORT
-        : parsePort("NYLORUN_GATES_LISTEN_PORT", rawPort);
-    const rawAllowed = read(env, "NYLORUN_GATES_ALLOWED_HOSTS");
-    const explicit = rawAllowed === undefined
-        ? []
-        : rawAllowed
-            .split(",")
-            .map((entry) => entry.trim())
-            .filter((entry) => entry !== "")
-            .map((entry) => normalizeAllowedHost("NYLORUN_GATES_ALLOWED_HOSTS", entry));
-    if (explicit.length === 0 && !isLoopbackAddress(host))
-        throw new StackConfigError(`NYLORUN_GATES_ALLOWED_HOSTS is required when NYLORUN_GATES_LISTEN_HOST is ${host}: list the Host headers the loop sends, e.g. gateway:${port}`);
+    const listen = parseListener(env, "NYLORUN_GATES_", DEFAULT_GATES_LISTEN_PORT, {
+        senders: "the loop sends",
+        example: (port) => `gateway:${port}`,
+    });
     const token = read(env, "NYLORUN_GATES_TOKEN");
     if (token === undefined)
         throw new StackConfigError("NYLORUN_GATES_TOKEN is required for --service gates: the token the loop presents (`nylorun start` sets it)");
     if (!GATES_TOKEN.test(token))
         throw new StackConfigError("NYLORUN_GATES_TOKEN must be at least 32 bytes as hex");
-    const resolver = parseResolver(env);
-    return {
-        listen: { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] },
-        token,
-        ...(resolver ? { resolver } : {}),
-    };
-}
-/** `GatesConfig.resolver` from `NYLORUN_RESOLVER_URL` and `NYLORUN_RESOLVER_TOKEN`: both or neither. */
-function parseResolver(env) {
-    const url = parseUrl(env, "NYLORUN_RESOLVER_URL", ["http:", "https:"]);
-    const token = read(env, "NYLORUN_RESOLVER_TOKEN");
-    if (url === undefined) {
-        if (token !== undefined)
-            throw new StackConfigError("NYLORUN_RESOLVER_TOKEN is set without NYLORUN_RESOLVER_URL: set the URL of your credential resolver");
-        return undefined;
-    }
-    if (token === undefined)
-        throw new StackConfigError("NYLORUN_RESOLVER_TOKEN is required with NYLORUN_RESOLVER_URL: the bearer the gateway presents to your credential resolver");
-    if (/\s/.test(token))
-        throw new StackConfigError("NYLORUN_RESOLVER_TOKEN cannot contain whitespace");
-    return { url, token };
+    return { listen, token };
 }
+/** The prefix of the credential resolver's variables (removed in protocol 10). */
+const REMOVED_RESOLVER_PREFIX = "NYLORUN_RESOLVER_";
 /** `StackConfig.egress` from `NYLORUN_EGRESS_LISTEN_*`. CONNECT has no Host header to check. */
 function parseEgress(env) {
-    const host = read(env, "NYLORUN_EGRESS_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;
-    if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_EGRESS_LISTEN_HOST is not an address: ${host}`);
-    const rawPort = read(env, "NYLORUN_EGRESS_LISTEN_PORT");
-    const port = rawPort === undefined ? DEFAULT_EGRESS_LISTEN_PORT : parsePort("NYLORUN_EGRESS_LISTEN_PORT", rawPort);
-    return { listen: { host, port } };
+    return { listen: parseListener(env, "NYLORUN_EGRESS_", DEFAULT_EGRESS_LISTEN_PORT) };
 }
 /** `StackConfig.modelGate` from `NYLORUN_GATES_URL` and `NYLORUN_GATES_TOKEN`. */
 function parseModelGate(env) {

package/dist/index.d.ts

@@ -4,7 +4,6 @@ export { parseIdentityFile, IdentityFileError, type TrustedIssuerConfig, } from
 export { createTrustedIssuers, type TrustedIssuers, type TrustedIssuersOptions, } from "./tenant/issuers.js";
 export type { TenantConfig, TenantHandle, TenantPaths, Logger, OpenTenantRuntime, } from "./tenant/types.js";
 export { scriptedModel, gatewayModel, type ModelProvider } from "./core/provider.js";
-export type { ResolverConfig } from "./vault/sources.js";
 export type { RuntimeAgent } from "./contracts.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
 export type { RuntimeModelAdapter } from "./contracts.js";

package/dist/keys/client.js

@@ -12,18 +12,10 @@ import { KEYS_PATH } from "./contract.js";
 import { KEYS_OPERATIONS } from "./keys.js";
 /** Signing and vault writes are short; anything slower is a gateway in trouble. */
 const KEYS_TIMEOUT_MS = 30_000;
-/**
- * MCP OAuth connect calls the authorization server several times (discovery, registration, the
- * code exchange), each bounded by `guardedFetch`'s 30 s: these wait longer.
- */
-const SLOW_OPERATIONS = {
-    startOAuth: 120_000,
-    finishOAuth: 60_000,
-};
 export function httpKeys(options) {
     const where = new URL(options.url).origin;
     function call(operation, args) {
-        const timeoutMs = Math.max(options.timeoutMs ?? KEYS_TIMEOUT_MS, SLOW_OPERATIONS[operation] ?? 0);
+        const timeoutMs = options.timeoutMs ?? KEYS_TIMEOUT_MS;
         const url = new URL(`${KEYS_PATH}/${operation}`, options.url);
         const send = url.protocol === "https:" ? httpsRequest : httpRequest;
         const payload = Buffer.from(JSON.stringify({ args }), "utf8");

package/dist/keys/keys.d.ts

@@ -1,7 +1,8 @@
-import type { CreateCredentialRequest, CredentialInfo, HostModelView, PutHostModelRequest, RotateCredentialRequest, SelectHostModelRequest, SigningKeyView } from "@nylorun/core/contracts";
+import type { CreateCredentialRequest, CredentialInfo, HostModelView, McpPreview, McpPreviewRequest, PutHostModelRequest, RotateCredentialRequest, SelectHostModelRequest, SigningKeyView } from "@nylorun/core/contracts";
 import type { SessionStore } from "../store/types.js";
+import type { OutboundPolicy } from "../tenant/outbound.js";
 import { type SigningKeys } from "../tenant/signing-keys.js";
-import type { FinishOAuthInput, StartOAuthInput, VaultService } from "../vault/service.js";
+import type { VaultService } from "../vault/service.js";
 /** One JWT to sign: its `typ` and every claim, `iss`, `aud`, `sub`, `iat`, `exp` and `jti` included. */
 export interface SignRequest {
     readonly typ: string;
@@ -26,19 +27,14 @@ export interface Keys {
     }): Promise<SigningKeyView[]>;
     /** Creates the current and standby keys when the Tenant has none. */
     ensureSigningKeys(): Promise<void>;
-    /** Starts an MCP OAuth connect into an installation vault (`VaultService.startOAuth`). */
-    startOAuth(input: StartOAuthInput): Promise<{
-        authorizeUrl: string;
-        expiresAt: string;
-    }>;
-    /** Finishes one from its callback (`VaultService.finishOAuth`). */
-    finishOAuth(input: FinishOAuthInput): Promise<{
-        vaultId: string;
-        credentialId: string;
-    }>;
+    /**
+     * Lists a remote MCP server's tools with the installation vault's credential for its URL
+     * (R2b C12, `mcp/preview.ts`); never calls a tool.
+     */
+    previewMcp(body: McpPreviewRequest): Promise<McpPreview>;
 }
 /** The operations, by the name the HTTP route carries. */
-export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "startOAuth", "finishOAuth"];
+export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp"];
 export type KeysOperation = (typeof KEYS_OPERATIONS)[number];
 export interface InProcessKeysOptions {
     readonly store: SessionStore;
@@ -47,5 +43,7 @@ export interface InProcessKeysOptions {
     readonly signingKeys: SigningKeys;
     /** The vault key. */
     readonly kek: () => Buffer;
+    /** How a tool preview reaches the server (`TenantConfig.delivery`). Default: no limits. */
+    readonly policy?: OutboundPolicy;
 }
 export declare function inProcessKeys(options: InProcessKeysOptions): Keys;

package/dist/keys/keys.js

@@ -5,15 +5,15 @@
  * links, run and host tokens, signing-key rotation) run here, whole, so the process that calls them never
  * holds the key or a private signing key.
  *
- * MCP OAuth connect (F9-D14) runs here too: discovery, registration, the code exchange and the
- * credential it seals, so the plaintext tokens, the PKCE verifier and any client secret never
- * reach the runtime container; core only routes the start and the callback.
+ * A tool preview (R2b C12, `previewMcp`) runs here too: it sends an installation vault's
+ * credential to the server it lists, so the process that reads the plaintext makes the request.
  *
  * Two implementations: `inProcessKeys` (embedding, the ephemeral Runtime, tests, and the gates
  * service itself, which serves the HTTP routes with it), and `httpKeys` (`client.ts`), the
  * runtime container's client of the `keys` service in the gateway.
  */
 import { SignJWT } from "jose";
+import { previewMcpServer } from "../mcp/preview.js";
 import { signingKeyView } from "../tenant/signing-keys.js";
 /** The operations, by the name the HTTP route carries. */
 export const KEYS_OPERATIONS = [
@@ -24,8 +24,7 @@ export const KEYS_OPERATIONS = [
     "sign",
     "rotateSigningKeys",
     "ensureSigningKeys",
-    "startOAuth",
-    "finishOAuth",
+    "previewMcp",
 ];
 export function inProcessKeys(options) {
     const { store, vault, signingKeys, kek } = options;
@@ -34,8 +33,6 @@ export function inProcessKeys(options) {
         rotateCredential: (vaultId, id, body) => vault.rotateCredential(vaultId, id, body),
         putHostModel: (body) => vault.putHostModel(body),
         selectHostModel: (body) => vault.selectHostModel(body),
-        startOAuth: (input) => vault.startOAuth(input),
-        finishOAuth: (input) => vault.finishOAuth(input),
         async sign(request) {
             const key = kek();
             const row = await store.tx((t) => signingKeys.ensure(t, key));
@@ -54,5 +51,6 @@ export function inProcessKeys(options) {
             const key = kek();
             await store.tx((t) => signingKeys.ensure(t, key));
         },
+        previewMcp: (body) => previewMcpServer(body, { vault, policy: options.policy ?? {} }),
     };
 }