@nylorun/runtime 0.21.1-beta → 0.22.0-beta

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.22.0-beta
+
+### Minor Changes
+
+- 212364b: **Credentials for skills (R2c).** A skill's CLI in a pod sandbox authenticates with a vault credential whose value never enters the sandbox.
+
+  - `@nylorun/core`: vault credentials gain `environment_secret` (`secretName`, `secretValue`, `allowedHosts`, optional `inject: { header, format }`) and `environment_variable` (`variableName`, `variableValue`), in create, rotate and `CredentialInfo` (whose `binding.url` is now optional). `ENVIRONMENT_SECRET_SENTINEL` (`nylorun-managed`), `ENVIRONMENT_SECRET_DEFAULT_INJECT`, `isInjectFormat`, `renderInjectFormat`, `EnvironmentNameSchema` and `RESERVED_ENVIRONMENT_NAMES` are exported; `ERROR_CODES` gains `credential_conflict`; the Harness API's `RunRouting.sandbox` gains `environment`.
+  - `@nylorun/runtime`: every sandbox command gets each secret's name set to `nylorun-managed` and each variable's value. egress-gate terminates TLS for port 443 of a host an `environment_secret` of the sandbox's sessions is bound to, with a fresh leaf signed by the installation's egress CA (held by keys; its certificate reaches the pod in the join answer, and the engine points `SSL_CERT_FILE`, `NODE_EXTRA_CA_CERTS`, `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`, `GIT_SSL_CAINFO` and `AWS_CA_BUNDLE` at a bundle with it), and sets the credential's header on every request from the vault, uncached. Every other host stays an opaque tunnel. Session open answers `409 credential_conflict` for two credentials with one variable name or one host, or two owners' secrets on one sandbox. No protocol change.
+  - `@nylorun/studio`: the Credentials page lists shell credentials (their variable and hosts) and deletes them; create and rotate them with the Management API.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [212364b]
+- Updated dependencies
+  - @nylorun/core@0.19.0-beta
+  - @nylorun/harness@0.25.1-beta
+
 ## 0.21.1-beta
 
 ### Patch Changes

package/dist/adapters/sandbox/local.js

@@ -57,7 +57,7 @@ export function localBackend(options) {
             return reject(signal.reason ?? new Error("Turn cancelled"));
         const child = spawn("/bin/sh", ["-c", request.command], {
             cwd: request.cwd,
-            env: { ...env, ...(options.proxyEnv?.() ?? {}) },
+            env: { ...env, ...(request.env ?? {}), ...(options.proxyEnv?.() ?? {}) },
             stdio: ["ignore", "pipe", "pipe"],
             // Its own process group, so a timeout or a cancel kills everything it started.
             detached: true,

package/dist/adapters/sandbox/virtual.js

@@ -81,7 +81,7 @@ export function virtualBackend(options) {
                     try {
                         const result = await bash.exec(request.command, {
                             cwd: request.cwd,
-                            env: { ...ENV },
+                            env: { ...(request.env ?? {}), ...ENV },
                             replaceEnv: true,
                             rawScript: true,
                             signal: controller.signal,

package/dist/api/components.d.ts

@@ -10,6 +10,7 @@ export declare const Rejected: z.ZodObject<{
     status: z.ZodLiteral<"rejected">;
     code: z.ZodEnum<{
         connection_missing: "connection_missing";
+        credential_conflict: "credential_conflict";
         credential_invalid: "credential_invalid";
         credential_rejected: "credential_rejected";
         credential_required: "credential_required";
@@ -8376,6 +8377,19 @@ export declare const CreateCredentialRequest: z.ZodObject<{
         type: z.ZodLiteral<"headers">;
         url: z.ZodString;
         headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"environment_secret">;
+        secretName: z.ZodString;
+        secretValue: z.ZodString;
+        allowedHosts: z.ZodArray<z.ZodString>;
+        inject: z.ZodOptional<z.ZodObject<{
+            header: z.ZodString;
+            format: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"environment_variable">;
+        variableName: z.ZodString;
+        variableValue: z.ZodString;
     }, z.core.$strict>], "type">;
 }, z.core.$strict>;
 export declare const CredentialInfo: z.ZodObject<{
@@ -8384,10 +8398,20 @@ export declare const CredentialInfo: z.ZodObject<{
     name: z.ZodString;
     type: z.ZodEnum<{
         bearer: "bearer";
+        environment_secret: "environment_secret";
+        environment_variable: "environment_variable";
         headers: "headers";
     }>;
     binding: z.ZodObject<{
-        url: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+        secretName: z.ZodOptional<z.ZodString>;
+        allowedHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        inject: z.ZodOptional<z.ZodObject<{
+            header: z.ZodString;
+            format: z.ZodString;
+        }, z.core.$strict>>;
+        variableName: z.ZodOptional<z.ZodString>;
+        variableValue: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     headerNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
     via: z.ZodOptional<z.ZodString>;
@@ -8404,10 +8428,20 @@ export declare const ListCredentialsResponse: z.ZodObject<{
         name: z.ZodString;
         type: z.ZodEnum<{
             bearer: "bearer";
+            environment_secret: "environment_secret";
+            environment_variable: "environment_variable";
             headers: "headers";
         }>;
         binding: z.ZodObject<{
-            url: z.ZodString;
+            url: z.ZodOptional<z.ZodString>;
+            secretName: z.ZodOptional<z.ZodString>;
+            allowedHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            inject: z.ZodOptional<z.ZodObject<{
+                header: z.ZodString;
+                format: z.ZodString;
+            }, z.core.$strict>>;
+            variableName: z.ZodOptional<z.ZodString>;
+            variableValue: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>;
         headerNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
         via: z.ZodOptional<z.ZodString>;
@@ -8435,6 +8469,12 @@ export declare const RotateCredentialRequest: z.ZodObject<{
         }, z.core.$strict>>>;
         type: z.ZodLiteral<"headers">;
         headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"environment_secret">;
+        secretValue: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"environment_variable">;
+        variableValue: z.ZodString;
     }, z.core.$strict>], "type">;
 }, z.core.$strict>;
 export declare const DeletedResponse: z.ZodObject<{

package/dist/gates/egress-credentials.d.ts

@@ -0,0 +1,48 @@
+import type { Duplex } from "node:stream";
+import type { Logger } from "../tenant/types.js";
+/** What the vault answers for one request to a host a credential may be bound to. */
+export type EgressCredentialRelease = {
+    readonly status: "none";
+} | {
+    readonly status: "released";
+    readonly header: string;
+    readonly value: string;
+    readonly credentialId: string;
+} | {
+    readonly status: "refused";
+    readonly reason: string;
+};
+export interface EgressCredentials {
+    /** Whether an `environment_secret` of a live session on the sandbox is bound to `host`. */
+    bound(sandboxId: string, host: string): Promise<boolean>;
+    /** The header to set on one request, read from the vault each time. */
+    release(sandboxId: string, host: string): Promise<EgressCredentialRelease>;
+    /** A fresh leaf for `host`: its key, made here, and its certificate, signed by keys. */
+    leaf(host: string): Promise<{
+        readonly key: string;
+        readonly cert: string;
+    }>;
+    /** Tests: the CA upstream servers are verified against, instead of the public roots. */
+    readonly upstreamCa?: string;
+    /** Tests: the port requests are sent to, instead of 443. */
+    readonly upstreamPort?: number;
+}
+export interface CredentialTerminator {
+    /**
+     * Answers the CONNECT, terminates TLS for `host` and serves its requests, sending each to one
+     * of `addresses` (already checked) and nowhere else.
+     */
+    terminate(client: Duplex, target: {
+        readonly sandboxId: string;
+        readonly host: string;
+        readonly addresses: readonly {
+            address: string;
+            family: number;
+        }[];
+    }): Promise<void>;
+}
+export declare function credentialTerminator(options: {
+    readonly credentials: EgressCredentials;
+    readonly logger: Logger;
+    readonly idleMs: number;
+}): CredentialTerminator;

package/dist/gates/egress-credentials.js

@@ -0,0 +1,147 @@
+/**
+ * egress-gate's credential path (R2c, D50): how a skill's CLI authenticates while the secret
+ * stays out of the sandbox. A CONNECT to port 443 of a host that an `environment_secret` of a
+ * live session on the sandbox is bound to (`allowedHosts`) is not tunnelled: the gate answers
+ * 200, terminates TLS with a fresh leaf for that host signed by the installation's egress CA
+ * (keys holds its key; the pod trusts its certificate, `harness/pod.ts`), and reads HTTP/1.1
+ * requests. For each request it reads the vault (one Postgres query, no cache, so a rotation
+ * applies to the next request), sets the credential's header (replacing any of that name, such
+ * as the `nylorun-managed` sentinel the CLI sent), and forwards it over TLS to the address the
+ * gate already checked, verifying the host's certificate by name against the public roots.
+ *
+ * Nothing here knows a tool: the header name and its format are the credential's. A release the
+ * vault refuses (two secrets for one host, an unreadable value) answers 502 and is logged, never
+ * as an event; a value never is. Upgrades (WebSocket) and HTTP/2 are not served on this path.
+ */
+import { createServer } from "node:http";
+import { Agent, request } from "node:https";
+import { createSecureContext, TLSSocket } from "node:tls";
+/** Headers that describe one hop and are never forwarded. */
+const HOP_BY_HOP = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+/** `rawHeaders` without hop-by-hop headers and `drop`, as lowercase names to values. */
+function forwardable(raw, drop) {
+    const headers = {};
+    for (let i = 0; i + 1 < raw.length; i += 2) {
+        const name = raw[i].toLowerCase();
+        if (HOP_BY_HOP.has(name) || name === drop)
+            continue;
+        (headers[name] ??= []).push(raw[i + 1]);
+    }
+    return headers;
+}
+function reply(res, status, message) {
+    if (res.headersSent) {
+        res.destroy();
+        return;
+    }
+    const body = `egress-gate: ${message}\n`;
+    res.writeHead(status, { "content-type": "text/plain; charset=utf-8", "content-length": Buffer.byteLength(body) });
+    res.end(body);
+}
+export function credentialTerminator(options) {
+    const { credentials, logger } = options;
+    const terminated = new WeakMap();
+    const http = createServer((req, res) => {
+        forward(req, res).catch((error) => {
+            logger.error("egress_forward_failed", { error: error instanceof Error ? error.message : String(error) });
+            reply(res, 502, "the request failed");
+        });
+    });
+    http.keepAliveTimeout = options.idleMs;
+    http.headersTimeout = 60_000;
+    // Uploads may be long; the client socket's idle timeout still applies.
+    http.requestTimeout = 0;
+    http.on("upgrade", (req, socket) => {
+        const at = terminated.get(req.socket);
+        logger.warn("egress_refused", { status: 501, reason: "upgrade_refused", sandboxId: at?.sandboxId, host: at?.host });
+        socket.destroy();
+    });
+    http.on("clientError", (_error, socket) => socket.destroy());
+    async function forward(req, res) {
+        const at = terminated.get(req.socket);
+        if (!at) {
+            res.destroy();
+            return;
+        }
+        const { sandboxId, host } = at;
+        const release = await credentials.release(sandboxId, host);
+        if (release.status === "refused") {
+            logger.warn("egress_credential_refused", { status: 502, reason: release.reason, sandboxId, host });
+            req.resume();
+            return reply(res, 502, `the credential for ${host} could not be used`);
+        }
+        const header = release.status === "released" ? release.header.toLowerCase() : undefined;
+        const headers = forwardable(req.rawHeaders, header);
+        if (release.status === "released")
+            headers[header] = [release.value];
+        const upstream = request({
+            host,
+            port: credentials.upstreamPort ?? 443,
+            servername: host,
+            method: req.method,
+            path: req.url,
+            headers,
+            agent: at.agent,
+        });
+        upstream.on("response", (response) => {
+            res.writeHead(response.statusCode ?? 502, response.statusMessage, forwardable(response.rawHeaders));
+            response.pipe(res);
+            response.on("error", () => res.destroy());
+        });
+        upstream.on("error", (error) => {
+            logger.warn("egress_upstream_failed", { status: 502, sandboxId, host, code: error.code });
+            reply(res, 502, `could not reach ${host}`);
+        });
+        req.on("error", () => upstream.destroy());
+        res.on("close", () => {
+            if (!res.writableFinished)
+                upstream.destroy();
+        });
+        req.pipe(upstream);
+    }
+    return {
+        async terminate(client, target) {
+            const { sandboxId, host, addresses } = target;
+            const leaf = await credentials.leaf(host);
+            if (client.destroyed)
+                return;
+            // Requests go to the addresses the gate checked, never to the name resolved again.
+            const lookup = (_name, lookupOptions, callback) => {
+                if (lookupOptions.all)
+                    callback(null, addresses);
+                else
+                    callback(null, addresses[0].address, addresses[0].family);
+            };
+            const agent = new Agent({
+                keepAlive: true,
+                maxSockets: 8,
+                lookup,
+                ...(credentials.upstreamCa ? { ca: credentials.upstreamCa } : {}),
+            });
+            client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+            const tls = new TLSSocket(client, {
+                isServer: true,
+                secureContext: createSecureContext({ key: leaf.key, cert: leaf.cert }),
+                ALPNProtocols: ["http/1.1"],
+            });
+            terminated.set(tls, { sandboxId, host, agent });
+            tls.on("error", () => tls.destroy());
+            tls.on("close", () => {
+                agent.destroy();
+                client.destroy();
+            });
+            logger.info("egress_terminated", { sandboxId, host });
+            http.emit("connection", tls);
+        },
+    };
+}

package/dist/gates/egress.d.ts

@@ -3,6 +3,7 @@ import { type Socket } from "node:net";
 import type { EgressTokenVerdict } from "../sandbox/egress-token.js";
 import type { SessionStore } from "../store/types.js";
 import type { Logger } from "../tenant/types.js";
+import { type EgressCredentials } from "./egress-credentials.js";
 /**
  * What egress-gate reads of a sandbox: its current host epoch, the pod that joined at it, and
  * its spec's `network.allow`; `undefined` when it is gone, deleted, lost, expired or not a pod.
@@ -46,6 +47,8 @@ export interface StartEgressGateOptions {
     readonly blocked?: (address: string) => boolean;
     /** Tests replace how the checked address is dialled. */
     readonly dial?: (address: string, port: number) => Socket;
+    /** The vault and keys, for hosts an `environment_secret` is bound to (R2c). None: tunnels only. */
+    readonly credentials?: EgressCredentials;
 }
 export interface EgressGate {
     /** Where the gate listens, e.g. `http://0.0.0.0:4200`. */

package/dist/gates/egress.js

@@ -17,7 +17,10 @@
  *    (cloud metadata included), multicast or reserved, else 502 or 403;
  * 6. the gate connects to that checked address (never to the name again) and pipes.
  *
- * No TLS interception and no credential injection: a tunnel is opaque bytes. Any other request
+ * A tunnel is opaque bytes, with one exception (R2c, D50): port 443 of a host that an
+ * `environment_secret` of a live session on the sandbox is bound to. There the gate terminates
+ * TLS and sets the credential's header on every request (`egress-credentials.ts`), still sending
+ * only to the checked address. Every other host gets the tunnel. Any other request
  * (an absolute-form plain HTTP request included) is answered 405. Refusals are logged, never as
  * events; the token never is. Tunnels close after `idleMs` without traffic in either direction.
  */
@@ -27,6 +30,7 @@ import { BlockList, connect, isIP } from "node:net";
 import { isSandboxHostPattern } from "@nylorun/core/define";
 import { isPrivateAddress } from "../tenant/outbound.js";
 import { bindListener } from "../host/http.js";
+import { credentialTerminator } from "./egress-credentials.js";
 /** Ports a tunnel may open. */
 export const EGRESS_PORTS = [443, 80];
 /** Tunnels one sandbox may hold open at once. */
@@ -151,6 +155,9 @@ export async function startEgressGate(options) {
             cache.delete(cache.keys().next().value);
         return value;
     }
+    const terminator = options.credentials
+        ? credentialTerminator({ credentials: options.credentials, logger, idleMs })
+        : undefined;
     const open = new Map();
     const tunnels = new Set();
     async function onConnect(req, client, head) {
@@ -209,6 +216,12 @@ export async function startEgressGate(options) {
             return refuse(403, "address_refused", { sandboxId }, `${host} resolves only to addresses tunnels may not reach`);
         if (client.destroyed)
             return;
+        if (terminator && port === 443 && (await options.credentials.bound(sandboxId, host))) {
+            // A client that spoke before the 200 is not one this path serves.
+            if (head.length > 0)
+                return refuse(403, "early_data", { sandboxId }, "wait for the CONNECT answer before sending");
+            return terminator.terminate(client, { sandboxId, host, addresses: allowed });
+        }
         const upstream = await dialFirst(allowed.map((entry) => entry.address), port);
         if (!upstream)
             return refuse(502, "connect_failed", { sandboxId }, `could not connect to ${host}:${port}`);

package/dist/gates/tenant-vaults.d.ts

@@ -34,6 +34,10 @@ export interface TenantVault {
     authorizeMcp(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
     /** Vault writes and token signing with the Tenant's vault key (the keys service, F4.2). */
     keys(): Keys;
+    /** Whether a live session on the sandbox has an `environment_secret` bound to `host` (R2c). */
+    environmentSecretBound(sandboxId: string, host: string): Promise<boolean>;
+    /** The header an `environment_secret` sets on one request to `host` (R2c). */
+    releaseEnvironmentSecret(sandboxId: string, host: string): ReturnType<VaultService["releaseEnvironmentSecret"]>;
 }
 export interface TenantVaults {
     /**

package/dist/gates/tenant-vaults.js

@@ -52,6 +52,8 @@ export function createTenantVaults(options) {
             session,
             authorizeMcp: (sessionId, request) => authorizeSessionMcp(credentials, session, sessionId, request),
             keys: () => keys,
+            environmentSecretBound: (sandboxId, host) => credentials.environmentSecretBound(sandboxId, host),
+            releaseEnvironmentSecret: (sandboxId, host) => credentials.releaseEnvironmentSecret({ sandboxId, host }),
         };
     }
     /** The database's Tenant, once its schema is at this build's version. */

package/dist/harness/calls.d.ts

@@ -27,6 +27,8 @@ export interface ToolRouting {
     /** The session that owns the tree's sandbox, and the sandbox resource it is attached to. */
     readonly sandboxOwnerId: string;
     readonly sandboxId?: string;
+    /** Variables every sandbox command gets (R2c): secret names set to the sentinel, plain values. */
+    readonly environment?: Readonly<Record<string, string>>;
     readonly activeTurnId: string | null;
     /** Who the sandbox call's events are claimed for: the run's id. */
     readonly claim?: string;

package/dist/harness/calls.js

@@ -127,6 +127,7 @@ export async function callSandboxTool(sandbox, routing, request, signal) {
         activeTurnId: routing.activeTurnId,
         manifest: routing.rootManifest,
         ...(routing.sandboxId === undefined ? {} : { sandboxId: routing.sandboxId }),
+        ...(routing.environment === undefined ? {} : { environment: routing.environment }),
         ...(routing.claim === undefined ? {} : { claim: routing.claim }),
     }, capability, request.toolName, request.input, signal);
 }

package/dist/harness/executors.js

@@ -95,6 +95,7 @@ export function routingOf(run) {
         ...(routing.mcpSnapshot ? { mcpSnapshot: routing.mcpSnapshot } : {}),
         sandboxOwnerId: routing.sandbox?.ownerId ?? run.grant.sessionId,
         ...(routing.sandbox?.sandboxId === undefined ? {} : { sandboxId: routing.sandbox.sandboxId }),
+        ...(routing.sandbox?.environment === undefined ? {} : { environment: routing.sandbox.environment }),
         activeTurnId: run.grant.turnId,
         claim: run.runId,
     };

package/dist/harness/main.js

@@ -44,7 +44,10 @@ export async function runHarness(stack, baseline) {
             log: (message, fields) => logger.info(message, fields),
         });
         logger.info("sandbox_network_policy_in_force", { sandboxId: config.pod.sandboxId, waitedMs });
-        pod = podHost(config.pod, logger, { volumeFile: join(config.root, "volume-id") });
+        pod = podHost(config.pod, logger, {
+            volumeFile: join(config.root, "volume-id"),
+            caBundleFile: join(config.root, "egress-ca-bundle.pem"),
+        });
     }
     const token = pod ? () => pod.token() : config.token;
     if (token === undefined)

package/dist/harness/pod.d.ts

@@ -18,4 +18,6 @@ export declare function podHost(config: PodHostConfig, logger: {
     renewMs?: number;
     /** Where the engine keeps the volume's id (on the volume): a new volume gets a new one. */
     volumeFile?: string;
+    /** Where the engine writes the trust bundle: the public roots and the egress CA (R2c). */
+    caBundleFile?: string;
 }): PodHost;

package/dist/harness/pod.js

@@ -5,17 +5,34 @@
  * read afresh each time: a reset writes a new one). The egress token minted with the host token
  * is the password of the proxy every command gets (`proxyEnv`); both are renewed every
  * `RENEW_MS`, well inside their 15-minute life.
+ *
+ * The join answer also carries the installation's egress CA (R2c, D50). The engine writes it,
+ * after the public roots, to a trust bundle on the pod (`caBundleFile`) and points every
+ * command's trust variables at it, so a CLI trusts the leaf egress-gate presents for a host an
+ * `environment_secret` is bound to. The bundle is rewritten only when the CA changes.
  */
 import { randomUUID } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { rootCertificates } from "node:tls";
 import { dirname } from "node:path";
 /** How often the host and egress tokens are renewed. */
 export const RENEW_MS = 5 * 60_000;
+/** The variables CLIs read their trust bundle from: OpenSSL, Node, Python, curl, git, AWS. */
+const TRUST_VARIABLES = [
+    "SSL_CERT_FILE",
+    "NODE_EXTRA_CA_CERTS",
+    "REQUESTS_CA_BUNDLE",
+    "CURL_CA_BUNDLE",
+    "GIT_SSL_CAINFO",
+    "AWS_CA_BUNDLE",
+];
 class Refused extends Error {
 }
 export function podHost(config, logger, options = {}) {
     const call = options.fetch ?? fetch;
     let held;
+    /** The CA in the bundle on disk, once one is written. */
+    let bundled;
     const post = async (path, init) => {
         const response = await call(`${config.httpUrl}/nylorun/harness/v1/host/${path}`, {
             method: "POST",
@@ -32,13 +49,27 @@ export function podHost(config, logger, options = {}) {
         if (!response.ok)
             throw new Error(`host/${path} answered ${response.status}`);
         const body = JSON.parse(text);
+        if (typeof body.caCertificate === "string")
+            await writeBundle(body.caCertificate);
         return {
             hostToken: body.hostToken,
             egressToken: body.egressToken,
             epoch: body.epoch,
             expiresAt: Date.parse(body.expiresAt),
+            ...(typeof body.caCertificate === "string" ? { caCertificate: body.caCertificate } : {}),
         };
     };
+    const writeBundle = async (ca) => {
+        const file = options.caBundleFile;
+        if (!file || ca === bundled)
+            return;
+        await mkdir(dirname(file), { recursive: true });
+        // Written beside it and renamed, so a command never reads half a bundle.
+        const next = `${file}.${randomUUID()}`;
+        await writeFile(next, `${rootCertificates.join("\n")}\n${ca.trim()}\n`, { mode: 0o644 });
+        await rename(next, file);
+        bundled = ca;
+    };
     /** The volume's id, created on a volume that has none. */
     const volumeId = async () => {
         const file = options.volumeFile;
@@ -100,7 +131,11 @@ export function podHost(config, logger, options = {}) {
             url.username = "nylorun";
             url.password = held.egressToken;
             const proxy = url.toString().replace(/\/$/, "");
+            const trust = bundled !== undefined && options.caBundleFile
+                ? Object.fromEntries(TRUST_VARIABLES.map((name) => [name, options.caBundleFile]))
+                : {};
             return {
+                ...trust,
                 HTTPS_PROXY: proxy,
                 HTTP_PROXY: proxy,
                 https_proxy: proxy,

package/dist/harness-api/start.d.ts

@@ -14,6 +14,8 @@ export interface SegmentStart {
     readonly sandbox: {
         readonly ownerId: string;
         readonly sandboxId?: string;
+        /** Variables every sandbox command gets (R2c): secret names set to the sentinel, plain values. */
+        readonly environment?: Readonly<Record<string, string>>;
     };
     /** The sandbox is a pod sandbox (F7.2): its engine runs the segment. Its lifecycle state. */
     readonly pod?: {

package/dist/harness-api/start.js

@@ -25,8 +25,10 @@ options = {}) {
         const fixtureModel = await usesFixtureModel(t);
         if (!options.harness)
             return { current, fixtureModel, outcomes: [], sandbox: { ownerId: id } };
-        const sandbox = sandboxWorkspaceOf(current, await sandboxLookup(t, current.id));
-        const resource = sandbox.sandboxId === undefined ? undefined : await t.sandboxResource(sandbox.sandboxId);
+        const workspace = sandboxWorkspaceOf(current, await sandboxLookup(t, current.id));
+        const resource = workspace.sandboxId === undefined ? undefined : await t.sandboxResource(workspace.sandboxId);
+        const { environment } = await ctx.vault.sessionEnvironment(t, current.vaultIds ?? []);
+        const sandbox = Object.keys(environment).length > 0 ? { ...workspace, environment } : workspace;
         return {
             current,
             fixtureModel,

package/dist/harness-api/ws-server.js

@@ -14,8 +14,8 @@
  * /nylorun/harness/v1/host/join` (`{ sandboxId, podUid, joinToken }`), renews it with `POST
  * .../host/renew` (`Authorization: Bearer <host token>`), and upgrades with the host token as
  * its bearer: that connection hosts its sandbox alone (`HarnessPeer.host`). Both answer
- * `{ hostToken, egressToken, sandboxId, epoch, expiresAt }`; every refusal is the same 401. The
- * harness token is never accepted as a host token, nor a host token anywhere but here.
+ * `{ hostToken, egressToken, sandboxId, epoch, expiresAt, caCertificate }` (the egress CA, R2c);
+ * every refusal is the same 401. The harness token is never accepted as a host token, nor a host token anywhere but here.
  */
 import { createHash, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";

package/dist/host/gates.js

@@ -27,6 +27,7 @@ import { probeDatabase } from "../infra/database.js";
 import { bindListener, headerValue, isAllowedRequestHost, sendRejected } from "./http.js";
 import { startEgressGate, storeEgressSandboxes } from "../gates/egress.js";
 import { verifyEgressToken } from "../sandbox/egress-token.js";
+import { leafKeyPair } from "../keys/x509.js";
 /** Above the gate's 600 s provider request timeout and the loop's 630 s client timeout. */
 export const GATES_REQUEST_TIMEOUT_MS = 660_000;
 export async function startGates(options) {
@@ -172,6 +173,16 @@ export async function startEgress(options) {
             return verifyEgressToken(vault.store, vault.tenantId, raw, publicKeys);
         },
         sandboxes: { live: async (sandboxId) => storeEgressSandboxes((await tenant.open()).store).live(sandboxId) },
+        credentials: {
+            bound: async (sandboxId, host) => (await tenant.open()).environmentSecretBound(sandboxId, host),
+            release: async (sandboxId, host) => (await tenant.open()).releaseEnvironmentSecret(sandboxId, host),
+            // A fresh key per connection, made here: keys signs its public half and never sees it.
+            async leaf(host) {
+                const pair = leafKeyPair();
+                const cert = await (await tenant.open()).keys().signEgressLeaf(host, pair.publicKey);
+                return { key: pair.privateKey, cert };
+            },
+        },
         ...options.gate,
     });
 }

package/dist/keys/egress-ca.d.ts

@@ -0,0 +1,15 @@
+import type { SessionStore } from "../store/types.js";
+/** How long a leaf egress-gate presents is valid: one connection rarely lasts this long. */
+export declare const EGRESS_LEAF_MINUTES = 60;
+export declare class EgressAuthority {
+    private readonly store;
+    private readonly kek;
+    /** The CA with its key, decrypted once per process, as signing keys are. */
+    private authority;
+    constructor(store: SessionStore, kek: () => Buffer);
+    /** The CA certificate (PEM), creating the CA when the Tenant has none. */
+    certificate(): Promise<string>;
+    /** A leaf for `host` and the caller's P-256 public key (SPKI PEM); the caller keeps its key. */
+    signLeaf(host: string, publicKey: string): Promise<string>;
+    private load;
+}