@nylorun/runtime 0.21.1-beta → 0.22.0-beta

package/dist/keys/egress-ca.js

@@ -0,0 +1,66 @@
+/**
+ * The installation's egress CA (R2c, D50, E12): one long-lived certificate authority whose
+ * certificate every pod sandbox trusts, and whose key signs the short-lived leaf egress-gate
+ * presents when it terminates TLS for a host an `environment_secret` is bound to. Only keys holds
+ * the key: it lives in the Tenant setting `egress.ca`, sealed under the vault KEK like a signing
+ * key, beside the certificate in the clear. Created on first use under the signing keys' lock.
+ * No rotation yet (R8, with the KeyRoot seam).
+ */
+import { X509Certificate } from "node:crypto";
+import { decryptSecret, encryptSecret } from "../vault/crypto.js";
+import { createCertificateAuthority, issueLeafCertificate } from "./x509.js";
+const SETTING = "egress.ca";
+/** How long a leaf egress-gate presents is valid: one connection rarely lasts this long. */
+export const EGRESS_LEAF_MINUTES = 60;
+function aad(certificate) {
+    return Buffer.from(`nylorun.egress-ca:${new X509Certificate(certificate).fingerprint256}`);
+}
+export class EgressAuthority {
+    store;
+    kek;
+    /** The CA with its key, decrypted once per process, as signing keys are. */
+    authority;
+    constructor(store, kek) {
+        this.store = store;
+        this.kek = kek;
+    }
+    /** The CA certificate (PEM), creating the CA when the Tenant has none. */
+    async certificate() {
+        return (await this.load()).certificate;
+    }
+    /** A leaf for `host` and the caller's P-256 public key (SPKI PEM); the caller keeps its key. */
+    async signLeaf(host, publicKey) {
+        return issueLeafCertificate({ authority: await this.load(), host, publicKey, minutes: EGRESS_LEAF_MINUTES });
+    }
+    async load() {
+        if (this.authority)
+            return this.authority;
+        const kek = this.kek();
+        const stored = await this.store.tx(async (t) => (await read(t)) ?? (await create(t, kek)));
+        const privateKey = decryptSecret(kek, aad(stored.certificate), Buffer.from(stored.nonce, "base64"), Buffer.from(stored.ciphertext, "base64"), Buffer.from(stored.wrappedDek, "base64"), stored.kekId).toString("utf8");
+        this.authority = { certificate: stored.certificate, privateKey };
+        return this.authority;
+    }
+}
+async function read(t) {
+    const value = await t.getSetting(SETTING);
+    return value === undefined ? undefined : JSON.parse(value);
+}
+async function create(t, kek) {
+    // Concurrent first uses would both create a CA: lock, then read what the winner made.
+    await t.lockSigningKeys();
+    const existing = await read(t);
+    if (existing)
+        return existing;
+    const authority = createCertificateAuthority({ commonName: "Nylorun egress CA" });
+    const sealed = encryptSecret(kek, aad(authority.certificate), Buffer.from(authority.privateKey, "utf8"));
+    const stored = {
+        certificate: authority.certificate,
+        kekId: sealed.kekId,
+        nonce: sealed.nonce.toString("base64"),
+        ciphertext: sealed.ciphertext.toString("base64"),
+        wrappedDek: sealed.wrappedDek.toString("base64"),
+    };
+    await t.putSetting(SETTING, JSON.stringify(stored));
+    return stored;
+}

package/dist/keys/keys.d.ts

@@ -32,9 +32,16 @@ export interface Keys {
      * (R2b C12, `mcp/preview.ts`); never calls a tool.
      */
     previewMcp(body: McpPreviewRequest): Promise<McpPreview>;
+    /** The egress CA's certificate (PEM), creating the CA when the Tenant has none (R2c, D50). */
+    egressCa(): Promise<string>;
+    /**
+     * A short-lived leaf for `host` and the caller's P-256 public key (SPKI PEM), signed by the
+     * egress CA (R2c). The leaf's private key never reaches keys; the CA's never leaves it.
+     */
+    signEgressLeaf(host: string, publicKey: string): Promise<string>;
 }
 /** The operations, by the name the HTTP route carries. */
-export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp"];
+export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp", "egressCa", "signEgressLeaf"];
 export type KeysOperation = (typeof KEYS_OPERATIONS)[number];
 export interface InProcessKeysOptions {
     readonly store: SessionStore;

package/dist/keys/keys.js

@@ -12,6 +12,7 @@
  * service itself, which serves the HTTP routes with it), and `httpKeys` (`client.ts`), the
  * runtime container's client of the `keys` service in the gateway.
  */
+import { EgressAuthority } from "./egress-ca.js";
 import { SignJWT } from "jose";
 import { previewMcpServer } from "../mcp/preview.js";
 import { signingKeyView } from "../tenant/signing-keys.js";
@@ -25,9 +26,12 @@ export const KEYS_OPERATIONS = [
     "rotateSigningKeys",
     "ensureSigningKeys",
     "previewMcp",
+    "egressCa",
+    "signEgressLeaf",
 ];
 export function inProcessKeys(options) {
     const { store, vault, signingKeys, kek } = options;
+    const egress = new EgressAuthority(store, kek);
     return {
         createCredential: (vaultId, body) => vault.createCredential(vaultId, body),
         rotateCredential: (vaultId, id, body) => vault.rotateCredential(vaultId, id, body),
@@ -52,5 +56,7 @@ export function inProcessKeys(options) {
             await store.tx((t) => signingKeys.ensure(t, key));
         },
         previewMcp: (body) => previewMcpServer(body, { vault, policy: options.policy ?? {} }),
+        egressCa: () => egress.certificate(),
+        signEgressLeaf: (host, publicKey) => egress.signLeaf(host, publicKey),
     };
 }

package/dist/keys/x509.d.ts

@@ -0,0 +1,29 @@
+export interface CertificateAuthority {
+    /** PEM of the CA certificate: the only part a sandbox ever receives. */
+    readonly certificate: string;
+    /** PKCS#8 PEM of the CA key: sealed in the vault, used only by keys. */
+    readonly privateKey: string;
+}
+/** A new P-256 CA, valid from an hour ago for `days` days. */
+export declare function createCertificateAuthority(options: {
+    readonly commonName: string;
+    readonly days?: number;
+    readonly now?: Date;
+}): CertificateAuthority;
+/**
+ * A leaf for `host` and the caller's `publicKey` (SPKI PEM), signed by the CA, valid from five
+ * minutes ago for `minutes` minutes. The caller keeps the leaf's private key: only the
+ * certificate comes back, so no private key leaves whoever holds it.
+ */
+export declare function issueLeafCertificate(options: {
+    readonly authority: CertificateAuthority;
+    readonly host: string;
+    readonly publicKey: string;
+    readonly minutes?: number;
+    readonly now?: Date;
+}): string;
+/** A P-256 key pair for a leaf, as PEM: SPKI for the public key, PKCS#8 for the private key. */
+export declare function leafKeyPair(): {
+    readonly publicKey: string;
+    readonly privateKey: string;
+};

package/dist/keys/x509.js

@@ -0,0 +1,160 @@
+/**
+ * The two certificates R2c needs (D50), built without a dependency: the installation's egress
+ * CA, and a short-lived leaf for one host name that egress-gate presents when it terminates TLS
+ * for a host an `environment_secret` is bound to. Node can parse X.509 but not build it, so this
+ * writes the DER by hand. Both use ECDSA P-256 with SHA-256.
+ *
+ * Only what clients check is written: a CA with basicConstraints CA:TRUE (critical), keyUsage
+ * keyCertSign and cRLSign (critical) and a subject key identifier; a leaf with the host as its
+ * only subjectAltName, keyUsage digitalSignature (critical), extKeyUsage serverAuth, and the
+ * CA's key identifier. Go (`gh`), OpenSSL (`curl`, `git`), Node and Python accept that shape.
+ */
+import { isIP } from "node:net";
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, X509Certificate, } from "node:crypto";
+const OID = {
+    ecdsaWithSha256: "1.2.840.10045.4.3.2",
+    commonName: "2.5.4.3",
+    organization: "2.5.4.10",
+    basicConstraints: "2.5.29.19",
+    keyUsage: "2.5.29.15",
+    extKeyUsage: "2.5.29.37",
+    serverAuth: "1.3.6.1.5.5.7.3.1",
+    subjectAltName: "2.5.29.17",
+    subjectKeyIdentifier: "2.5.29.14",
+    authorityKeyIdentifier: "2.5.29.35",
+};
+function length(n) {
+    if (n < 0x80)
+        return Buffer.from([n]);
+    const bytes = [];
+    for (let v = n; v > 0; v = Math.floor(v / 256))
+        bytes.unshift(v & 0xff);
+    return Buffer.from([0x80 | bytes.length, ...bytes]);
+}
+function tlv(tag, content) {
+    return Buffer.concat([Buffer.from([tag]), length(content.length), content]);
+}
+const seq = (...items) => tlv(0x30, Buffer.concat(items));
+const set = (...items) => tlv(0x31, Buffer.concat(items));
+const octets = (content) => tlv(0x04, content);
+const bits = (content, unused = 0) => tlv(0x03, Buffer.concat([Buffer.from([unused]), content]));
+const bool = (value) => tlv(0x01, Buffer.from([value ? 0xff : 0x00]));
+const explicit = (n, content) => tlv(0xa0 + n, content);
+function integer(value) {
+    let v = value;
+    while (v.length > 1 && v[0] === 0 && (v[1] & 0x80) === 0)
+        v = v.subarray(1);
+    if (v[0] & 0x80)
+        v = Buffer.concat([Buffer.from([0]), v]);
+    return tlv(0x02, v);
+}
+function oid(dotted) {
+    const parts = dotted.split(".").map(Number);
+    const out = [40 * parts[0] + parts[1]];
+    for (const part of parts.slice(2)) {
+        const chunk = [part & 0x7f];
+        for (let v = Math.floor(part / 128); v > 0; v = Math.floor(v / 128))
+            chunk.unshift((v & 0x7f) | 0x80);
+        out.push(...chunk);
+    }
+    return tlv(0x06, Buffer.from(out));
+}
+function name(fields) {
+    const rdns = [set(seq(oid(OID.commonName), tlv(0x0c, Buffer.from(fields.commonName, "utf8"))))];
+    if (fields.organization)
+        rdns.unshift(set(seq(oid(OID.organization), tlv(0x0c, Buffer.from(fields.organization, "utf8")))));
+    return seq(...rdns);
+}
+/** UTCTime before 2050, GeneralizedTime from then on (RFC 5280 §4.1.2.5). */
+function time(at) {
+    const iso = at.toISOString().replace(/[-:T]/g, "").slice(0, 14) + "Z";
+    return at.getUTCFullYear() < 2050 ? tlv(0x17, Buffer.from(iso.slice(2), "ascii")) : tlv(0x18, Buffer.from(iso, "ascii"));
+}
+function extension(id, critical, value) {
+    return critical ? seq(oid(id), bool(true), octets(value)) : seq(oid(id), octets(value));
+}
+function spki(key) {
+    return key.export({ type: "spki", format: "der" });
+}
+/** SHA-1 of the subjectPublicKey bits (RFC 5280 §4.2.1.2, method 1). */
+function keyIdentifier(publicKey) {
+    const der = spki(publicKey);
+    // The SPKI is SEQUENCE { AlgorithmIdentifier, BIT STRING }; for P-256 the key is its last 65 bytes.
+    return createHash("sha1").update(der.subarray(der.length - 65)).digest();
+}
+function serial() {
+    const value = randomBytes(16);
+    value[0] = value[0] & 0x7f;
+    return integer(value);
+}
+function certificate(tbs, issuerKey) {
+    const algorithm = seq(oid(OID.ecdsaWithSha256));
+    const signature = sign("sha256", tbs, issuerKey);
+    return seq(tbs, algorithm, bits(signature));
+}
+function pem(der) {
+    const body = der.toString("base64").replace(/(.{64})/g, "$1\n").replace(/\n$/, "");
+    return `-----BEGIN CERTIFICATE-----\n${body}\n-----END CERTIFICATE-----\n`;
+}
+/** A new P-256 CA, valid from an hour ago for `days` days. */
+export function createCertificateAuthority(options) {
+    const { publicKey, privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+    const now = options.now ?? new Date();
+    const subject = name({ commonName: options.commonName, organization: "Nylorun" });
+    const ski = keyIdentifier(publicKey);
+    const tbs = seq(explicit(0, integer(Buffer.from([2]))), serial(), seq(oid(OID.ecdsaWithSha256)), subject, seq(time(new Date(now.getTime() - 3_600_000)), time(new Date(now.getTime() + (options.days ?? 3650) * 86_400_000))), subject, spki(publicKey), explicit(3, seq(extension(OID.basicConstraints, true, seq(bool(true), integer(Buffer.from([0])))), extension(OID.keyUsage, true, bits(Buffer.from([0x06]), 1)), extension(OID.subjectKeyIdentifier, false, octets(ski)))));
+    return {
+        certificate: pem(certificate(tbs, privateKey)),
+        privateKey: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+    };
+}
+/**
+ * A leaf for `host` and the caller's `publicKey` (SPKI PEM), signed by the CA, valid from five
+ * minutes ago for `minutes` minutes. The caller keeps the leaf's private key: only the
+ * certificate comes back, so no private key leaves whoever holds it.
+ */
+export function issueLeafCertificate(options) {
+    if (isIP(options.host) !== 0 || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/.test(options.host))
+        throw new Error(`Not a host name: ${options.host}`);
+    const caKey = createPrivateKey(options.authority.privateKey);
+    const ca = new X509Certificate(options.authority.certificate);
+    const publicKey = createPublicKey(options.publicKey);
+    if (publicKey.asymmetricKeyType !== "ec" || publicKey.asymmetricKeyDetails?.namedCurve !== "prime256v1")
+        throw new Error("A leaf key must be ECDSA P-256");
+    const now = options.now ?? new Date();
+    const issuer = Buffer.from(ca.raw);
+    const tbs = seq(explicit(0, integer(Buffer.from([2]))), serial(), seq(oid(OID.ecdsaWithSha256)), subjectOf(issuer), seq(time(new Date(now.getTime() - 300_000)), time(new Date(now.getTime() + (options.minutes ?? 60) * 60_000))), name({ commonName: options.host }), spki(publicKey), explicit(3, seq(extension(OID.keyUsage, true, bits(Buffer.from([0x80]), 7)), extension(OID.extKeyUsage, false, seq(oid(OID.serverAuth))), extension(OID.subjectAltName, false, seq(tlv(0x82, Buffer.from(options.host, "ascii")))), extension(OID.authorityKeyIdentifier, false, seq(tlv(0x80, keyIdentifier(ca.publicKey)))))));
+    return pem(certificate(tbs, caKey));
+}
+/** A P-256 key pair for a leaf, as PEM: SPKI for the public key, PKCS#8 for the private key. */
+export function leafKeyPair() {
+    const { publicKey, privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+    return {
+        publicKey: publicKey.export({ type: "spki", format: "pem" }).toString(),
+        privateKey: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+    };
+}
+/** The subject Name of a DER certificate, byte for byte, to use as a leaf's issuer. */
+function subjectOf(der) {
+    // Certificate ::= SEQUENCE { tbs SEQUENCE { [0] version, serial, sigAlg, issuer, validity, subject, … } }
+    const read = (buf, at) => {
+        let len = buf[at + 1];
+        let header = 2;
+        if (len & 0x80) {
+            const n = len & 0x7f;
+            len = 0;
+            for (let i = 0; i < n; i++)
+                len = len * 256 + buf[at + 2 + i];
+            header += n;
+        }
+        return { start: at, header, end: at + header + len };
+    };
+    const cert = read(der, 0);
+    const tbs = read(der, cert.start + cert.header);
+    // TBSCertificate fields: [0] version, serial, signature, issuer, validity, subject.
+    let at = tbs.start + tbs.header;
+    for (let field = 0; field < 5; field++)
+        at = read(der, at).end;
+    const subject = read(der, at);
+    return der.subarray(subject.start, subject.end);
+}

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.21.1-beta",
+    "version": "0.22.0-beta",
     "x-nylorun-protocol": {
       "min": 4,
       "max": 10,
@@ -97,6 +97,7 @@
               "definition_files_missing",
               "credential_rejected",
               "mcp_preview_failed",
+              "credential_conflict",
               "internal_error"
             ]
           },
@@ -2113,7 +2114,9 @@
             "type": "string",
             "enum": [
               "bearer",
-              "headers"
+              "headers",
+              "environment_secret",
+              "environment_variable"
             ]
           },
           "binding": {
@@ -2121,11 +2124,41 @@
             "properties": {
               "url": {
                 "type": "string"
+              },
+              "secretName": {
+                "type": "string"
+              },
+              "allowedHosts": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "inject": {
+                "type": "object",
+                "properties": {
+                  "header": {
+                    "type": "string",
+                    "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                  },
+                  "format": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "required": [
+                  "header",
+                  "format"
+                ],
+                "additionalProperties": false
+              },
+              "variableName": {
+                "type": "string"
+              },
+              "variableValue": {
+                "type": "string"
               }
             },
-            "required": [
-              "url"
-            ],
             "additionalProperties": false
           },
           "headerNames": {
@@ -2269,6 +2302,85 @@
                   "headers"
                 ],
                 "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "enum": [
+                      "environment_secret"
+                    ]
+                  },
+                  "secretName": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+                  },
+                  "secretValue": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 8192
+                  },
+                  "allowedHosts": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "minItems": 1,
+                    "maxItems": 32
+                  },
+                  "inject": {
+                    "type": "object",
+                    "properties": {
+                      "header": {
+                        "type": "string",
+                        "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                      },
+                      "format": {
+                        "type": "string",
+                        "minLength": 1
+                      }
+                    },
+                    "required": [
+                      "header",
+                      "format"
+                    ],
+                    "additionalProperties": false
+                  }
+                },
+                "required": [
+                  "type",
+                  "secretName",
+                  "secretValue",
+                  "allowedHosts"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "enum": [
+                      "environment_variable"
+                    ]
+                  },
+                  "variableName": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+                  },
+                  "variableValue": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 8192
+                  }
+                },
+                "required": [
+                  "type",
+                  "variableName",
+                  "variableValue"
+                ],
+                "additionalProperties": false
               }
             ]
           }
@@ -2302,7 +2414,9 @@
                   "type": "string",
                   "enum": [
                     "bearer",
-                    "headers"
+                    "headers",
+                    "environment_secret",
+                    "environment_variable"
                   ]
                 },
                 "binding": {
@@ -2310,11 +2424,41 @@
                   "properties": {
                     "url": {
                       "type": "string"
+                    },
+                    "secretName": {
+                      "type": "string"
+                    },
+                    "allowedHosts": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    "inject": {
+                      "type": "object",
+                      "properties": {
+                        "header": {
+                          "type": "string",
+                          "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                        },
+                        "format": {
+                          "type": "string",
+                          "minLength": 1
+                        }
+                      },
+                      "required": [
+                        "header",
+                        "format"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "variableName": {
+                      "type": "string"
+                    },
+                    "variableValue": {
+                      "type": "string"
                     }
                   },
-                  "required": [
-                    "url"
-                  ],
                   "additionalProperties": false
                 },
                 "headerNames": {
@@ -2463,6 +2607,48 @@
                   "headers"
                 ],
                 "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "enum": [
+                      "environment_secret"
+                    ]
+                  },
+                  "secretValue": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 8192
+                  }
+                },
+                "required": [
+                  "type",
+                  "secretValue"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "enum": [
+                      "environment_variable"
+                    ]
+                  },
+                  "variableValue": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 8192
+                  }
+                },
+                "required": [
+                  "type",
+                  "variableValue"
+                ],
+                "additionalProperties": false
               }
             ]
           }

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.21.1-beta",
+    "version": "0.22.0-beta",
     "x-nylorun-protocol": {
       "min": 4,
       "max": 10,
@@ -6338,6 +6338,7 @@
               "definition_files_missing",
               "credential_rejected",
               "mcp_preview_failed",
+              "credential_conflict",
               "internal_error"
             ]
           },

package/dist/sandbox/join.d.ts

@@ -15,6 +15,8 @@ export interface HostJoinAnswer {
     readonly epoch: number;
     /** ISO time the tokens expire. */
     readonly expiresAt: string;
+    /** The egress CA certificate (PEM) the sandbox trusts (R2c). */
+    readonly caCertificate: string;
 }
 /** A refused join, renewal or host connection. */
 export declare class HostAuthError extends Error {

package/dist/sandbox/join.js

@@ -24,6 +24,10 @@
  * and the pod (`tenant/host-token.ts`). `renew` mints a new pair at the same epoch while the
  * host is current; it is refused once the epoch moved.
  *
+ * The answer also carries the installation's egress CA certificate (R2c, D50): the engine adds it
+ * to the trust bundle every command gets, so a host egress-gate terminates TLS for (one an
+ * `environment_secret` is bound to) is trusted. Only the certificate: its key stays in keys.
+ *
  * Every refusal answers the same 401 (the reason is logged), so a caller learns nothing about
  * which check failed.
  */
@@ -53,13 +57,14 @@ function sameHash(a, b) {
     const right = Buffer.from(b, "hex");
     return left.length === right.length && left.length > 0 && timingSafeEqual(left, right);
 }
-function answerOf(grant) {
+function answerOf(grant, caCertificate) {
     return {
         hostToken: grant.hostToken,
         egressToken: grant.egressToken,
         sandboxId: grant.claims.sandboxId,
         epoch: grant.claims.epoch,
         expiresAt: new Date(grant.claims.expiresAt).toISOString(),
+        caCertificate,
     };
 }
 export function hostAuthority(ctx) {
@@ -154,11 +159,11 @@ export function hostAuthority(ctx) {
             // The previous host's connection (an older epoch) serves nothing more.
             ctx.harness.revokeHost(sandboxId, joined);
             ctx.config.logger.info("sandbox host joined", { sandboxId, epoch: joined });
-            return answerOf(await mintHostTokens(ctx, { sandboxId, epoch: joined, podUid }));
+            return answerOf(await mintHostTokens(ctx, { sandboxId, epoch: joined, podUid }), await ctx.keys.egressCa());
         },
         async renew(hostToken) {
             const claims = await verified(hostToken);
-            return answerOf(await mintHostTokens(ctx, claims));
+            return answerOf(await mintHostTokens(ctx, claims), await ctx.keys.egressCa());
         },
         verify: verified,
     };

package/dist/sandbox/manager.d.ts

@@ -34,6 +34,8 @@ export interface SandboxSessionRef {
      * so every session attached to it shares the files; absent, the workspace is the session's.
      */
     readonly sandboxId?: string;
+    /** Variables every command of the call gets (R2c): secret names set to the sentinel, plain values. */
+    readonly environment?: Readonly<Record<string, string>>;
     /**
      * Who the call's events are claimed for, passed back to `emit`: in a harness, the run that
      * made the call (its run id).

package/dist/sandbox/manager.js

@@ -285,7 +285,7 @@ export class SandboxManager {
         try {
             const outcome = await runSandboxTool(live.handle, toolName, (input ?? {}), signal, (value) => {
                 report = value;
-            });
+            }, session.environment);
             await this.options.emit(session.id, session.activeTurnId, "sandbox.exec", {
                 tool: toolName,
                 ...report,

package/dist/sandbox/tools.d.ts

@@ -20,4 +20,6 @@ export declare function truncateMiddle(value: string, limit?: number): {
     text: string;
     truncated: boolean;
 };
-export declare function runSandboxTool(handle: SandboxHandle, name: SandboxToolName, input: Record<string, any>, signal: AbortSignal, report: (value: SandboxToolReport) => void): Promise<SandboxToolOutcome>;
+export declare function runSandboxTool(handle: SandboxHandle, name: SandboxToolName, input: Record<string, any>, signal: AbortSignal, report: (value: SandboxToolReport) => void, 
+/** Variables every command gets (R2c): secret names set to the sentinel, plain values. */
+environment?: Readonly<Record<string, string>>): Promise<SandboxToolOutcome>;