@nylorun/runtime 0.23.0-beta → 0.24.0-beta

package/dist/gates/policy.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Tool policy (R5 step 2). Every MCP and HTTP tool call of every harness is decided as core
+ * journals it (`harness-api/record.ts`), which each harness must do before it sends a call:
+ * `deny` fails it to the model as `tool.denied`, unsent; `ask` holds the row until a person
+ * approves it on the session; `allow` runs it. The Tool Gate sends only a call the journal holds
+ * running (`journal.ts`), so a held or refused call cannot run, whichever harness asks.
+ *
+ * The rules are the Tenant's (`PUT /v1/tenant/tool-policy`, the `tool-policy` setting). A rule
+ * matches a call when every selector it sets matches; the strictest matching rule decides
+ * (`deny`, then `ask`, then `allow`), and a call no rule matches runs. A session pinned to a
+ * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
+ * the approval it was opened with. A policy that cannot be read refuses every call.
+ */
+import { type ToolPolicy, type ToolRule } from "@nylorun/core/contracts";
+import type { AgentManifest } from "@nylorun/core/define";
+import type { HostEffect } from "@nylorun/harness/run";
+import { type McpSnapshot } from "../mcp/snapshot.js";
+import type { Tx } from "../store/types.js";
+import type { Session } from "../tenant/context.js";
+/** The `tenant_settings` key the policy is kept under. */
+export declare const TOOL_POLICY_SETTING = "tool-policy";
+/** A call as the policy reads it. */
+export interface PolicyCall {
+    readonly kind: "mcp" | "http";
+    /** The name the model calls the tool by; a flow stage's key. */
+    readonly tool: string;
+    /** The MCP server's name. */
+    readonly server?: string;
+    /** The agent that calls it. */
+    readonly agent: string;
+    readonly input: unknown;
+}
+export type PolicyDecision = {
+    readonly effect: "allow";
+} | {
+    readonly effect: "ask" | "deny";
+    readonly reason: string;
+};
+/** The Tenant's policy; an empty one when none was set. Throws when it cannot be read. */
+export declare function readToolPolicy(t: Pick<Tx, "getSetting">): Promise<ToolPolicy>;
+/**
+ * The decision for `request`, a session's MCP or HTTP tool call: the Tenant's rules and the
+ * pinned manifest's `approval`. A policy that cannot be read refuses the call.
+ */
+export declare function toolCallDecision(t: Pick<Tx, "getSetting">, s: Session, request: HostEffect, kind: "mcp" | "http"): Promise<PolicyDecision>;
+/** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */
+export declare function decide(rules: readonly ToolRule[], call: PolicyCall, pinnedAsk?: boolean): PolicyDecision;
+/** The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2. */
+export declare function pinnedApproval(manifest: AgentManifest, snapshot: McpSnapshot | undefined, request: HostEffect): boolean;

package/dist/gates/policy.js

@@ -0,0 +1,134 @@
+/**
+ * Tool policy (R5 step 2). Every MCP and HTTP tool call of every harness is decided as core
+ * journals it (`harness-api/record.ts`), which each harness must do before it sends a call:
+ * `deny` fails it to the model as `tool.denied`, unsent; `ask` holds the row until a person
+ * approves it on the session; `allow` runs it. The Tool Gate sends only a call the journal holds
+ * running (`journal.ts`), so a held or refused call cannot run, whichever harness asks.
+ *
+ * The rules are the Tenant's (`PUT /v1/tenant/tool-policy`, the `tool-policy` setting). A rule
+ * matches a call when every selector it sets matches; the strictest matching rule decides
+ * (`deny`, then `ask`, then `allow`), and a call no rule matches runs. A session pinned to a
+ * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
+ * the approval it was opened with. A policy that cannot be read refuses every call.
+ */
+import { ToolPolicySchema } from "@nylorun/core/contracts";
+import { mcpToolOf, mcpToolSettingsIn } from "../mcp/snapshot.js";
+import { canonical } from "../store/canonical.js";
+import { turnManifestOf } from "../tenant/session.js";
+import { declaredHttpTool } from "./http-tool.js";
+/** The `tenant_settings` key the policy is kept under. */
+export const TOOL_POLICY_SETTING = "tool-policy";
+const STRICTNESS = { allow: 0, ask: 1, deny: 2 };
+/** The Tenant's policy; an empty one when none was set. Throws when it cannot be read. */
+export async function readToolPolicy(t) {
+    const raw = await t.getSetting(TOOL_POLICY_SETTING);
+    if (raw === undefined)
+        return { rules: [], updatedAt: null };
+    return ToolPolicySchema.parse(JSON.parse(raw));
+}
+/**
+ * The decision for `request`, a session's MCP or HTTP tool call: the Tenant's rules and the
+ * pinned manifest's `approval`. A policy that cannot be read refuses the call.
+ */
+export async function toolCallDecision(t, s, request, kind) {
+    let rules;
+    try {
+        rules = (await readToolPolicy(t)).rules;
+    }
+    catch {
+        return { effect: "deny", reason: "The Tenant's tool policy could not be read, so no tool call runs" };
+    }
+    const mcp = mcpToolOf(s.mcpSnapshot, request);
+    return decide(rules, {
+        kind,
+        tool: request.toolName ?? request.key ?? request.effectId,
+        ...(mcp ? { server: mcp.serverName } : {}),
+        agent: request.agent?.id ?? s.agentId,
+        input: request.input,
+    }, pinnedApproval(turnManifestOf(s), s.mcpSnapshot, request));
+}
+/** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */
+export function decide(rules, call, pinnedAsk = false) {
+    let strictest = pinnedAsk
+        ? { effect: "ask", reason: `The agent's manifest asks for approval of '${call.tool}'` }
+        : undefined;
+    for (const rule of rules) {
+        if (!matches(rule, call))
+            continue;
+        if (strictest && STRICTNESS[rule.effect] <= STRICTNESS[strictest.effect])
+            continue;
+        strictest = { effect: rule.effect, reason: rule.reason ?? describe(rule) };
+    }
+    if (!strictest || strictest.effect === "allow")
+        return { effect: "allow" };
+    return { effect: strictest.effect, reason: strictest.reason };
+}
+/** The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2. */
+export function pinnedApproval(manifest, snapshot, request) {
+    const mcp = mcpToolOf(snapshot, request);
+    if (mcp)
+        return mcpToolSettingsIn(manifest, mcp).approval === "always";
+    if (request.capabilityId === undefined)
+        return false;
+    return declaredHttpTool(manifest, request.agent?.id, request.capabilityId, request.toolName)?.approval === "always";
+}
+function matches(rule, call) {
+    if (rule.kind !== undefined && rule.kind !== call.kind)
+        return false;
+    if (rule.tool !== undefined && !glob(rule.tool).test(call.tool))
+        return false;
+    if (rule.server !== undefined && (call.server === undefined || !glob(rule.server).test(call.server)))
+        return false;
+    if (rule.agent !== undefined && !glob(rule.agent).test(call.agent))
+        return false;
+    for (const [path, condition] of Object.entries(rule.when ?? {}))
+        if (!holds(condition, fieldOf(call.input, path)))
+            return false;
+    return true;
+}
+/** A pattern where `*` is any run of characters, matched whole. */
+function glob(pattern) {
+    return new RegExp(`^${pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`);
+}
+/** The value at a dotted `path` of `input`, or undefined. */
+function fieldOf(input, path) {
+    let value = input;
+    for (const key of path.split(".")) {
+        if (!value || typeof value !== "object")
+            return undefined;
+        value = value[key];
+    }
+    return value;
+}
+function holds(condition, value) {
+    if (value === undefined)
+        return false;
+    if (condition.equals !== undefined && canonical(value) !== canonical(condition.equals))
+        return false;
+    if (condition.in !== undefined && !condition.in.some((item) => canonical(item) === canonical(value)))
+        return false;
+    const number = typeof value === "number" ? value : undefined;
+    if (condition.gt !== undefined && !(number !== undefined && number > condition.gt))
+        return false;
+    if (condition.gte !== undefined && !(number !== undefined && number >= condition.gte))
+        return false;
+    if (condition.lt !== undefined && !(number !== undefined && number < condition.lt))
+        return false;
+    if (condition.lte !== undefined && !(number !== undefined && number <= condition.lte))
+        return false;
+    if (condition.matches !== undefined && !(typeof value === "string" && new RegExp(condition.matches).test(value)))
+        return false;
+    return true;
+}
+/** What a rule with no `reason` says. */
+function describe(rule) {
+    const what = [
+        rule.tool === undefined ? undefined : `tool '${rule.tool}'`,
+        rule.server === undefined ? undefined : `server '${rule.server}'`,
+        rule.kind === undefined ? undefined : `${rule.kind} tools`,
+        rule.agent === undefined ? undefined : `agent '${rule.agent}'`,
+        rule.when === undefined ? undefined : `input ${Object.keys(rule.when).join(", ")}`,
+    ].filter((part) => part !== undefined);
+    const verb = rule.effect === "deny" ? "refuses" : "asks a person about";
+    return `The Tenant's tool policy ${verb} ${what.length === 0 ? "every tool call" : `calls of ${what.join(", ")}`}`;
+}

package/dist/gates/tenant-vaults.d.ts

@@ -29,15 +29,15 @@ export interface TenantVault {
     session(sessionId: string): Promise<Session | undefined>;
     /**
      * The authorization of one request to a session's remote MCP server or HTTP tool: its
-     * credential from the session's attached vaults.
+     * credential from the vault of the session's Environment.
      */
     authorizeMcp(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
     /** Vault writes and token signing with the Tenant's vault key (the keys service, F4.2). */
     keys(): Keys;
-    /** Whether a live session on the sandbox has an `environment_secret` bound to `host` (R2c). */
-    environmentSecretBound(sandboxId: string, host: string): Promise<boolean>;
+    /** Whether the Environment's vault has an `environment_secret` bound to `host` (R2c). */
+    environmentSecretBound(environmentId: string, host: string): Promise<boolean>;
     /** The header an `environment_secret` sets on one request to `host` (R2c). */
-    releaseEnvironmentSecret(sandboxId: string, host: string): ReturnType<VaultService["releaseEnvironmentSecret"]>;
+    releaseEnvironmentSecret(environmentId: string, host: string): ReturnType<VaultService["releaseEnvironmentSecret"]>;
 }
 export interface TenantVaults {
     /**
@@ -60,8 +60,8 @@ export interface TenantVaultsOptions {
 }
 export declare function createTenantVaults(options: TenantVaultsOptions): TenantVaults;
 /**
- * A request to a session's remote MCP server, authorized from the session's attached vaults:
- * what the loop does in its own process (`tenant/effects.ts` `authorize`). The vaults come from
- * the session row.
+ * A request to a session's remote MCP server, authorized from its Environment's vault: what the
+ * loop does in its own process (`tenant/effects.ts` `authorize`). The Environment comes from the
+ * session row.
  */
 export declare function authorizeSessionMcp(vault: Pick<VaultService, "authorize">, session: (sessionId: string) => Promise<Session | undefined>, sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;

package/dist/gates/tenant-vaults.js

@@ -52,8 +52,8 @@ export function createTenantVaults(options) {
             session,
             authorizeMcp: (sessionId, request) => authorizeSessionMcp(credentials, session, sessionId, request),
             keys: () => keys,
-            environmentSecretBound: (sandboxId, host) => credentials.environmentSecretBound(sandboxId, host),
-            releaseEnvironmentSecret: (sandboxId, host) => credentials.releaseEnvironmentSecret({ sandboxId, host }),
+            environmentSecretBound: (environmentId, host) => credentials.environmentSecretBound(environmentId, host),
+            releaseEnvironmentSecret: (environmentId, host) => credentials.releaseEnvironmentSecret({ environmentId, host }),
         };
     }
     /** The database's Tenant, once its schema is at this build's version. */
@@ -81,9 +81,9 @@ export function createTenantVaults(options) {
     };
 }
 /**
- * A request to a session's remote MCP server, authorized from the session's attached vaults:
- * what the loop does in its own process (`tenant/effects.ts` `authorize`). The vaults come from
- * the session row.
+ * A request to a session's remote MCP server, authorized from its Environment's vault: what the
+ * loop does in its own process (`tenant/effects.ts` `authorize`). The Environment comes from the
+ * session row.
  */
 export async function authorizeSessionMcp(vault, session, sessionId, request) {
     const found = await session(sessionId);

package/dist/gates/tool-calls.d.ts

@@ -8,10 +8,14 @@
  * - The gate also writes a `tool_crossings` row before it calls the server, and the answer
  *   after. A re-send that finds the answer gets it. One that finds a row without an answer,
  *   for a call this gateway is not running, was lost with an earlier gateway (a restart mid
- *   call): it answers `uncertain`, because the call may have run, and is never run again.
+ *   call): it is started again under the same key (R5.3), so the tool sees the key twice and
+ *   a tool that honors it acts once. Core counts the sends and stops at its cap (R5.4).
+ * - A re-send that another gateway process started or settled between this one's read and its
+ *   write answers `{uncertain: true}`: not answered here, so the caller sends it again later.
  *
- * A cancel aborts the call and leaves its row without an answer. Settled rows are deleted a day
- * later (`prune`).
+ * A cancel aborts the call and settles its row as cancelled: it never runs again under its key.
+ * A shutdown leaves the row open, so the next gateway starts it again. Settled rows are deleted
+ * a day later (`prune`); a re-send after that runs the call again, which at least once allows.
  */
 import type { Logger } from "../tenant/types.js";
 import { type InflightCallsOptions, type InflightOwner } from "./inflight.js";
@@ -29,8 +33,9 @@ export interface ToolCalls {
      */
     run(tenantId: string | undefined, key: string, hash: string, call: (signal: AbortSignal) => Promise<ToolCallAnswer>, owner?: InflightOwner): Promise<ToolCallAnswer>;
     /**
-     * Aborts the call under `key`; it is never run again under that key. With `sessionId`, false
-     * when the running call is another session's (nothing is aborted).
+     * Aborts the call under `key` and settles its crossing as cancelled: it is never run again
+     * under that key. With `sessionId`, false when the running call is another session's (nothing
+     * is aborted).
      */
     cancel(key: string, sessionId?: string): boolean;
     /** Aborts every running call (gateway shutdown). */

package/dist/gates/tool-calls.js

@@ -1,11 +1,15 @@
 import { createInflightCalls, InflightConflict, } from "./inflight.js";
 /** How long a settled crossing is kept. */
 export const TOOL_CROSSING_TTL_MS = 24 * 60 * 60_000;
-const LOST = {
+const CANCELLED = {
+    ok: false,
+    error: { message: "The call was cancelled while it ran; it may have reached its server" },
+};
+const ELSEWHERE = {
     ok: false,
     error: {
         uncertain: true,
-        message: "The gateway stopped while this tool call ran; the call may have reached its server, so it is not run again",
+        message: "Another gateway process is running this tool call; send it again",
     },
 };
 export function createToolCalls(options) {
@@ -16,7 +20,7 @@ export function createToolCalls(options) {
     return {
         async run(tenantId, key, hash, call, owner) {
             if (inflight.has(key))
-                return inflight.run(key, hash, () => Promise.resolve(LOST), owner);
+                return inflight.run(key, hash, () => Promise.resolve(ELSEWHERE), owner);
             const vault = await vaults.open(tenantId);
             const store = vault.store;
             const row = await store.tx((t) => t.toolCrossing(key));
@@ -25,16 +29,19 @@ export function createToolCalls(options) {
                     throw new InflightConflict(`A different request already ran under ${key}`);
                 if (row.answer !== null && row.answer !== undefined)
                     return row.answer;
-                // Started here a moment ago, or lost with an earlier gateway.
+                // Started here a moment ago: join it.
                 if (inflight.has(key))
-                    return inflight.run(key, hash, () => Promise.resolve(LOST), owner);
-                return LOST;
+                    return inflight.run(key, hash, () => Promise.resolve(ELSEWHERE), owner);
+                // Otherwise it was lost with an earlier gateway: it starts again below (R5.3).
             }
             return inflight.run(key, hash, async (signal) => {
-                const started = await store.tx((t) => t.startToolCrossing({ key, hash, startedAt: iso() }));
-                // Another gateway process wrote it between the read and now: never run it twice.
+                const startedAt = iso();
+                const started = await store.tx((t) => row
+                    ? t.restartToolCrossing({ key, hash, startedAt })
+                    : t.startToolCrossing({ key, hash, startedAt }));
+                // Another gateway process started or settled it between the read and now.
                 if (!started)
-                    return LOST;
+                    return ELSEWHERE;
                 const answer = await call(signal);
                 // A cancel or a shutdown: the call may have reached the server; the row stays open.
                 if (signal.aborted)
@@ -48,7 +55,18 @@ export function createToolCalls(options) {
                 return answer;
             }, owner);
         },
-        cancel: (key, sessionId) => inflight.cancel(key, sessionId),
+        cancel(key, sessionId) {
+            if (!inflight.cancel(key, sessionId))
+                return false;
+            void vaults
+                .open(undefined)
+                .then((vault) => vault.store.tx((t) => t.settleToolCrossing(key, CANCELLED, iso())))
+                .catch((error) => logger.warn("tool_crossing_unsettled", {
+                effect: key,
+                message: error instanceof Error ? error.message : String(error),
+            }));
+            return true;
+        },
         close: () => inflight.close(),
         async prune() {
             try {

package/dist/gates/tool-client.d.ts

@@ -1,5 +1,13 @@
 import type { ToolGate } from "./tool-gate.js";
 import type { RunTokens } from "../tenant/run-grants.js";
+/**
+ * A keyed call whose answer the hop lost (R5.3): the gate never got it, the connection broke,
+ * the gate answered `5xx`, or another gateway process holds the call. Sending it again with the
+ * same key is safe: the gate joins the call, answers it from its crossing, or runs it again.
+ */
+export declare class GateCallLost extends Error {
+    readonly name = "GateCallLost";
+}
 export interface HttpToolGateOptions {
     /** The gates service, e.g. `http://gateway:4100` (`NYLORUN_GATES_URL`). */
     readonly url: string;

package/dist/gates/tool-client.js

@@ -8,10 +8,12 @@
  * Failures keep the meaning they had in the loop's own process:
  * - An MCP request that fails throws, so the pool reports a diagnostic. A tool call's coded
  *   failure (R2b C7) throws the `McpCallFailed` the loop's own call would have, which becomes a
- *   failed outcome the model sees. Only the hop's failures and a call lost with the gateway leave
- *   it `uncertain`.
- * - An HTTP tool call throws only for the hop, or a call lost with the gateway: its own failures
- *   are outcomes.
+ *   failed outcome the model sees.
+ * - An HTTP tool call throws only for the hop: its own failures are outcomes.
+ * - A hop that lost the answer (the gate unreachable, the connection lost, a `5xx`, or a call
+ *   another gateway process holds) throws `GateCallLost`: sending the call again with the same
+ *   key joins it, collects its answer, or runs it again (R5.3). A gate's refusal (`4xx`) throws
+ *   a plain error.
  *
  * Credentials (F5): a session's MCP requests and keyed cancels carry its run token, read per
  * request from the advance's grant, and leave the session out of the body: the gate takes it
@@ -26,6 +28,14 @@ import { McpCallFailed, } from "../mcp/connect.js";
 import { TENANT_HEADER } from "./contract.js";
 import { GATE_CLIENT_TIMEOUT_MS } from "./http-client.js";
 import { HTTP_CALLS_PATH, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, TOOL_CALLS_PATH, } from "./tool-contract.js";
+/**
+ * A keyed call whose answer the hop lost (R5.3): the gate never got it, the connection broke,
+ * the gate answered `5xx`, or another gateway process holds the call. Sending it again with the
+ * same key is safe: the gate joins the call, answers it from its crossing, or runs it again.
+ */
+export class GateCallLost extends Error {
+    name = "GateCallLost";
+}
 /** How long a close or a cancel may take; neither changes an outcome. */
 const SHORT_TIMEOUT_MS = 2_000;
 export function httpToolGate(options) {
@@ -111,8 +121,7 @@ export function httpToolGate(options) {
     }
     /**
      * The answer of an MCP or HTTP tool request, or a throw: a coded MCP failure (`McpCallFailed`),
-     * or one the pool and `resolveEffect` read as before, the call's fate unknown and the effect
-     * `uncertain`.
+     * a lost hop (`GateCallLost`, sent again), or a gate's refusal.
      */
     async function answer(path, scope, request) {
         const result = await exchange(path, scope.body, {
@@ -123,8 +132,10 @@ export function httpToolGate(options) {
         if (result.kind === "aborted")
             throw result.reason ?? new Error("aborted");
         if (result.kind !== "answer")
-            throw new Error(result.message);
+            throw new GateCallLost(result.message);
         const parsed = parse(result.text);
+        if (result.status >= 500)
+            throw new GateCallLost(gateRefusal(result.status, parsed));
         if (result.status !== 200 || !parsed || !("ok" in parsed))
             throw new Error(gateRefusal(result.status, parsed));
         if (parsed.ok)
@@ -176,7 +187,9 @@ export function httpToolGate(options) {
         async callHttp(call, signal) {
             const token = options.runTokens?.token(call.tool.sessionId);
             const { sessionId: _, ...unnamed } = call.tool;
-            const body = { ...call, tool: token ? unnamed : { ...call.tool } };
+            // The gate reads the call's span context from its journal row (R7.4), not from the caller.
+            const { traceparent: _traceparent, ...sent } = call;
+            const body = { ...sent, tool: token ? unnamed : { ...call.tool } };
             return answered(HTTP_CALLS_PATH, { body, ...(token ? { bearer: token } : {}) }, { signal, idempotencyKey: call.effectId });
         },
         async cancel(request) {
@@ -190,10 +203,13 @@ export function httpToolGate(options) {
 }
 /** An MCP failure the gate reported, as the loop's own MCP code would have thrown it. */
 function mcpError(error) {
-    // Coded (R2b C7): the model sees it. A call lost with the gateway never is.
-    if (error.failure && !error.uncertain)
+    // Held by another gateway process: send it again (R5.3).
+    if (error.uncertain)
+        return new GateCallLost(error.message);
+    // Coded (R2b C7): the model sees it.
+    if (error.failure)
         return McpCallFailed.from(error.failure);
-    const thrown = new Error(error.uncertain ? `${error.message} (the call may have run; it is not sent again)` : error.message);
+    const thrown = new Error(error.message);
     if (error.code !== undefined)
         thrown.code = error.code;
     if (error.credentialIds !== undefined)

package/dist/gates/tool-contract.d.ts

@@ -1,7 +1,7 @@
 /**
  * The Tool Gate's wire format (blueprint §12, F4.1): the routes the loop calls on the gates
- * service for remote MCP servers and HTTP tools. Internal, like the model call route
- * (`contract.ts`): same optional Tenant header, not in the published OpenAPI documents.
+ * service for remote MCP servers and HTTP tools. Like the model call route (`contract.ts`): same
+ * optional Tenant header, bodies published in `@nylorun/core/harness-api` (R4.5).
  *
  * Credentials (F5). A session's MCP requests carry its run token, and the gate takes the
  * session from it: `server.sessionId` is then absent (or the token's). Core's credential
@@ -25,9 +25,9 @@
  * answer, not a gate error. A tool call's failure is coded (`error.failure`, R2b C7), and neither
  * a result nor a failure carries a credential value the gate sent (C8). An answer past 8 MiB is
  * `mcp.too-large` (C11), as an HTTP tool's is `http.too-large`; core shapes what fits into a
- * result the model can take (`tenant/tool-results.ts`). A keyed call whose
- * earlier attempt was lost with the gateway answers `{ok: false, error: {uncertain: true}}` and
- * is never run again.
+ * result the model can take (`tenant/tool-results.ts`). A keyed call whose earlier attempt was
+ * lost with the gateway runs again under the same key (R5.3); one another gateway process holds
+ * answers `{ok: false, error: {uncertain: true}}`, and the caller sends it again.
  *
  * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
  * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, capabilityId, toolName}`), or a
@@ -36,67 +36,10 @@
  * (`gates/http-tool.ts`). A run token's turn is the call's; `turnId` counts only under core's
  * credential. Keyed like a tool call, and cancelled by the same route. It answers
  * `200 {ok: true, result}` with the tool outcome (a failed request is a failed outcome the
- * model sees), or `{ok: false, error: {uncertain: true}}` for a call lost with the gateway.
+ * model sees), or `{ok: false, error: {uncertain: true}}` for a call another gateway process holds.
  */
-import { z } from "zod";
 import type { McpCallFailure } from "../mcp/connect.js";
-export declare const MCP_CONNECT_PATH = "/nylorun/v1/mcp/connect";
-export declare const MCP_LIST_PATH = "/nylorun/v1/mcp/list";
-export declare const MCP_CLOSE_PATH = "/nylorun/v1/mcp/close";
-export declare const TOOL_CALLS_PATH = "/nylorun/v1/tool-calls";
-export declare const HTTP_CALLS_PATH = "/nylorun/v1/http-calls";
-/** Largest tool call body the gate reads. */
-export declare const MAX_TOOL_BODY_BYTES: number;
-export declare const McpServerRefSchema: z.ZodObject<{
-    sessionId: z.ZodOptional<z.ZodString>;
-    agentId: z.ZodOptional<z.ZodString>;
-    capabilityId: z.ZodString;
-    serverName: z.ZodString;
-}, z.core.$strip>;
-export declare const McpServerBodySchema: z.ZodObject<{
-    server: z.ZodObject<{
-        sessionId: z.ZodOptional<z.ZodString>;
-        agentId: z.ZodOptional<z.ZodString>;
-        capabilityId: z.ZodString;
-        serverName: z.ZodString;
-    }, z.core.$strip>;
-}, z.core.$strip>;
-export declare const McpListBodySchema: z.ZodObject<{
-    server: z.ZodObject<{
-        sessionId: z.ZodOptional<z.ZodString>;
-        agentId: z.ZodOptional<z.ZodString>;
-        capabilityId: z.ZodString;
-        serverName: z.ZodString;
-    }, z.core.$strip>;
-    cursor: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export declare const ToolCallBodySchema: z.ZodObject<{
-    server: z.ZodObject<{
-        sessionId: z.ZodOptional<z.ZodString>;
-        agentId: z.ZodOptional<z.ZodString>;
-        capabilityId: z.ZodString;
-        serverName: z.ZodString;
-    }, z.core.$strip>;
-    effectId: z.ZodString;
-    name: z.ZodString;
-    arguments: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-}, z.core.$strip>;
-export type ToolCallBody = z.infer<typeof ToolCallBodySchema>;
-export declare const HttpCallBodySchema: z.ZodObject<{
-    tool: z.ZodUnion<readonly [z.ZodObject<{
-        sessionId: z.ZodOptional<z.ZodString>;
-        agentId: z.ZodOptional<z.ZodString>;
-        capabilityId: z.ZodString;
-        toolName: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        sessionId: z.ZodOptional<z.ZodString>;
-        stage: z.ZodString;
-    }, z.core.$strip>]>;
-    effectId: z.ZodString;
-    turnId: z.ZodString;
-    input: z.ZodUnknown;
-}, z.core.$strip>;
-export type HttpCallBody = z.infer<typeof HttpCallBodySchema>;
+export { HTTP_CALLS_PATH, HttpCallBodySchema, MAX_TOOL_BODY_BYTES, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, McpServerRefSchema, TOOL_CALLS_PATH, ToolCallBodySchema, type HttpCallBody, type ToolCallBody, } from "@nylorun/core/harness-api";
 /** Why an MCP request failed, as the loop's diagnostics read it (`mcp/connect.ts`). */
 export interface McpGateError {
     readonly message: string;
@@ -104,13 +47,12 @@ export interface McpGateError {
     readonly code?: number;
     /** The vault credentials a refused authorization names. */
     readonly credentialIds?: readonly string[];
-    /** The call may have run: its earlier attempt was lost with the gateway. Never re-run. */
+    /** Not answered here: another gateway process holds the keyed call. Send it again (R5.3). */
     readonly uncertain?: boolean;
     /**
      * How the request failed, coded (R2b C1, C7): the loop's `McpCallFailed`, which a tool call
-     * turns into a failed outcome the model sees (`mcp.lost` only for a read-only or idempotent
-     * tool). `credential_rejected` for a `401`, with the server and the scope of the vault whose
-     * credential was sent. Its message has no credential value in it (C8).
+     * turns into a failed outcome the model sees (`mcp.lost` included). `credential_rejected` for a
+     * `401`, with the server. Its message has no credential value in it (C8).
      */
     readonly failure?: McpCallFailure;
 }

package/dist/gates/tool-contract.js

@@ -1,85 +1 @@
-/**
- * The Tool Gate's wire format (blueprint §12, F4.1): the routes the loop calls on the gates
- * service for remote MCP servers and HTTP tools. Internal, like the model call route
- * (`contract.ts`): same optional Tenant header, not in the published OpenAPI documents.
- *
- * Credentials (F5). A session's MCP requests carry its run token, and the gate takes the
- * session from it: `server.sessionId` is then absent (or the token's). Core's credential
- * (`NYLORUN_GATES_TOKEN`) is accepted too, for requests made outside a run, and then
- * `server.sessionId` names the session.
- *
- * Remote MCP. The gate holds the connection and the vault credential; the loop names the
- * server, never a URL or a credential, and the gate finds it in the session's pinned manifest.
- * - `POST /nylorun/v1/mcp/connect` `{server}`: opens the server's connection (vault
- *   authorization included), or keeps the open one. Its result is `{instructions}` when the
- *   server gave instructions at `initialize` (R2b C10, for the note on its deferred tools), else
- *   `null`.
- * - `POST /nylorun/v1/mcp/list` `{server, cursor?}`: one page of `tools/list`.
- * - `POST /nylorun/v1/tool-calls` `{server, effectId, name, arguments}`: one
- *   `tools/call`. With an `Idempotency-Key` (the effect id) the call outlives its client and runs
- *   once (G3); a re-send joins it or gets its outcome.
- * - `POST /nylorun/v1/tool-calls/{key}/cancel`: aborts a keyed call; `204` either way, `403
- *   gate_forbidden` for another session's call under a run token.
- * - `POST /nylorun/v1/mcp/close` `{server}`: closes the server's connection; `204`.
- * Each answers `200 {ok: true, result}` or `200 {ok: false, error}`: an MCP failure is an
- * answer, not a gate error. A tool call's failure is coded (`error.failure`, R2b C7), and neither
- * a result nor a failure carries a credential value the gate sent (C8). An answer past 8 MiB is
- * `mcp.too-large` (C11), as an HTTP tool's is `http.too-large`; core shapes what fits into a
- * result the model can take (`tenant/tool-results.ts`). A keyed call whose
- * earlier attempt was lost with the gateway answers `{ok: false, error: {uncertain: true}}` and
- * is never run again.
- *
- * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
- * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, capabilityId, toolName}`), or a
- * flow's HTTP stage or HTTP verifier by its stage key (`{sessionId?, stage}`); the gate finds its
- * URL, method and credential in the session's pinned manifest
- * (`gates/http-tool.ts`). A run token's turn is the call's; `turnId` counts only under core's
- * credential. Keyed like a tool call, and cancelled by the same route. It answers
- * `200 {ok: true, result}` with the tool outcome (a failed request is a failed outcome the
- * model sees), or `{ok: false, error: {uncertain: true}}` for a call lost with the gateway.
- */
-import { z } from "zod";
-export const MCP_CONNECT_PATH = "/nylorun/v1/mcp/connect";
-export const MCP_LIST_PATH = "/nylorun/v1/mcp/list";
-export const MCP_CLOSE_PATH = "/nylorun/v1/mcp/close";
-export const TOOL_CALLS_PATH = "/nylorun/v1/tool-calls";
-export const HTTP_CALLS_PATH = "/nylorun/v1/http-calls";
-/** Largest tool call body the gate reads. */
-export const MAX_TOOL_BODY_BYTES = 8 * 1024 * 1024;
-export const McpServerRefSchema = z.object({
-    /** Required with core's credential; a run token names the session itself. */
-    sessionId: z.string().min(1).optional(),
-    agentId: z.string().min(1).optional(),
-    capabilityId: z.string().min(1),
-    serverName: z.string().min(1),
-});
-export const McpServerBodySchema = z.object({ server: McpServerRefSchema });
-export const McpListBodySchema = z.object({
-    server: McpServerRefSchema,
-    cursor: z.string().optional(),
-});
-export const ToolCallBodySchema = z.object({
-    server: McpServerRefSchema,
-    effectId: z.string().min(1),
-    name: z.string().min(1),
-    arguments: z.record(z.string(), z.unknown()),
-});
-export const HttpCallBodySchema = z.object({
-    tool: z.union([
-        z.object({
-            /** Required with core's credential; a run token names the session itself. */
-            sessionId: z.string().min(1).optional(),
-            agentId: z.string().min(1).optional(),
-            capabilityId: z.string().min(1),
-            toolName: z.string().min(1),
-        }),
-        z.object({
-            sessionId: z.string().min(1).optional(),
-            /** A flow's HTTP stage or HTTP verifier. */
-            stage: z.string().min(1),
-        }),
-    ]),
-    effectId: z.string().min(1),
-    turnId: z.string().min(1),
-    input: z.unknown(),
-});
+export { HTTP_CALLS_PATH, HttpCallBodySchema, MAX_TOOL_BODY_BYTES, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, McpServerRefSchema, TOOL_CALLS_PATH, ToolCallBodySchema, } from "@nylorun/core/harness-api";