@nylorun/runtime 0.21.0-beta → 0.22.0-beta

package/dist/keys/x509.js

@@ -0,0 +1,160 @@
+/**
+ * The two certificates R2c needs (D50), built without a dependency: the installation's egress
+ * CA, and a short-lived leaf for one host name that egress-gate presents when it terminates TLS
+ * for a host an `environment_secret` is bound to. Node can parse X.509 but not build it, so this
+ * writes the DER by hand. Both use ECDSA P-256 with SHA-256.
+ *
+ * Only what clients check is written: a CA with basicConstraints CA:TRUE (critical), keyUsage
+ * keyCertSign and cRLSign (critical) and a subject key identifier; a leaf with the host as its
+ * only subjectAltName, keyUsage digitalSignature (critical), extKeyUsage serverAuth, and the
+ * CA's key identifier. Go (`gh`), OpenSSL (`curl`, `git`), Node and Python accept that shape.
+ */
+import { isIP } from "node:net";
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, X509Certificate, } from "node:crypto";
+const OID = {
+    ecdsaWithSha256: "1.2.840.10045.4.3.2",
+    commonName: "2.5.4.3",
+    organization: "2.5.4.10",
+    basicConstraints: "2.5.29.19",
+    keyUsage: "2.5.29.15",
+    extKeyUsage: "2.5.29.37",
+    serverAuth: "1.3.6.1.5.5.7.3.1",
+    subjectAltName: "2.5.29.17",
+    subjectKeyIdentifier: "2.5.29.14",
+    authorityKeyIdentifier: "2.5.29.35",
+};
+function length(n) {
+    if (n < 0x80)
+        return Buffer.from([n]);
+    const bytes = [];
+    for (let v = n; v > 0; v = Math.floor(v / 256))
+        bytes.unshift(v & 0xff);
+    return Buffer.from([0x80 | bytes.length, ...bytes]);
+}
+function tlv(tag, content) {
+    return Buffer.concat([Buffer.from([tag]), length(content.length), content]);
+}
+const seq = (...items) => tlv(0x30, Buffer.concat(items));
+const set = (...items) => tlv(0x31, Buffer.concat(items));
+const octets = (content) => tlv(0x04, content);
+const bits = (content, unused = 0) => tlv(0x03, Buffer.concat([Buffer.from([unused]), content]));
+const bool = (value) => tlv(0x01, Buffer.from([value ? 0xff : 0x00]));
+const explicit = (n, content) => tlv(0xa0 + n, content);
+function integer(value) {
+    let v = value;
+    while (v.length > 1 && v[0] === 0 && (v[1] & 0x80) === 0)
+        v = v.subarray(1);
+    if (v[0] & 0x80)
+        v = Buffer.concat([Buffer.from([0]), v]);
+    return tlv(0x02, v);
+}
+function oid(dotted) {
+    const parts = dotted.split(".").map(Number);
+    const out = [40 * parts[0] + parts[1]];
+    for (const part of parts.slice(2)) {
+        const chunk = [part & 0x7f];
+        for (let v = Math.floor(part / 128); v > 0; v = Math.floor(v / 128))
+            chunk.unshift((v & 0x7f) | 0x80);
+        out.push(...chunk);
+    }
+    return tlv(0x06, Buffer.from(out));
+}
+function name(fields) {
+    const rdns = [set(seq(oid(OID.commonName), tlv(0x0c, Buffer.from(fields.commonName, "utf8"))))];
+    if (fields.organization)
+        rdns.unshift(set(seq(oid(OID.organization), tlv(0x0c, Buffer.from(fields.organization, "utf8")))));
+    return seq(...rdns);
+}
+/** UTCTime before 2050, GeneralizedTime from then on (RFC 5280 §4.1.2.5). */
+function time(at) {
+    const iso = at.toISOString().replace(/[-:T]/g, "").slice(0, 14) + "Z";
+    return at.getUTCFullYear() < 2050 ? tlv(0x17, Buffer.from(iso.slice(2), "ascii")) : tlv(0x18, Buffer.from(iso, "ascii"));
+}
+function extension(id, critical, value) {
+    return critical ? seq(oid(id), bool(true), octets(value)) : seq(oid(id), octets(value));
+}
+function spki(key) {
+    return key.export({ type: "spki", format: "der" });
+}
+/** SHA-1 of the subjectPublicKey bits (RFC 5280 §4.2.1.2, method 1). */
+function keyIdentifier(publicKey) {
+    const der = spki(publicKey);
+    // The SPKI is SEQUENCE { AlgorithmIdentifier, BIT STRING }; for P-256 the key is its last 65 bytes.
+    return createHash("sha1").update(der.subarray(der.length - 65)).digest();
+}
+function serial() {
+    const value = randomBytes(16);
+    value[0] = value[0] & 0x7f;
+    return integer(value);
+}
+function certificate(tbs, issuerKey) {
+    const algorithm = seq(oid(OID.ecdsaWithSha256));
+    const signature = sign("sha256", tbs, issuerKey);
+    return seq(tbs, algorithm, bits(signature));
+}
+function pem(der) {
+    const body = der.toString("base64").replace(/(.{64})/g, "$1\n").replace(/\n$/, "");
+    return `-----BEGIN CERTIFICATE-----\n${body}\n-----END CERTIFICATE-----\n`;
+}
+/** A new P-256 CA, valid from an hour ago for `days` days. */
+export function createCertificateAuthority(options) {
+    const { publicKey, privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+    const now = options.now ?? new Date();
+    const subject = name({ commonName: options.commonName, organization: "Nylorun" });
+    const ski = keyIdentifier(publicKey);
+    const tbs = seq(explicit(0, integer(Buffer.from([2]))), serial(), seq(oid(OID.ecdsaWithSha256)), subject, seq(time(new Date(now.getTime() - 3_600_000)), time(new Date(now.getTime() + (options.days ?? 3650) * 86_400_000))), subject, spki(publicKey), explicit(3, seq(extension(OID.basicConstraints, true, seq(bool(true), integer(Buffer.from([0])))), extension(OID.keyUsage, true, bits(Buffer.from([0x06]), 1)), extension(OID.subjectKeyIdentifier, false, octets(ski)))));
+    return {
+        certificate: pem(certificate(tbs, privateKey)),
+        privateKey: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+    };
+}
+/**
+ * A leaf for `host` and the caller's `publicKey` (SPKI PEM), signed by the CA, valid from five
+ * minutes ago for `minutes` minutes. The caller keeps the leaf's private key: only the
+ * certificate comes back, so no private key leaves whoever holds it.
+ */
+export function issueLeafCertificate(options) {
+    if (isIP(options.host) !== 0 || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/.test(options.host))
+        throw new Error(`Not a host name: ${options.host}`);
+    const caKey = createPrivateKey(options.authority.privateKey);
+    const ca = new X509Certificate(options.authority.certificate);
+    const publicKey = createPublicKey(options.publicKey);
+    if (publicKey.asymmetricKeyType !== "ec" || publicKey.asymmetricKeyDetails?.namedCurve !== "prime256v1")
+        throw new Error("A leaf key must be ECDSA P-256");
+    const now = options.now ?? new Date();
+    const issuer = Buffer.from(ca.raw);
+    const tbs = seq(explicit(0, integer(Buffer.from([2]))), serial(), seq(oid(OID.ecdsaWithSha256)), subjectOf(issuer), seq(time(new Date(now.getTime() - 300_000)), time(new Date(now.getTime() + (options.minutes ?? 60) * 60_000))), name({ commonName: options.host }), spki(publicKey), explicit(3, seq(extension(OID.keyUsage, true, bits(Buffer.from([0x80]), 7)), extension(OID.extKeyUsage, false, seq(oid(OID.serverAuth))), extension(OID.subjectAltName, false, seq(tlv(0x82, Buffer.from(options.host, "ascii")))), extension(OID.authorityKeyIdentifier, false, seq(tlv(0x80, keyIdentifier(ca.publicKey)))))));
+    return pem(certificate(tbs, caKey));
+}
+/** A P-256 key pair for a leaf, as PEM: SPKI for the public key, PKCS#8 for the private key. */
+export function leafKeyPair() {
+    const { publicKey, privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+    return {
+        publicKey: publicKey.export({ type: "spki", format: "pem" }).toString(),
+        privateKey: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+    };
+}
+/** The subject Name of a DER certificate, byte for byte, to use as a leaf's issuer. */
+function subjectOf(der) {
+    // Certificate ::= SEQUENCE { tbs SEQUENCE { [0] version, serial, sigAlg, issuer, validity, subject, … } }
+    const read = (buf, at) => {
+        let len = buf[at + 1];
+        let header = 2;
+        if (len & 0x80) {
+            const n = len & 0x7f;
+            len = 0;
+            for (let i = 0; i < n; i++)
+                len = len * 256 + buf[at + 2 + i];
+            header += n;
+        }
+        return { start: at, header, end: at + header + len };
+    };
+    const cert = read(der, 0);
+    const tbs = read(der, cert.start + cert.header);
+    // TBSCertificate fields: [0] version, serial, signature, issuer, validity, subject.
+    let at = tbs.start + tbs.header;
+    for (let field = 0; field < 5; field++)
+        at = read(der, at).end;
+    const subject = read(der, at);
+    return der.subarray(subject.start, subject.end);
+}

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.21.0-beta",
+    "version": "0.22.0-beta",
     "x-nylorun-protocol": {
       "min": 4,
       "max": 10,
@@ -97,6 +97,7 @@
               "definition_files_missing",
               "credential_rejected",
               "mcp_preview_failed",
+              "credential_conflict",
               "internal_error"
             ]
           },
@@ -2113,7 +2114,9 @@
             "type": "string",
             "enum": [
               "bearer",
-              "headers"
+              "headers",
+              "environment_secret",
+              "environment_variable"
             ]
           },
           "binding": {
@@ -2121,11 +2124,41 @@
             "properties": {
               "url": {
                 "type": "string"
+              },
+              "secretName": {
+                "type": "string"
+              },
+              "allowedHosts": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "inject": {
+                "type": "object",
+                "properties": {
+                  "header": {
+                    "type": "string",
+                    "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                  },
+                  "format": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "required": [
+                  "header",
+                  "format"
+                ],
+                "additionalProperties": false
+              },
+              "variableName": {
+                "type": "string"
+              },
+              "variableValue": {
+                "type": "string"
               }
             },
-            "required": [
-              "url"
-            ],
             "additionalProperties": false
           },
           "headerNames": {
@@ -2269,6 +2302,85 @@
                   "headers"
                 ],
                 "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "enum": [
+                      "environment_secret"
+                    ]
+                  },
+                  "secretName": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+                  },
+                  "secretValue": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 8192
+                  },
+                  "allowedHosts": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "minItems": 1,
+                    "maxItems": 32
+                  },
+                  "inject": {
+                    "type": "object",
+                    "properties": {
+                      "header": {
+                        "type": "string",
+                        "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                      },
+                      "format": {
+                        "type": "string",
+                        "minLength": 1
+                      }
+                    },
+                    "required": [
+                      "header",
+                      "format"
+                    ],
+                    "additionalProperties": false
+                  }
+                },
+                "required": [
+                  "type",
+                  "secretName",
+                  "secretValue",
+                  "allowedHosts"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "enum": [
+                      "environment_variable"
+                    ]
+                  },
+                  "variableName": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+                  },
+                  "variableValue": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 8192
+                  }
+                },
+                "required": [
+                  "type",
+                  "variableName",
+                  "variableValue"
+                ],
+                "additionalProperties": false
               }
             ]
           }
@@ -2302,7 +2414,9 @@
                   "type": "string",
                   "enum": [
                     "bearer",
-                    "headers"
+                    "headers",
+                    "environment_secret",
+                    "environment_variable"
                   ]
                 },
                 "binding": {
@@ -2310,11 +2424,41 @@
                   "properties": {
                     "url": {
                       "type": "string"
+                    },
+                    "secretName": {
+                      "type": "string"
+                    },
+                    "allowedHosts": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    "inject": {
+                      "type": "object",
+                      "properties": {
+                        "header": {
+                          "type": "string",
+                          "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                        },
+                        "format": {
+                          "type": "string",
+                          "minLength": 1
+                        }
+                      },
+                      "required": [
+                        "header",
+                        "format"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "variableName": {
+                      "type": "string"
+                    },
+                    "variableValue": {
+                      "type": "string"
                     }
                   },
-                  "required": [
-                    "url"
-                  ],
                   "additionalProperties": false
                 },
                 "headerNames": {
@@ -2463,6 +2607,48 @@
                   "headers"
                 ],
                 "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "enum": [
+                      "environment_secret"
+                    ]
+                  },
+                  "secretValue": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 8192
+                  }
+                },
+                "required": [
+                  "type",
+                  "secretValue"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "enum": [
+                      "environment_variable"
+                    ]
+                  },
+                  "variableValue": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 8192
+                  }
+                },
+                "required": [
+                  "type",
+                  "variableValue"
+                ],
+                "additionalProperties": false
               }
             ]
           }

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.21.0-beta",
+    "version": "0.22.0-beta",
     "x-nylorun-protocol": {
       "min": 4,
       "max": 10,
@@ -6338,6 +6338,7 @@
               "definition_files_missing",
               "credential_rejected",
               "mcp_preview_failed",
+              "credential_conflict",
               "internal_error"
             ]
           },

package/dist/sandbox/join.d.ts

@@ -15,6 +15,8 @@ export interface HostJoinAnswer {
     readonly epoch: number;
     /** ISO time the tokens expire. */
     readonly expiresAt: string;
+    /** The egress CA certificate (PEM) the sandbox trusts (R2c). */
+    readonly caCertificate: string;
 }
 /** A refused join, renewal or host connection. */
 export declare class HostAuthError extends Error {

package/dist/sandbox/join.js

@@ -24,6 +24,10 @@
  * and the pod (`tenant/host-token.ts`). `renew` mints a new pair at the same epoch while the
  * host is current; it is refused once the epoch moved.
  *
+ * The answer also carries the installation's egress CA certificate (R2c, D50): the engine adds it
+ * to the trust bundle every command gets, so a host egress-gate terminates TLS for (one an
+ * `environment_secret` is bound to) is trusted. Only the certificate: its key stays in keys.
+ *
  * Every refusal answers the same 401 (the reason is logged), so a caller learns nothing about
  * which check failed.
  */
@@ -53,13 +57,14 @@ function sameHash(a, b) {
     const right = Buffer.from(b, "hex");
     return left.length === right.length && left.length > 0 && timingSafeEqual(left, right);
 }
-function answerOf(grant) {
+function answerOf(grant, caCertificate) {
     return {
         hostToken: grant.hostToken,
         egressToken: grant.egressToken,
         sandboxId: grant.claims.sandboxId,
         epoch: grant.claims.epoch,
         expiresAt: new Date(grant.claims.expiresAt).toISOString(),
+        caCertificate,
     };
 }
 export function hostAuthority(ctx) {
@@ -154,11 +159,11 @@ export function hostAuthority(ctx) {
             // The previous host's connection (an older epoch) serves nothing more.
             ctx.harness.revokeHost(sandboxId, joined);
             ctx.config.logger.info("sandbox host joined", { sandboxId, epoch: joined });
-            return answerOf(await mintHostTokens(ctx, { sandboxId, epoch: joined, podUid }));
+            return answerOf(await mintHostTokens(ctx, { sandboxId, epoch: joined, podUid }), await ctx.keys.egressCa());
         },
         async renew(hostToken) {
             const claims = await verified(hostToken);
-            return answerOf(await mintHostTokens(ctx, claims));
+            return answerOf(await mintHostTokens(ctx, claims), await ctx.keys.egressCa());
         },
         verify: verified,
     };

package/dist/sandbox/manager.d.ts

@@ -34,6 +34,8 @@ export interface SandboxSessionRef {
      * so every session attached to it shares the files; absent, the workspace is the session's.
      */
     readonly sandboxId?: string;
+    /** Variables every command of the call gets (R2c): secret names set to the sentinel, plain values. */
+    readonly environment?: Readonly<Record<string, string>>;
     /**
      * Who the call's events are claimed for, passed back to `emit`: in a harness, the run that
      * made the call (its run id).

package/dist/sandbox/manager.js

@@ -285,7 +285,7 @@ export class SandboxManager {
         try {
             const outcome = await runSandboxTool(live.handle, toolName, (input ?? {}), signal, (value) => {
                 report = value;
-            });
+            }, session.environment);
             await this.options.emit(session.id, session.activeTurnId, "sandbox.exec", {
                 tool: toolName,
                 ...report,

package/dist/sandbox/tools.d.ts

@@ -20,4 +20,6 @@ export declare function truncateMiddle(value: string, limit?: number): {
     text: string;
     truncated: boolean;
 };
-export declare function runSandboxTool(handle: SandboxHandle, name: SandboxToolName, input: Record<string, any>, signal: AbortSignal, report: (value: SandboxToolReport) => void): Promise<SandboxToolOutcome>;
+export declare function runSandboxTool(handle: SandboxHandle, name: SandboxToolName, input: Record<string, any>, signal: AbortSignal, report: (value: SandboxToolReport) => void, 
+/** Variables every command gets (R2c): secret names set to the sentinel, plain values. */
+environment?: Readonly<Record<string, string>>): Promise<SandboxToolOutcome>;

package/dist/sandbox/tools.js

@@ -39,10 +39,12 @@ const failed = (code, message) => ({
     code,
     message,
 });
-export async function runSandboxTool(handle, name, input, signal, report) {
+export async function runSandboxTool(handle, name, input, signal, report, 
+/** Variables every command gets (R2c): secret names set to the sentinel, plain values. */
+environment) {
     const workspace = handle.workspace ?? SANDBOX_WORKSPACE;
     const resolvePath = (path) => resolveSandboxPath(path, workspace);
-    const exec = (command, timeoutMs = 60_000) => handle.exec({ command, cwd: workspace, timeoutMs }, signal);
+    const exec = (command, timeoutMs = 60_000) => handle.exec({ command, cwd: workspace, timeoutMs, ...(environment ? { env: environment } : {}) }, signal);
     switch (name) {
         case "bash": {
             const command = String(input.command);

package/dist/sandbox/types.d.ts

@@ -36,6 +36,11 @@ export interface ExecRequest {
     readonly command: string;
     readonly cwd: string;
     readonly timeoutMs: number;
+    /**
+     * Variables this command gets on top of the backend's own (R2c): never a secret. The backend's
+     * proxy and trust variables win over them.
+     */
+    readonly env?: Readonly<Record<string, string>>;
 }
 export interface ExecResult {
     readonly exitCode: number;

package/dist/store/postgres/drizzle/0017_wake_outbox.sql

@@ -0,0 +1,9 @@
+CREATE TABLE "nylorun"."wakes" (
+	"id" text COLLATE "C" PRIMARY KEY NOT NULL,
+	"session_id" text COLLATE "C" NOT NULL,
+	"reason" text NOT NULL,
+	"dedupe_key" text,
+	"created_at" timestamp with time zone DEFAULT clock_timestamp() NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX "wakes_created_at" ON "nylorun"."wakes" USING btree ("created_at");

package/dist/store/postgres/drizzle/meta/_journal.json

@@ -120,6 +120,13 @@
       "when": 1791395759051,
       "tag": "0016_mcp_oauth_removed",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "7",
+      "when": 1791455573196,
+      "tag": "0017_wake_outbox",
+      "breakpoints": true
     }
   ]
 }