@nylorun/runtime 0.21.1-beta → 0.22.0-beta

package/dist/sandbox/tools.js

@@ -39,10 +39,12 @@ const failed = (code, message) => ({
     code,
     message,
 });
-export async function runSandboxTool(handle, name, input, signal, report) {
+export async function runSandboxTool(handle, name, input, signal, report, 
+/** Variables every command gets (R2c): secret names set to the sentinel, plain values. */
+environment) {
     const workspace = handle.workspace ?? SANDBOX_WORKSPACE;
     const resolvePath = (path) => resolveSandboxPath(path, workspace);
-    const exec = (command, timeoutMs = 60_000) => handle.exec({ command, cwd: workspace, timeoutMs }, signal);
+    const exec = (command, timeoutMs = 60_000) => handle.exec({ command, cwd: workspace, timeoutMs, ...(environment ? { env: environment } : {}) }, signal);
     switch (name) {
         case "bash": {
             const command = String(input.command);

package/dist/sandbox/types.d.ts

@@ -36,6 +36,11 @@ export interface ExecRequest {
     readonly command: string;
     readonly cwd: string;
     readonly timeoutMs: number;
+    /**
+     * Variables this command gets on top of the backend's own (R2c): never a secret. The backend's
+     * proxy and trust variables win over them.
+     */
+    readonly env?: Readonly<Record<string, string>>;
 }
 export interface ExecResult {
     readonly exitCode: number;

package/dist/store/postgres/schema.d.ts

@@ -1048,14 +1048,14 @@ export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWith
             tableName: "vault_credentials";
             dataType: "string";
             columnType: "PgText";
-            data: "bearer" | "headers" | "model";
+            data: "bearer" | "environment_secret" | "environment_variable" | "headers" | "model";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["bearer", "headers", "model"];
+            enumValues: ["bearer", "headers", "environment_secret", "environment_variable", "model"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;

package/dist/store/postgres/schema.js

@@ -129,7 +129,7 @@ export const vaultCredentials = nylorun.table("vault_credentials", {
     id: textC().primaryKey(),
     vaultId: text().notNull(),
     name: text().notNull(),
-    type: text({ enum: ["bearer", "headers", "model"] }).notNull(),
+    type: text({ enum: ["bearer", "headers", "environment_secret", "environment_variable", "model"] }).notNull(),
     /** JSON text of the non-secret binding: url (and via, identity, header names), or provider and model. */
     bindingJson: text().notNull(),
     expiresAt: text(),

package/dist/tenant/sessions.js

@@ -136,7 +136,12 @@ export async function putSession(ctx, id, body, access, options = {}) {
             return prior;
         }
         await ctx.vault.assertAttachment(t, body.ownerUserId, vaultIds, credentialSelections, { opaque });
+        const environment = await ctx.vault.sessionEnvironment(t, vaultIds);
+        if (environment.conflict)
+            fail(409, environment.conflict, { code: "credential_conflict" });
         if (prior) {
+            if (prior.sandboxId !== undefined)
+                await assertSandboxSecrets(ctx, t, prior.sandboxId, id, body.ownerUserId, environment.secretHosts);
             if (sessionIdentity(prior.creation) !== sessionIdentity(body))
                 fail(409, "Session already exists with different creation parameters");
             prior.vaultIds = vaultIds;
@@ -156,6 +161,8 @@ export async function putSession(ctx, id, body, access, options = {}) {
         checkPlacement(await readSandboxConfig(t), sandbox.kind);
         if (sandbox.kind === "pod")
             await requirePods(ctx.pods, `Sandbox ${sandbox.sandboxId}`);
+        if (sandbox.sandboxId !== undefined)
+            await assertSandboxSecrets(ctx, t, sandbox.sandboxId, id, body.ownerUserId, environment.secretHosts);
         const pinned = sandbox.manifest === undefined ? platformTools(definition) : sandbox;
         const created = {
             id,
@@ -186,6 +193,25 @@ export async function putSession(ctx, id, body, access, options = {}) {
         return created;
     });
 }
+/**
+ * A sandbox's shell secrets must be unambiguous (R2c, D50): egress-gate sets the header from the
+ * one `environment_secret` bound to a host among the sessions using the sandbox. So while any of
+ * them has secrets, they all have one owner, and no host is bound to two credentials.
+ */
+async function assertSandboxSecrets(ctx, t, sandboxId, sessionId, ownerUserId, secretHosts) {
+    const conflict = (message) => fail(409, message, { code: "credential_conflict" });
+    const mine = Object.keys(secretHosts).length > 0;
+    for (const other of await t.sessionsOnSandbox(sandboxId)) {
+        if (other.id === sessionId)
+            continue;
+        const theirs = (await ctx.vault.sessionEnvironment(t, other.vaultIds ?? [])).secretHosts;
+        if (other.ownerUserId !== ownerUserId && (mine || Object.keys(theirs).length > 0))
+            conflict(`Sandbox ${sandboxId} serves environment_secret credentials of one owner at a time`);
+        for (const [host, credentialId] of Object.entries(secretHosts))
+            if (theirs[host] !== undefined && theirs[host] !== credentialId)
+                conflict(`Two environment_secret credentials would be bound to ${host} in sandbox ${sandboxId}`);
+    }
+}
 function isShare(value) {
     return typeof value === "object" && value !== null && "session" in value;
 }

package/dist/tenant/transcript.d.ts

@@ -103,6 +103,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     agent: import("@nylorun/core/define").AgentRef;
     error: {
         code: string;
@@ -112,10 +113,10 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
         retryable?: boolean | undefined;
     };
     output?: undefined;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     agent?: undefined;
     error: {
         code: string;
@@ -125,7 +126,6 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
         retryable?: boolean | undefined;
     };
     output?: undefined;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
@@ -143,17 +143,17 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     agent: import("@nylorun/core/define").AgentRef;
     error?: undefined;
     output: unknown;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     agent?: undefined;
     error?: undefined;
     output: unknown;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
@@ -187,6 +187,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     callId: string;
     invocationId: string;
     agent: import("@nylorun/core/define").AgentRef;
@@ -198,10 +199,10 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
         retryable?: boolean | undefined;
     };
     output?: undefined;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     callId: string;
     invocationId: string;
     agent?: undefined;
@@ -213,7 +214,6 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
         retryable?: boolean | undefined;
     };
     output?: undefined;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
@@ -235,21 +235,21 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     callId: string;
     invocationId: string;
     agent: import("@nylorun/core/define").AgentRef;
     error?: undefined;
     output: unknown;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     callId: string;
     invocationId: string;
     agent?: undefined;
     error?: undefined;
     output: unknown;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | undefined;

package/dist/vault/service.d.ts

@@ -76,6 +76,40 @@ export declare class VaultService {
     }): Promise<void>;
     /** Writes the `attach` audit row. Run in the session PUT transaction. */
     recordAttachment(t: Tx, sessionId: string, vaultIds: readonly string[]): Promise<void>;
+    /**
+     * The variables a session's sandbox commands get (R2c, D50): each `environment_secret`'s name
+     * set to the sentinel, each `environment_variable`'s value, and each host a secret is bound to
+     * with that secret's credential id. `conflict` says why they are ambiguous: two credentials with one variable name, or two
+     * secrets bound to one host. Reads rows only; no plaintext. Run in the caller's transaction.
+     */
+    sessionEnvironment(t: Tx, vaultIds: readonly string[]): Promise<{
+        environment: Record<string, string>;
+        secretHosts: Record<string, string>;
+        conflict?: string;
+    }>;
+    /**
+     * The header egress-gate sets on a request from `sandboxId` to `host` (R2c, D50): the
+     * `environment_secret` bound to `host` among the vaults of the sessions using the sandbox, its
+     * value unsealed and rendered into its format. `none` when no secret is bound to the host;
+     * `refused` when two are, or the sealed value cannot be read. One query and one unseal per
+     * call; nothing is cached (E3). Plaintext exists only in the returned header.
+     */
+    releaseEnvironmentSecret(input: {
+        sandboxId: string;
+        host: string;
+    }): Promise<{
+        status: "none";
+    } | {
+        status: "released";
+        header: string;
+        value: string;
+        credentialId: string;
+    } | {
+        status: "refused";
+        reason: "ambiguous" | "unreadable";
+    }>;
+    /** Whether any `environment_secret` of the sessions using `sandboxId` is bound to `host`. */
+    environmentSecretBound(sandboxId: string, host: string): Promise<boolean>;
     authorize(input: {
         /** The session the request is made for; absent for a tool preview (R2b C12). */
         sessionId?: string;

package/dist/vault/service.js

@@ -74,7 +74,7 @@
  * credential is chosen.
  */
 import { createHash, randomUUID } from "node:crypto";
-import { INSTALLATION_OWNER } from "@nylorun/core/contracts";
+import { ENVIRONMENT_SECRET_DEFAULT_INJECT, ENVIRONMENT_SECRET_SENTINEL, INSTALLATION_OWNER, renderInjectFormat, } from "@nylorun/core/contracts";
 import { canonical } from "../store/canonical.js";
 import { decryptSecret, encryptSecret, VaultCryptoError } from "./crypto.js";
 import { VaultError } from "./error.js";
@@ -156,11 +156,18 @@ export class VaultService {
         return this.store.tx((t) => this.replay(t, `create-credential:${vaultId}:${body.idempotencyKey}`, body, async () => {
             await this.vaultInfo(t, vaultId);
             const id = randomUUID();
-            const url = normalizeVaultUrl(body.auth.url);
             const type = body.auth.type;
-            const payload = payloadOf(body.auth);
-            const binding = bindingOf(url, payload, body.auth);
-            const sealed = encryptSecret(kek, credentialAad(vaultId, id, type, url), Buffer.from(JSON.stringify(payload), "utf8"));
+            let payload;
+            let binding;
+            if (body.auth.type === "environment_secret" || body.auth.type === "environment_variable") {
+                ({ payload, binding } = environmentCredential(body.auth));
+            }
+            else {
+                const url = normalizeVaultUrl(body.auth.url);
+                payload = payloadOf(body.auth);
+                binding = bindingOf(url, payload, body.auth);
+            }
+            const sealed = encryptSecret(kek, credentialAad(vaultId, id, type, binding), Buffer.from(JSON.stringify(payload), "utf8"));
             const row = {
                 id,
                 vaultId,
@@ -201,11 +208,23 @@ export class VaultService {
             if (row.type !== body.auth.type)
                 throw new VaultError(409, "Credential type cannot change");
             const current = credentialBinding(row);
-            const next = payloadOf(body.auth);
-            const binding = bindingOf(current.url, next, {
-                via: body.auth.via === undefined ? current.via : body.auth.via,
-                identity: body.auth.identity === undefined ? current.identity : body.auth.identity,
-            });
+            let next;
+            let binding;
+            if (body.auth.type === "environment_secret") {
+                next = { value: body.auth.secretValue };
+                binding = current;
+            }
+            else if (body.auth.type === "environment_variable") {
+                next = {};
+                binding = { ...current, variableValue: body.auth.variableValue };
+            }
+            else {
+                next = payloadOf(body.auth);
+                binding = bindingOf(current.url, next, {
+                    via: body.auth.via === undefined ? current.via : body.auth.via,
+                    identity: body.auth.identity === undefined ? current.identity : body.auth.identity,
+                });
+            }
             const updated = await this.writePayload(t, kek, row, next, binding, new Date().toISOString());
             await this.audit(t, {
                 actor: "application",
@@ -271,6 +290,65 @@ export class VaultService {
             outcome: "attached",
         });
     }
+    /**
+     * The variables a session's sandbox commands get (R2c, D50): each `environment_secret`'s name
+     * set to the sentinel, each `environment_variable`'s value, and each host a secret is bound to
+     * with that secret's credential id. `conflict` says why they are ambiguous: two credentials with one variable name, or two
+     * secrets bound to one host. Reads rows only; no plaintext. Run in the caller's transaction.
+     */
+    async sessionEnvironment(t, vaultIds) {
+        const environment = {};
+        const hosts = new Map();
+        let conflict;
+        for (const vaultId of vaultIds)
+            for (const row of await t.credentialsForVault(vaultId)) {
+                if (row.type !== "environment_secret" && row.type !== "environment_variable")
+                    continue;
+                const binding = JSON.parse(row.bindingJson);
+                const name = row.type === "environment_secret" ? binding.secretName : binding.variableName;
+                if (name in environment)
+                    conflict ??= `Two attached credentials set the variable ${name}`;
+                environment[name] = row.type === "environment_secret" ? ENVIRONMENT_SECRET_SENTINEL : binding.variableValue;
+                for (const host of row.type === "environment_secret" ? binding.allowedHosts ?? [] : []) {
+                    if (hosts.has(host) && hosts.get(host) !== row.id)
+                        conflict ??= `Two attached environment_secret credentials are bound to ${host}`;
+                    hosts.set(host, row.id);
+                }
+            }
+        return { environment, secretHosts: Object.fromEntries([...hosts].sort()), ...(conflict ? { conflict } : {}) };
+    }
+    /**
+     * The header egress-gate sets on a request from `sandboxId` to `host` (R2c, D50): the
+     * `environment_secret` bound to `host` among the vaults of the sessions using the sandbox, its
+     * value unsealed and rendered into its format. `none` when no secret is bound to the host;
+     * `refused` when two are, or the sealed value cannot be read. One query and one unseal per
+     * call; nothing is cached (E3). Plaintext exists only in the returned header.
+     */
+    async releaseEnvironmentSecret(input) {
+        const found = await this.store.tx((t) => sandboxSecretsFor(t, input.sandboxId, input.host));
+        if (found.length === 0)
+            return { status: "none" };
+        if (found.length > 1)
+            return { status: "refused", reason: "ambiguous" };
+        const row = found[0];
+        let payload;
+        try {
+            payload = readPayload(this.kek(), row);
+        }
+        catch (error) {
+            if (!(error instanceof VaultCryptoError))
+                throw error;
+            return { status: "refused", reason: "unreadable" };
+        }
+        if (!payload.value)
+            return { status: "refused", reason: "unreadable" };
+        const inject = credentialBinding(row).inject ?? ENVIRONMENT_SECRET_DEFAULT_INJECT;
+        return { status: "released", header: inject.header, value: renderInjectFormat(inject.format, payload.value), credentialId: row.id };
+    }
+    /** Whether any `environment_secret` of the sessions using `sandboxId` is bound to `host`. */
+    async environmentSecretBound(sandboxId, host) {
+        return (await this.store.tx((t) => sandboxSecretsFor(t, sandboxId, host))).length > 0;
+    }
     // --- use ---------------------------------------------------------------------
     async authorize(input) {
         const url = normalizeVaultUrl(input.url);
@@ -502,7 +580,7 @@ export class VaultService {
     }
     /** Re-seals a user credential's payload with its new binding and returns the updated row. */
     async writePayload(t, kek, row, payload, binding, rotatedAt) {
-        const sealed = encryptSecret(kek, credentialAad(row.vaultId, row.id, row.type, bindingUrl(row)), Buffer.from(JSON.stringify(payload), "utf8"));
+        const sealed = encryptSecret(kek, credentialAad(row.vaultId, row.id, row.type, binding), Buffer.from(JSON.stringify(payload), "utf8"));
         const patch = { rotatedAt, bindingJson: JSON.stringify(binding), ...sealed };
         if (!(await t.updateCredential(row.vaultId, row.id, patch)))
             throw new VaultError(404, "Credential not found");
@@ -649,7 +727,15 @@ function credentialInfoOf(row) {
         vaultId: row.vaultId,
         name: row.name,
         type: row.type,
-        binding: { url: binding.url },
+        binding: row.type === "environment_secret"
+            ? {
+                secretName: binding.secretName,
+                allowedHosts: binding.allowedHosts,
+                inject: binding.inject ?? { ...ENVIRONMENT_SECRET_DEFAULT_INJECT },
+            }
+            : row.type === "environment_variable"
+                ? { variableName: binding.variableName, variableValue: binding.variableValue }
+                : { url: binding.url },
         ...(binding.headerNames === undefined ? {} : { headerNames: binding.headerNames }),
         ...(binding.via === undefined ? {} : { via: binding.via }),
         ...(binding.identity === undefined ? {} : { identity: binding.identity }),
@@ -658,7 +744,7 @@ function credentialInfoOf(row) {
     };
 }
 function readPayload(kek, row) {
-    const aad = credentialAad(row.vaultId, row.id, row.type, bindingUrl(row));
+    const aad = credentialAad(row.vaultId, row.id, row.type, credentialBinding(row));
     const plaintext = decryptSecret(kek, aad, Buffer.from(row.nonce), Buffer.from(row.ciphertext), Buffer.from(row.wrappedDek), row.kekId);
     try {
         return JSON.parse(plaintext.toString("utf8"));
@@ -804,10 +890,57 @@ export function hostModelAad(provider, model) {
         model,
     }), "utf8");
 }
-function credentialAad(vaultId, credentialId, type, url) {
-    return Buffer.from(canonical({ vaultId, credentialId, type, url }), "utf8");
+/**
+ * What a user credential's ciphertext is bound to: its vault, id, type and URL; for an
+ * `environment_secret` (R2c) also its variable, hosts and header, so the value can never be sent
+ * anywhere else without a new seal.
+ */
+function credentialAad(vaultId, credentialId, type, binding) {
+    return Buffer.from(canonical(type === "environment_secret"
+        ? {
+            vaultId,
+            credentialId,
+            type,
+            secretName: binding.secretName,
+            allowedHosts: binding.allowedHosts,
+            inject: binding.inject ?? null,
+        }
+        : { vaultId, credentialId, type, url: binding.url }), "utf8");
+}
+/** The sealed payload and unsealed binding of an environment credential (R2c). */
+function environmentCredential(auth) {
+    if (auth.type === "environment_variable")
+        return { payload: {}, binding: { variableName: auth.variableName, variableValue: auth.variableValue } };
+    if (auth.inject)
+        checkCredentialHeaders([auth.inject.header.toLowerCase()], undefined);
+    return {
+        payload: { value: auth.secretValue },
+        binding: {
+            secretName: auth.secretName,
+            allowedHosts: auth.allowedHosts.map((host) => host.toLowerCase()),
+            ...(auth.inject ? { inject: { header: auth.inject.header, format: auth.inject.format } } : {}),
+        },
+    };
 }
 function requestHash(body) {
     const { requestId: _requestId, ...rest } = body;
     return canonical(rest);
 }
+/**
+ * The `environment_secret` credentials bound to `host` in the vaults of every session on the
+ * sandbox (R2c). A session between turns counts: it can run again, and what it started may
+ * still run. Session open keeps them to one owner and one credential per host.
+ */
+async function sandboxSecretsFor(t, sandboxId, host) {
+    const lower = host.toLowerCase();
+    const vaultIds = new Set();
+    for (const session of await t.sessionsOnSandbox(sandboxId))
+        for (const vaultId of session.vaultIds ?? [])
+            vaultIds.add(vaultId);
+    const matches = [];
+    for (const vaultId of vaultIds)
+        for (const row of await t.credentialsForVault(vaultId))
+            if (row.type === "environment_secret" && (credentialBinding(row).allowedHosts ?? []).includes(lower))
+                matches.push(row);
+    return matches;
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.21.1-beta";
+export declare const RUNTIME_VERSION = "0.22.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.21.1-beta";
+export const RUNTIME_VERSION = "0.22.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.21.1-beta",
+  "version": "0.22.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.3",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.31.0",
-    "@nylorun/core": "0.18.0-beta",
-    "@nylorun/harness": "0.25.0-beta",
+    "@nylorun/core": "0.19.0-beta",
+    "@nylorun/harness": "0.25.1-beta",
     "@restatedev/restate-sdk": "1.17.2",
     "@s2-dev/streamstore": "0.28.0",
     "aws4fetch": "1.0.20",