@nylorun/runtime 0.21.0-beta → 0.22.0-beta

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 0.22.0-beta
+
+### Minor Changes
+
+- 212364b: **Credentials for skills (R2c).** A skill's CLI in a pod sandbox authenticates with a vault credential whose value never enters the sandbox.
+
+  - `@nylorun/core`: vault credentials gain `environment_secret` (`secretName`, `secretValue`, `allowedHosts`, optional `inject: { header, format }`) and `environment_variable` (`variableName`, `variableValue`), in create, rotate and `CredentialInfo` (whose `binding.url` is now optional). `ENVIRONMENT_SECRET_SENTINEL` (`nylorun-managed`), `ENVIRONMENT_SECRET_DEFAULT_INJECT`, `isInjectFormat`, `renderInjectFormat`, `EnvironmentNameSchema` and `RESERVED_ENVIRONMENT_NAMES` are exported; `ERROR_CODES` gains `credential_conflict`; the Harness API's `RunRouting.sandbox` gains `environment`.
+  - `@nylorun/runtime`: every sandbox command gets each secret's name set to `nylorun-managed` and each variable's value. egress-gate terminates TLS for port 443 of a host an `environment_secret` of the sandbox's sessions is bound to, with a fresh leaf signed by the installation's egress CA (held by keys; its certificate reaches the pod in the join answer, and the engine points `SSL_CERT_FILE`, `NODE_EXTRA_CA_CERTS`, `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`, `GIT_SSL_CAINFO` and `AWS_CA_BUNDLE` at a bundle with it), and sets the credential's header on every request from the vault, uncached. Every other host stays an opaque tunnel. Session open answers `409 credential_conflict` for two credentials with one variable name or one host, or two owners' secrets on one sandbox. No protocol change.
+  - `@nylorun/studio`: the Credentials page lists shell credentials (their variable and hosts) and deletes them; create and rotate them with the Management API.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [212364b]
+- Updated dependencies
+  - @nylorun/core@0.19.0-beta
+  - @nylorun/harness@0.25.1-beta
+
+## 0.21.1-beta
+
+### Patch Changes
+
+- 070674d: **One source of truth for the manifest and Harness API schemas.**
+
+  - `@nylorun/core`: `Agent.from` (`agentFrom`) checks a manifest with `AgentManifestSchema`, the Runtime's own check, instead of a validator of its own, and refuses with `agent.build-failed` and the schema's messages (each prefixed with its path, such as `capabilities.0.tools.0.name: …`). It now refuses what the Runtime refuses at registration and it let through, such as unknown fields (it dropped them) or a tool or MCP server name that not every model provider accepts. The schema names a top-level `model` or `schemaVersion` and a capability's `model` as before, and the skill whose `files` are wrong (`Skill 'triage' files must include SKILL.md`). The rebuilt manifest is a frozen copy; the object passed in is no longer frozen. `AgentManifestSchema` and `WorkflowManifestSchema` are no longer force-cast to their types: the build checks that each accepts exactly `AgentManifest` and `WorkflowManifest`. `@nylorun/core/contracts` exports `McpServerManifestSchema`, `HEADER_NAME_PATTERN` and `LOOPBACK_HOSTS`. The Harness API's types (`@nylorun/core/harness-api`) are inferred from the schemas that validate its frames, so they match them: `TurnStart.manifest`, `TurnStart.checkpoint` and `RunRouting.rootManifest` are `object`, `WorkspaceCall.tool` is a sandbox tool name, `ABORT_REASONS` is a tuple, and properties are no longer `readonly` (arrays that were stay so).
+  - `@nylorun/harness`: `runDurable` checks the manifest once, when it rebuilds the agent, instead of twice. The unpublished, stale `schemas/manifest.schema.json` (manifest `schemaVersion` 2) is gone; `z.toJSONSchema(AgentManifestSchema)` is the manifest's JSON Schema.
+  - `@nylorun/agents`: a plugin's MCP servers are checked with core's `McpServerManifestSchema`, header-name pattern and loopback hosts. A server whose key is not a name every model provider accepts is skipped with a `plugin.mcp-server-skipped` warning, since the Runtime would refuse the manifest declaring it.
+  - `@nylorun/runtime`: the stack configuration reads its four listeners (`NYLORUN_LISTEN_*`, `NYLORUN_GATES_LISTEN_*`, `NYLORUN_HARNESS_LISTEN_*`, `NYLORUN_EGRESS_LISTEN_*`) with one parser; the variables and their errors are unchanged.
+
+- 34d1a81: A commit can no longer lose its wake. A transaction that asks for an advance writes the wake to the Session Store's wake outbox (`Tx.wake`, migration `0017_wake_outbox` adds `nylorun.wakes`) and sends it to Durable Session Execution after commit, with an idempotency key (the wake's dedupe key, or one made from its row), deleting the row once Restate accepted it. A send that fails, or that a crash between the commit and the send cut off, is sent again by the Tenant sweep under the same key: on a process's first pass for any row, then for rows older than 2 s. Restate deduplicates the repeat, so a wake whose answer was lost runs one advance. The sweep's orphan scan no longer delivers lost wakes: it runs on a process's first pass and then once a minute, as the backstop for what the execution itself lost (Restate state wiped, an invocation killed, an in-process execution's queue). Restate owns when a session runs (wakes, one advance per session, retries, timers); the Session Store owns what happened (checkpoint, effect journal, events, the lease's epoch and the outbox), as `src/CONTEXT.md` and `adapters/execution/restate.ts` now describe. A Runtime of the previous beta refuses the migrated database (`schema-too-new`); while processes of both run, the old ones send wakes as before.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [417f336]
+- Updated dependencies [6fecd4c]
+- Updated dependencies [7780b2f]
+- Updated dependencies [070674d]
+- Updated dependencies
+  - @nylorun/core@0.18.0-beta
+  - @nylorun/harness@0.25.0-beta
+
 ## 0.21.0-beta
 
 ### Major Changes

package/README.md

@@ -42,8 +42,10 @@ whose key the admin key derives (the only derived key). Management keys come fro
 rotates and deletes the Tenant's application keys (`PUT /v1/tenant/keys/{keyId}`); a rotated
 or deleted key stops authenticating at once. A database written by a Runtime that kept several Tenants in one
 database (`tenant_<id>` schemas), or by a pre-release build of one Tenant per database
-(`schema_version` tables), is refused: this release starts fresh on a new database. Restate runs one advance of a session at a time and holds the Tenant's sweep
-timer (Durable Session Execution); every session's events are relayed from the record to
+(`schema_version` tables), is refused: this release starts fresh on a new database. Restate runs one advance of a session at a time, delivers its wakes and holds
+its timers and the Tenant's sweep (Durable Session Execution), and journals no effect:
+checkpoints, effects, events and the wake outbox are the Session Store's, and a wake is
+written to the outbox in the transaction that causes it, so a commit never loses it; every session's events are relayed from the record to
 its own S2 stream, which history and SSE read (Durable Streams). One image runs every **service**,
 and `--service` picks what a process runs: `core` serves the Runtime API, the
 Management API and SSE and runs the stream relay, `loop` runs advances (the Worker), and

package/dist/adapters/execution/restate.js

@@ -25,7 +25,32 @@
  *   What a run answers arms its timers and its retry.
  *
  * Wakes, sandbox reconciles, timers and sweep arming go through the ingress as one-way
- * sends, so an API node can call them without ever calling `start`.
+ * sends, so an API node can call them without ever calling `start`. A wake a commit asked for
+ * comes from the Session Store's wake outbox (`Tx.wake`) with an idempotency key, so a send
+ * repeated after its answer was lost causes no second advance.
+ *
+ * ## What Restate owns, and what the Session Store owns
+ *
+ * Restate owns when a session runs: it delivers each wake at least once, deduped by its
+ * key for `dedupeRetentionMs`; runs at most one invocation per key at a time; retries an
+ * invocation whose attempt failed, so an advance whose Worker died runs again and takes the
+ * session over (§11.4); and keeps every timer: the busy re-wake, `NylorunTimer`,
+ * `NylorunSandbox` and the `NylorunTenant` sweep chain. The Session Store (Postgres) owns
+ * what happened: the checkpoint, the effect journal (`harness-api/record.ts`), the events
+ * (the Record), and the wake outbox that hands each committed wake to Restate. Restate
+ * journals no effect: an effect's intent and outcome commit with the session's events in
+ * one transaction, under the advance's lease, and remote harnesses and pod engines write
+ * them too, over the Harness API.
+ *
+ * Two Session Store mechanisms overlap Restate on purpose:
+ *
+ * - **The lease and its epoch** (§10.6). Restate's one invocation per key holds for an
+ *   attempt, not for the code it started: an attempt that ends (abort timeout, a dropped
+ *   connection) is retried while the previous attempt's handler may still run on its Worker,
+ *   and a remote harness or pod engine may still hold the run. The epoch fences their writes,
+ *   and `busy` answers the overlap.
+ * - **The advance deadline** (`tenant/worker.ts`). Restate's abort timeout does not stop a
+ *   running handler, so the Worker bounds each advance itself, below `timeouts`.
  */
 import { createServer } from "node:http2";
 import * as restate from "@restatedev/restate-sdk";

package/dist/adapters/sandbox/local.js

@@ -57,7 +57,7 @@ export function localBackend(options) {
             return reject(signal.reason ?? new Error("Turn cancelled"));
         const child = spawn("/bin/sh", ["-c", request.command], {
             cwd: request.cwd,
-            env: { ...env, ...(options.proxyEnv?.() ?? {}) },
+            env: { ...env, ...(request.env ?? {}), ...(options.proxyEnv?.() ?? {}) },
             stdio: ["ignore", "pipe", "pipe"],
             // Its own process group, so a timeout or a cancel kills everything it started.
             detached: true,

package/dist/adapters/sandbox/virtual.js

@@ -81,7 +81,7 @@ export function virtualBackend(options) {
                     try {
                         const result = await bash.exec(request.command, {
                             cwd: request.cwd,
-                            env: { ...ENV },
+                            env: { ...(request.env ?? {}), ...ENV },
                             replaceEnv: true,
                             rawScript: true,
                             signal: controller.signal,

package/dist/api/components.d.ts

@@ -10,6 +10,7 @@ export declare const Rejected: z.ZodObject<{
     status: z.ZodLiteral<"rejected">;
     code: z.ZodEnum<{
         connection_missing: "connection_missing";
+        credential_conflict: "credential_conflict";
         credential_invalid: "credential_invalid";
         credential_rejected: "credential_rejected";
         credential_required: "credential_required";
@@ -8376,6 +8377,19 @@ export declare const CreateCredentialRequest: z.ZodObject<{
         type: z.ZodLiteral<"headers">;
         url: z.ZodString;
         headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"environment_secret">;
+        secretName: z.ZodString;
+        secretValue: z.ZodString;
+        allowedHosts: z.ZodArray<z.ZodString>;
+        inject: z.ZodOptional<z.ZodObject<{
+            header: z.ZodString;
+            format: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"environment_variable">;
+        variableName: z.ZodString;
+        variableValue: z.ZodString;
     }, z.core.$strict>], "type">;
 }, z.core.$strict>;
 export declare const CredentialInfo: z.ZodObject<{
@@ -8384,10 +8398,20 @@ export declare const CredentialInfo: z.ZodObject<{
     name: z.ZodString;
     type: z.ZodEnum<{
         bearer: "bearer";
+        environment_secret: "environment_secret";
+        environment_variable: "environment_variable";
         headers: "headers";
     }>;
     binding: z.ZodObject<{
-        url: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+        secretName: z.ZodOptional<z.ZodString>;
+        allowedHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        inject: z.ZodOptional<z.ZodObject<{
+            header: z.ZodString;
+            format: z.ZodString;
+        }, z.core.$strict>>;
+        variableName: z.ZodOptional<z.ZodString>;
+        variableValue: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     headerNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
     via: z.ZodOptional<z.ZodString>;
@@ -8404,10 +8428,20 @@ export declare const ListCredentialsResponse: z.ZodObject<{
         name: z.ZodString;
         type: z.ZodEnum<{
             bearer: "bearer";
+            environment_secret: "environment_secret";
+            environment_variable: "environment_variable";
             headers: "headers";
         }>;
         binding: z.ZodObject<{
-            url: z.ZodString;
+            url: z.ZodOptional<z.ZodString>;
+            secretName: z.ZodOptional<z.ZodString>;
+            allowedHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            inject: z.ZodOptional<z.ZodObject<{
+                header: z.ZodString;
+                format: z.ZodString;
+            }, z.core.$strict>>;
+            variableName: z.ZodOptional<z.ZodString>;
+            variableValue: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>;
         headerNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
         via: z.ZodOptional<z.ZodString>;
@@ -8435,6 +8469,12 @@ export declare const RotateCredentialRequest: z.ZodObject<{
         }, z.core.$strict>>>;
         type: z.ZodLiteral<"headers">;
         headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"environment_secret">;
+        secretValue: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"environment_variable">;
+        variableValue: z.ZodString;
     }, z.core.$strict>], "type">;
 }, z.core.$strict>;
 export declare const DeletedResponse: z.ZodObject<{

package/dist/core/flow-host.d.ts

@@ -1,8 +1,7 @@
 import type { EffectOutcome } from "@nylorun/core/contracts";
 import { type JsonValue, type WorkflowManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
-import type { Wake } from "../execution/types.js";
-import type { EffectDoc, Tx } from "../store/types.js";
+import type { EffectDoc, Tx, WakeDelivery } from "../store/types.js";
 import { type FlowLimits } from "./limits.js";
 /** Deterministic agent session id: derive(workflowSessionId, path, …parts). */
 export declare function deriveSessionId(workflowSessionId: string, path: string, ...parts: string[]): string;
@@ -99,7 +98,7 @@ export type CascadeCancelPlan = {
     readonly agentSessionIds: string[];
 };
 /** Wakes a session after commit (`DurableExecution.wake` through the Tenant context). */
-type Schedule = (sessionId: string, wake: Wake) => void | Promise<void>;
+type Schedule = WakeDelivery;
 /** Effect documents as the flow host writes them. */
 export type FlowEffect = EffectDoc & {
     agentSessionId?: string;

package/dist/core/flow-host.js

@@ -4,7 +4,8 @@
  * Every function that touches state takes the caller's transaction `t: Tx` and
  * is async. Nothing here publishes, notifies or schedules directly (seam rule
  * 1): events go through `t.event(...)`, which the store publishes after
- * commit, and wakes go through `t.afterCommit(() => schedule(id, wake))`. Functions
+ * commit, and wakes go through `t.wake(id, wake, schedule)`, the wake outbox, which
+ * calls `schedule` after commit. Functions
  * that rewrite a session-scoped document lock that session first with
  * `t.lockSession` (a no-op when the caller already holds it).
  *
@@ -35,8 +36,9 @@
  * - `foreignInteractionConflict({ t, workflowSessionId, interactionId }): Promise<{ status: 409; message; ownerSessionId } | undefined>`
  * - `wakeForQueuedEffects({ t, workflowSessionId, turnId, limits, schedule }): Promise<boolean>`
  *
- * `schedule: (sessionId, wake) => void | Promise<void>` runs after commit, never inside `t`;
- * `wake` carries the reason (`linked`, `flow`) and, where the cause has one, a dedupe key.
+ * `schedule` (a `WakeDelivery`, the Tenant's `ctx.wake`) runs after commit, never inside `t`;
+ * `wake` carries the reason (`linked`, `flow`) and, where the cause has one, a dedupe key. A
+ * wake `schedule` does not deliver stays in the outbox for the Tenant sweep (`Tx.wake`).
  *
  * An `agent` effect settles only from the linked turn it started. A linked agent session is
  * reused by every iteration of a Loop (its id derives from the workflow and the path), so its
@@ -138,8 +140,9 @@ export async function recordVerdict(t, request, value) {
         ...(verdict.data !== undefined ? { data: verdict.data } : {}),
     });
 }
-function scheduleAfterCommit(t, schedule, id, wake) {
-    t.afterCommit(() => schedule(id, wake));
+/** Writes the wake to the outbox; `schedule` delivers it after commit. */
+function requestWake(t, schedule, id, wake) {
+    return t.wake(id, wake, schedule);
 }
 /** Active agent turns + tool nodes in flight for one workflow turn. */
 export async function countActiveFlowWork(t, workflowSessionId, turnId) {
@@ -242,7 +245,7 @@ export async function wakeLinkedWorkflow(input) {
     await settleAgentEffect({ t, effect, outcome });
     workflow.status = "runnable";
     await t.put("sessions", workflow.id, workflow);
-    scheduleAfterCommit(t, input.schedule, workflow.id, {
+    await requestWake(t, input.schedule, workflow.id, {
         reason: "linked",
         dedupeKey: `linked:${link.turnId}:${link.effectId}`,
     });
@@ -471,7 +474,7 @@ export async function wakeForQueuedEffects(input) {
         workflow.status = "runnable";
         await t.put("sessions", workflow.id, workflow);
     }
-    scheduleAfterCommit(t, input.schedule, input.workflowSessionId, {
+    await requestWake(t, input.schedule, input.workflowSessionId, {
         reason: "flow",
     });
     return true;

package/dist/execution/types.d.ts

@@ -3,7 +3,10 @@
  *
  * Durable Session Execution decides when to look at a session again. It never
  * holds session state: every outcome lives in the Session Store, and `advance`
- * is safe to repeat (§10.1). Restate is the supported implementation
+ * is safe to repeat (§10.1). It owns the schedule (wake delivery, one advance per
+ * key, retries, timers, the sweep chain); the Session Store owns the record (the
+ * checkpoint, the effect journal, the events) and the wake outbox that bridges the
+ * two. Restate is the supported implementation
  * (`adapters/execution/restate.ts`); `execution/memory.ts` is the in-process
  * implementation used by unit tests, `startEphemeralRuntime` and a Host
  * started without Restate endpoints.
@@ -15,11 +18,14 @@
  *   Different keys may run concurrently.
  * - **At least once after a wake.** When `wake` resolves, an `advance` for the
  *   key will start after that point (possibly merged with other wakes). Wakes
- *   are sent after the Session Store transaction that caused them commits
- *   (`Tx.afterCommit`), never inside it.
+ *   are sent after the Session Store transaction that caused them commits, never
+ *   inside it: the transaction writes the wake to its outbox (`Tx.wake`), and the
+ *   wake is sent after commit, or by the Tenant sweep when that send failed or a
+ *   crash cut it off. A wake may therefore be sent more than once, always with the
+ *   same `dedupeKey`.
  * - **Dedupe.** Wakes carrying the same `dedupeKey` for the same key cause at
  *   most one advance for that cause (within the implementation's retention
- *   window, at least 24 hours for Restate).
+ *   window, at least 24 hours for Restate). Every wake from the outbox has one.
  * - **Busy re-wake.** An advance that returns `busy` is re-run for the same key
  *   after `retryAfterMs`.
  * - **Retries on infrastructure errors.** A handler that throws is retried with
@@ -27,7 +33,9 @@
  *   becomes `uncertain` is settled in the Session Store and `advance` returns
  *   `done`.
  * - **Sweeps.** `armSweep` arms one self-re-arming sweep per Tenant; arming an
- *   armed Tenant is a no-op. The sweep re-wakes orphaned `runnable` sessions.
+ *   armed Tenant is a no-op. The sweep sends the outbox's undelivered wakes and,
+ *   as a backstop for what an implementation lost, re-wakes orphaned sessions
+ *   (`tenant/sweep.ts`).
  * - **One reconcile per sandbox at a time** (F7.2). `sandbox` runs
  *   `WorkerHandlers.sandbox` for the key `<tenantId>:<sandboxId>` at least once
  *   after a `reconcile` resolves, never overlapping another run for the key. A

package/dist/execution/types.js

@@ -3,7 +3,10 @@
  *
  * Durable Session Execution decides when to look at a session again. It never
  * holds session state: every outcome lives in the Session Store, and `advance`
- * is safe to repeat (§10.1). Restate is the supported implementation
+ * is safe to repeat (§10.1). It owns the schedule (wake delivery, one advance per
+ * key, retries, timers, the sweep chain); the Session Store owns the record (the
+ * checkpoint, the effect journal, the events) and the wake outbox that bridges the
+ * two. Restate is the supported implementation
  * (`adapters/execution/restate.ts`); `execution/memory.ts` is the in-process
  * implementation used by unit tests, `startEphemeralRuntime` and a Host
  * started without Restate endpoints.
@@ -15,11 +18,14 @@
  *   Different keys may run concurrently.
  * - **At least once after a wake.** When `wake` resolves, an `advance` for the
  *   key will start after that point (possibly merged with other wakes). Wakes
- *   are sent after the Session Store transaction that caused them commits
- *   (`Tx.afterCommit`), never inside it.
+ *   are sent after the Session Store transaction that caused them commits, never
+ *   inside it: the transaction writes the wake to its outbox (`Tx.wake`), and the
+ *   wake is sent after commit, or by the Tenant sweep when that send failed or a
+ *   crash cut it off. A wake may therefore be sent more than once, always with the
+ *   same `dedupeKey`.
  * - **Dedupe.** Wakes carrying the same `dedupeKey` for the same key cause at
  *   most one advance for that cause (within the implementation's retention
- *   window, at least 24 hours for Restate).
+ *   window, at least 24 hours for Restate). Every wake from the outbox has one.
  * - **Busy re-wake.** An advance that returns `busy` is re-run for the same key
  *   after `retryAfterMs`.
  * - **Retries on infrastructure errors.** A handler that throws is retried with
@@ -27,7 +33,9 @@
  *   becomes `uncertain` is settled in the Session Store and `advance` returns
  *   `done`.
  * - **Sweeps.** `armSweep` arms one self-re-arming sweep per Tenant; arming an
- *   armed Tenant is a no-op. The sweep re-wakes orphaned `runnable` sessions.
+ *   armed Tenant is a no-op. The sweep sends the outbox's undelivered wakes and,
+ *   as a backstop for what an implementation lost, re-wakes orphaned sessions
+ *   (`tenant/sweep.ts`).
  * - **One reconcile per sandbox at a time** (F7.2). `sandbox` runs
  *   `WorkerHandlers.sandbox` for the key `<tenantId>:<sandboxId>` at least once
  *   after a `reconcile` resolves, never overlapping another run for the key. A

package/dist/gates/egress-credentials.d.ts

@@ -0,0 +1,48 @@
+import type { Duplex } from "node:stream";
+import type { Logger } from "../tenant/types.js";
+/** What the vault answers for one request to a host a credential may be bound to. */
+export type EgressCredentialRelease = {
+    readonly status: "none";
+} | {
+    readonly status: "released";
+    readonly header: string;
+    readonly value: string;
+    readonly credentialId: string;
+} | {
+    readonly status: "refused";
+    readonly reason: string;
+};
+export interface EgressCredentials {
+    /** Whether an `environment_secret` of a live session on the sandbox is bound to `host`. */
+    bound(sandboxId: string, host: string): Promise<boolean>;
+    /** The header to set on one request, read from the vault each time. */
+    release(sandboxId: string, host: string): Promise<EgressCredentialRelease>;
+    /** A fresh leaf for `host`: its key, made here, and its certificate, signed by keys. */
+    leaf(host: string): Promise<{
+        readonly key: string;
+        readonly cert: string;
+    }>;
+    /** Tests: the CA upstream servers are verified against, instead of the public roots. */
+    readonly upstreamCa?: string;
+    /** Tests: the port requests are sent to, instead of 443. */
+    readonly upstreamPort?: number;
+}
+export interface CredentialTerminator {
+    /**
+     * Answers the CONNECT, terminates TLS for `host` and serves its requests, sending each to one
+     * of `addresses` (already checked) and nowhere else.
+     */
+    terminate(client: Duplex, target: {
+        readonly sandboxId: string;
+        readonly host: string;
+        readonly addresses: readonly {
+            address: string;
+            family: number;
+        }[];
+    }): Promise<void>;
+}
+export declare function credentialTerminator(options: {
+    readonly credentials: EgressCredentials;
+    readonly logger: Logger;
+    readonly idleMs: number;
+}): CredentialTerminator;

package/dist/gates/egress-credentials.js

@@ -0,0 +1,147 @@
+/**
+ * egress-gate's credential path (R2c, D50): how a skill's CLI authenticates while the secret
+ * stays out of the sandbox. A CONNECT to port 443 of a host that an `environment_secret` of a
+ * live session on the sandbox is bound to (`allowedHosts`) is not tunnelled: the gate answers
+ * 200, terminates TLS with a fresh leaf for that host signed by the installation's egress CA
+ * (keys holds its key; the pod trusts its certificate, `harness/pod.ts`), and reads HTTP/1.1
+ * requests. For each request it reads the vault (one Postgres query, no cache, so a rotation
+ * applies to the next request), sets the credential's header (replacing any of that name, such
+ * as the `nylorun-managed` sentinel the CLI sent), and forwards it over TLS to the address the
+ * gate already checked, verifying the host's certificate by name against the public roots.
+ *
+ * Nothing here knows a tool: the header name and its format are the credential's. A release the
+ * vault refuses (two secrets for one host, an unreadable value) answers 502 and is logged, never
+ * as an event; a value never is. Upgrades (WebSocket) and HTTP/2 are not served on this path.
+ */
+import { createServer } from "node:http";
+import { Agent, request } from "node:https";
+import { createSecureContext, TLSSocket } from "node:tls";
+/** Headers that describe one hop and are never forwarded. */
+const HOP_BY_HOP = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+/** `rawHeaders` without hop-by-hop headers and `drop`, as lowercase names to values. */
+function forwardable(raw, drop) {
+    const headers = {};
+    for (let i = 0; i + 1 < raw.length; i += 2) {
+        const name = raw[i].toLowerCase();
+        if (HOP_BY_HOP.has(name) || name === drop)
+            continue;
+        (headers[name] ??= []).push(raw[i + 1]);
+    }
+    return headers;
+}
+function reply(res, status, message) {
+    if (res.headersSent) {
+        res.destroy();
+        return;
+    }
+    const body = `egress-gate: ${message}\n`;
+    res.writeHead(status, { "content-type": "text/plain; charset=utf-8", "content-length": Buffer.byteLength(body) });
+    res.end(body);
+}
+export function credentialTerminator(options) {
+    const { credentials, logger } = options;
+    const terminated = new WeakMap();
+    const http = createServer((req, res) => {
+        forward(req, res).catch((error) => {
+            logger.error("egress_forward_failed", { error: error instanceof Error ? error.message : String(error) });
+            reply(res, 502, "the request failed");
+        });
+    });
+    http.keepAliveTimeout = options.idleMs;
+    http.headersTimeout = 60_000;
+    // Uploads may be long; the client socket's idle timeout still applies.
+    http.requestTimeout = 0;
+    http.on("upgrade", (req, socket) => {
+        const at = terminated.get(req.socket);
+        logger.warn("egress_refused", { status: 501, reason: "upgrade_refused", sandboxId: at?.sandboxId, host: at?.host });
+        socket.destroy();
+    });
+    http.on("clientError", (_error, socket) => socket.destroy());
+    async function forward(req, res) {
+        const at = terminated.get(req.socket);
+        if (!at) {
+            res.destroy();
+            return;
+        }
+        const { sandboxId, host } = at;
+        const release = await credentials.release(sandboxId, host);
+        if (release.status === "refused") {
+            logger.warn("egress_credential_refused", { status: 502, reason: release.reason, sandboxId, host });
+            req.resume();
+            return reply(res, 502, `the credential for ${host} could not be used`);
+        }
+        const header = release.status === "released" ? release.header.toLowerCase() : undefined;
+        const headers = forwardable(req.rawHeaders, header);
+        if (release.status === "released")
+            headers[header] = [release.value];
+        const upstream = request({
+            host,
+            port: credentials.upstreamPort ?? 443,
+            servername: host,
+            method: req.method,
+            path: req.url,
+            headers,
+            agent: at.agent,
+        });
+        upstream.on("response", (response) => {
+            res.writeHead(response.statusCode ?? 502, response.statusMessage, forwardable(response.rawHeaders));
+            response.pipe(res);
+            response.on("error", () => res.destroy());
+        });
+        upstream.on("error", (error) => {
+            logger.warn("egress_upstream_failed", { status: 502, sandboxId, host, code: error.code });
+            reply(res, 502, `could not reach ${host}`);
+        });
+        req.on("error", () => upstream.destroy());
+        res.on("close", () => {
+            if (!res.writableFinished)
+                upstream.destroy();
+        });
+        req.pipe(upstream);
+    }
+    return {
+        async terminate(client, target) {
+            const { sandboxId, host, addresses } = target;
+            const leaf = await credentials.leaf(host);
+            if (client.destroyed)
+                return;
+            // Requests go to the addresses the gate checked, never to the name resolved again.
+            const lookup = (_name, lookupOptions, callback) => {
+                if (lookupOptions.all)
+                    callback(null, addresses);
+                else
+                    callback(null, addresses[0].address, addresses[0].family);
+            };
+            const agent = new Agent({
+                keepAlive: true,
+                maxSockets: 8,
+                lookup,
+                ...(credentials.upstreamCa ? { ca: credentials.upstreamCa } : {}),
+            });
+            client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+            const tls = new TLSSocket(client, {
+                isServer: true,
+                secureContext: createSecureContext({ key: leaf.key, cert: leaf.cert }),
+                ALPNProtocols: ["http/1.1"],
+            });
+            terminated.set(tls, { sandboxId, host, agent });
+            tls.on("error", () => tls.destroy());
+            tls.on("close", () => {
+                agent.destroy();
+                client.destroy();
+            });
+            logger.info("egress_terminated", { sandboxId, host });
+            http.emit("connection", tls);
+        },
+    };
+}

package/dist/gates/egress.d.ts

@@ -3,6 +3,7 @@ import { type Socket } from "node:net";
 import type { EgressTokenVerdict } from "../sandbox/egress-token.js";
 import type { SessionStore } from "../store/types.js";
 import type { Logger } from "../tenant/types.js";
+import { type EgressCredentials } from "./egress-credentials.js";
 /**
  * What egress-gate reads of a sandbox: its current host epoch, the pod that joined at it, and
  * its spec's `network.allow`; `undefined` when it is gone, deleted, lost, expired or not a pod.
@@ -46,6 +47,8 @@ export interface StartEgressGateOptions {
     readonly blocked?: (address: string) => boolean;
     /** Tests replace how the checked address is dialled. */
     readonly dial?: (address: string, port: number) => Socket;
+    /** The vault and keys, for hosts an `environment_secret` is bound to (R2c). None: tunnels only. */
+    readonly credentials?: EgressCredentials;
 }
 export interface EgressGate {
     /** Where the gate listens, e.g. `http://0.0.0.0:4200`. */

package/dist/gates/egress.js

@@ -17,7 +17,10 @@
  *    (cloud metadata included), multicast or reserved, else 502 or 403;
  * 6. the gate connects to that checked address (never to the name again) and pipes.
  *
- * No TLS interception and no credential injection: a tunnel is opaque bytes. Any other request
+ * A tunnel is opaque bytes, with one exception (R2c, D50): port 443 of a host that an
+ * `environment_secret` of a live session on the sandbox is bound to. There the gate terminates
+ * TLS and sets the credential's header on every request (`egress-credentials.ts`), still sending
+ * only to the checked address. Every other host gets the tunnel. Any other request
  * (an absolute-form plain HTTP request included) is answered 405. Refusals are logged, never as
  * events; the token never is. Tunnels close after `idleMs` without traffic in either direction.
  */
@@ -27,6 +30,7 @@ import { BlockList, connect, isIP } from "node:net";
 import { isSandboxHostPattern } from "@nylorun/core/define";
 import { isPrivateAddress } from "../tenant/outbound.js";
 import { bindListener } from "../host/http.js";
+import { credentialTerminator } from "./egress-credentials.js";
 /** Ports a tunnel may open. */
 export const EGRESS_PORTS = [443, 80];
 /** Tunnels one sandbox may hold open at once. */
@@ -151,6 +155,9 @@ export async function startEgressGate(options) {
             cache.delete(cache.keys().next().value);
         return value;
     }
+    const terminator = options.credentials
+        ? credentialTerminator({ credentials: options.credentials, logger, idleMs })
+        : undefined;
     const open = new Map();
     const tunnels = new Set();
     async function onConnect(req, client, head) {
@@ -209,6 +216,12 @@ export async function startEgressGate(options) {
             return refuse(403, "address_refused", { sandboxId }, `${host} resolves only to addresses tunnels may not reach`);
         if (client.destroyed)
             return;
+        if (terminator && port === 443 && (await options.credentials.bound(sandboxId, host))) {
+            // A client that spoke before the 200 is not one this path serves.
+            if (head.length > 0)
+                return refuse(403, "early_data", { sandboxId }, "wait for the CONNECT answer before sending");
+            return terminator.terminate(client, { sandboxId, host, addresses: allowed });
+        }
         const upstream = await dialFirst(allowed.map((entry) => entry.address), port);
         if (!upstream)
             return refuse(502, "connect_failed", { sandboxId }, `could not connect to ${host}:${port}`);

package/dist/gates/tenant-vaults.d.ts

@@ -34,6 +34,10 @@ export interface TenantVault {
     authorizeMcp(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
     /** Vault writes and token signing with the Tenant's vault key (the keys service, F4.2). */
     keys(): Keys;
+    /** Whether a live session on the sandbox has an `environment_secret` bound to `host` (R2c). */
+    environmentSecretBound(sandboxId: string, host: string): Promise<boolean>;
+    /** The header an `environment_secret` sets on one request to `host` (R2c). */
+    releaseEnvironmentSecret(sandboxId: string, host: string): ReturnType<VaultService["releaseEnvironmentSecret"]>;
 }
 export interface TenantVaults {
     /**

package/dist/gates/tenant-vaults.js

@@ -52,6 +52,8 @@ export function createTenantVaults(options) {
             session,
             authorizeMcp: (sessionId, request) => authorizeSessionMcp(credentials, session, sessionId, request),
             keys: () => keys,
+            environmentSecretBound: (sandboxId, host) => credentials.environmentSecretBound(sandboxId, host),
+            releaseEnvironmentSecret: (sandboxId, host) => credentials.releaseEnvironmentSecret({ sandboxId, host }),
         };
     }
     /** The database's Tenant, once its schema is at this build's version. */