@nylorun/runtime 0.23.0-beta → 0.25.0-beta

package/dist/gates/http-tool.d.ts

@@ -17,22 +17,20 @@ export type HttpOutcome = {
     readonly kind: "failed";
     readonly code: string;
     readonly message: string;
-    /** With `credential_rejected`: the tool's `credential`, and the scope of its vault. */
+    /** With `credential_rejected`: the tool's `credential`. */
     readonly server?: string;
-    readonly vault?: "installation" | "user";
     /** How many credential values the message had in it, replaced (R2b C8). */
     readonly redacted?: number;
 };
 /**
  * One declared HTTP tool of a session: what the gate finds it by in the pinned manifest. An
- * agent's HTTP tool is named by its capability and tool; a flow's HTTP stage or HTTP verifier
+ * agent's HTTP tool is named by its agent and tool name; a flow's HTTP stage or HTTP verifier
  * by its stage key.
  */
 export type HttpToolRef = {
     readonly sessionId: string;
     /** The agent used as a tool that declares it; absent for the session's root agent. */
     readonly agentId?: string;
-    readonly capabilityId: string;
     readonly toolName: string;
 } | {
     readonly sessionId: string;
@@ -45,6 +43,11 @@ export interface HttpToolCall {
     readonly effectId: string;
     readonly turnId: string;
     readonly input: unknown;
+    /**
+     * The call's span context (R7.4), sent as `traceparent`: in the gates service, from the call's
+     * journal row (`gates/journal.ts`); in process, from core's `execute` answer. Never a body field.
+     */
+    readonly traceparent?: string;
 }
 /** What `runHttpTool` reads of the Tenant: the session's pinned manifest and its credentials. */
 export interface HttpToolTenant {
@@ -53,8 +56,8 @@ export interface HttpToolTenant {
     } | undefined>;
     authorize(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
 }
-/** The HTTP tool `capabilityId`/`toolName` of the agent `agentId` (the root when absent). */
-export declare function declaredHttpTool(manifest: unknown, agentId: string | undefined, capabilityId: string | undefined, toolName: string | undefined): (ToolManifest & {
+/** The HTTP tool `toolName` of the agent `agentId` (the root when absent). */
+export declare function declaredHttpTool(manifest: unknown, agentId: string | undefined, toolName: string | undefined): (ToolManifest & {
     readonly http: HttpToolTarget;
 }) | undefined;
 /** The HTTP stage or HTTP verifier at stage key `stage` of a flow session's `manifest`. */

package/dist/gates/http-tool.js

@@ -20,15 +20,13 @@ import { MAX_RESPONSE_BYTES, post } from "../tenant/outbound.js";
 import { credentialSecrets } from "../vault/headers.js";
 /** How much of a failed answer's body the model sees. */
 export const HTTP_ERROR_BODY_CHARS = 2_000;
-/** The HTTP tool `capabilityId`/`toolName` of the agent `agentId` (the root when absent). */
-export function declaredHttpTool(manifest, agentId, capabilityId, toolName) {
+/** The HTTP tool `toolName` of the agent `agentId` (the root when absent). */
+export function declaredHttpTool(manifest, agentId, toolName) {
     const root = manifest;
-    if (!root || !Array.isArray(root.capabilities))
+    if (!root || typeof root !== "object" || isWorkflowManifest(root) || toolName === undefined)
         return undefined;
     const agent = agentId === undefined ? root : delegateManifest(root, agentId);
-    const tool = agent?.capabilities
-        .find((capability) => capability.id === capabilityId)
-        ?.tools?.find((item) => item.name === toolName);
+    const tool = agent?.tools?.find((item) => item.name === toolName);
     return tool?.http ? tool : undefined;
 }
 /** The HTTP stage or HTTP verifier at stage key `stage` of a flow session's `manifest`. */
@@ -44,18 +42,17 @@ export function declaredFlowHttp(manifest, stage) {
 export function isHttpToolCall(manifest, request) {
     if (request.kind !== "tool")
         return false;
-    if (request.capabilityId === undefined)
+    if (request.toolName === undefined)
         return declaredFlowHttp(manifest, request.key) !== undefined;
-    return declaredHttpTool(manifest, request.agent?.id, request.capabilityId, request.toolName) !== undefined;
+    return declaredHttpTool(manifest, request.agent?.id, request.toolName) !== undefined;
 }
 /** The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, or its flow stage. */
 export function httpToolRefOf(request) {
-    if (request.capabilityId === undefined)
+    if (request.toolName === undefined)
         return { sessionId: request.sessionId, stage: request.key };
     return {
         sessionId: request.sessionId,
         ...(request.agent ? { agentId: request.agent.id } : {}),
-        capabilityId: request.capabilityId,
         toolName: request.toolName,
     };
 }
@@ -138,7 +135,6 @@ export async function runHttpTool(tenant, call, options) {
         ...("stage" in tool
             ? { stage: tool.stage }
             : {
-                capability: tool.capabilityId,
                 tool: tool.toolName,
                 ...(tool.agentId === undefined ? {} : { agent: tool.agentId }),
             }),
@@ -154,7 +150,7 @@ export async function runHttpTool(tenant, call, options) {
         const agentId = "stage" in tool ? undefined : tool.agentId;
         const declared = "stage" in tool
             ? declaredFlowHttp(session.manifest, tool.stage)
-            : declaredHttpTool(session.manifest, agentId, tool.capabilityId, tool.toolName);
+            : declaredHttpTool(session.manifest, agentId, tool.toolName);
         if (!declared)
             return failed("http.undeclared", "stage" in tool
                 ? `'${tool.stage}' is not an HTTP stage of the flow`
@@ -163,7 +159,6 @@ export async function runHttpTool(tenant, call, options) {
         let credential = {};
         let identity;
         let target = http;
-        let vault;
         if (http.credential !== undefined) {
             const authorized = await tenant.authorize(tool.sessionId, {
                 url: http.url,
@@ -172,10 +167,9 @@ export async function runHttpTool(tenant, call, options) {
             if (authorized.status === "refused")
                 return failed("http.credential", `The credential '${http.credential}' was refused: ${authorized.reason}`);
             if (authorized.status === "unauthenticated")
-                return failed("http.credential", `The session's vaults hold no credential '${http.credential}' for ${authorized.url}`);
+                return failed("http.credential", `The session's Environment holds no credential '${http.credential}' for ${authorized.url}`);
             credential = authorized.headers;
             identity = authorized.identity;
-            vault = authorized.vault;
             // A credential with `via` sends the call there, a gateway (R2b C2, Q9).
             if (authorized.via !== undefined)
                 target = { ...http, url: authorized.via };
@@ -187,6 +181,7 @@ export async function runHttpTool(tenant, call, options) {
                 [TURN_ID_HEADER]: call.turnId,
                 [AGENT_ID_HEADER]: agentId ?? session.manifest.id,
                 "idempotency-key": call.effectId,
+                ...(call.traceparent ? { traceparent: call.traceparent } : {}),
             },
             policy: options.policy,
             signal: options.signal,
@@ -199,9 +194,8 @@ export async function runHttpTool(tenant, call, options) {
             return outcome;
         return {
             ...outcome,
-            message: `The service answered HTTP 401: it rejected the credential '${http.credential}' from the ${vault} vault`,
+            message: `The service answered HTTP 401: it rejected the credential '${http.credential}' from the session's Environment`,
             server: http.credential,
-            ...(vault === undefined ? {} : { vault }),
         };
     }
 }

package/dist/gates/in-process.d.ts

@@ -41,4 +41,9 @@ export declare function tenantModelGate(options: {
     /** The Tenant's Object store, for the files a prompt names. */
     readonly blobs?: BlobStore;
 }): ModelGate;
+/**
+ * Serves one call: from the fixture model while the Tenant's `model.fixture` setting is on (R4.3),
+ * else from `gate`. Read per call, so a seed applies to the next call.
+ */
+export declare function serve(store: SessionStore, gate: ModelGate, request: ModelGateRequest, signal: AbortSignal): ReturnType<ModelGate["call"]>;
 export declare function inProcessModelGate(options: InProcessModelGateOptions): ModelGate;

package/dist/gates/in-process.js

@@ -2,6 +2,8 @@ import { piModel } from "../model/pi-model.js";
 import { HostModelVault } from "../vault/host-model.js";
 import { createMeter } from "./meter.js";
 import { artifactFiles } from "../artifacts/files.js";
+import { usesFixtureModel } from "../tenant/model-setting.js";
+import { fixtureAnswer } from "./fixture-model.js";
 /**
  * The files a call names, from the Tenant's artifacts, limited to the call's session: in
  * process, the loop's own request; over HTTP, the session of the run token's claims, which the
@@ -26,9 +28,18 @@ export function tenantModelGate(options) {
     });
     const meter = createMeter({ logger: options.logger });
     return {
-        call: (request, signal) => meter.call(options.store, request, () => gate.call(request, signal)),
+        call: (request, signal) => meter.call(options.store, request, () => serve(options.store, gate, request, signal)),
     };
 }
+/**
+ * Serves one call: from the fixture model while the Tenant's `model.fixture` setting is on (R4.3),
+ * else from `gate`. Read per call, so a seed applies to the next call.
+ */
+export async function serve(store, gate, request, signal) {
+    if (await store.tx((t) => usesFixtureModel(t)))
+        return fixtureAnswer(request.call, signal);
+    return gate.call(request, signal);
+}
 export function inProcessModelGate(options) {
     return {
         async call(request, signal) {

package/dist/gates/journal.d.ts

@@ -0,0 +1,30 @@
+import type { McpServerRef } from "../mcp/pool.js";
+import type { RunClaims } from "../tenant/run-token.js";
+import { type HttpToolRef } from "./http-tool.js";
+import type { TenantVaults } from "./tenant-vaults.js";
+/** The call a run asks the gate to send, as the gate's body names it. */
+export type GateToolCall = {
+    readonly kind: "mcp";
+    readonly server: McpServerRef;
+    readonly name: string;
+    readonly arguments: Record<string, unknown>;
+} | {
+    readonly kind: "http";
+    readonly tool: HttpToolRef;
+    readonly input: unknown;
+};
+/**
+ * What the journal says of a call: why it does not hold it, or that it does, with the call's span
+ * context from the row (R7.4), which the gate sends on as `traceparent`.
+ */
+export type JournalAnswer = {
+    readonly refused: string;
+} | {
+    readonly refused?: undefined;
+    readonly traceparent?: string;
+};
+export interface JournalCheck {
+    /** Whether the journal holds `call` under `key` for the run `claims` names. */
+    check(tenantId: string | undefined, claims: RunClaims, key: string, call: GateToolCall): Promise<JournalAnswer>;
+}
+export declare function journalCheck(vaults: TenantVaults): JournalCheck;

package/dist/gates/journal.js

@@ -0,0 +1,51 @@
+import { mcpToolOf } from "../mcp/snapshot.js";
+import { canonical } from "../store/canonical.js";
+import { httpToolRefOf } from "./http-tool.js";
+export function journalCheck(vaults) {
+    return {
+        async check(tenantId, claims, key, call) {
+            const store = (await vaults.open(tenantId)).store;
+            const refusal = await store.tx(async (t) => {
+                const row = await t.get("effects", key);
+                if (!row)
+                    return `No journaled call has the effect id '${key}'`;
+                const request = row.request;
+                if (request.kind !== "tool" ||
+                    request.sessionId !== claims.sessionId ||
+                    request.turnId !== claims.turnId)
+                    return `Effect '${key}' is not a tool call of this run's turn`;
+                if (row.status !== "invoking")
+                    return `Effect '${key}' is not running: it is ${row.status}`;
+                if (call.kind === "http") {
+                    const { sessionId: _journaled, ...expected } = httpToolRefOf(request);
+                    const { sessionId: _named, ...named } = call.tool;
+                    if (canonical(expected) !== canonical(named))
+                        return `Effect '${key}' calls another tool`;
+                    if (canonical(request.input ?? null) !== canonical(call.input ?? null))
+                        return `Effect '${key}' was journaled with other input`;
+                    return held(row);
+                }
+                const session = await t.get("sessions", request.sessionId);
+                const tool = mcpToolOf(session?.mcpSnapshot, request);
+                if (!tool ||
+                    tool.serverName !== call.server.serverName ||
+                    (tool.agentId ?? null) !== (call.server.agentId ?? null) ||
+                    tool.serverToolName !== call.name)
+                    return `Effect '${key}' calls another tool`;
+                if (canonical(argumentsOf(request.input)) !== canonical(call.arguments))
+                    return `Effect '${key}' was journaled with other input`;
+                return held(row);
+            });
+            return typeof refusal === "string" ? { refused: refusal } : refusal;
+        },
+    };
+}
+/** A journaled call: its span context, when core recorded one (R7.4). */
+function held(row) {
+    const traceparent = row.traceparent;
+    return typeof traceparent === "string" ? { traceparent } : {};
+}
+/** A tool call's input as `tools/call` arguments (`callMcpTool`): an object, else none. */
+function argumentsOf(input) {
+    return input && typeof input === "object" && !Array.isArray(input) ? input : {};
+}

package/dist/gates/mcp-handler.d.ts

@@ -29,6 +29,10 @@ export interface McpHandler {
         effectId: string;
         name: string;
         arguments: Record<string, unknown>;
+        /** The call's `Idempotency-Key`, sent to the server in `_meta` (R5.5). */
+        key?: string;
+        /** The call's span context from its journal row (R7.4), sent as `traceparent`. */
+        traceparent?: string;
     }, signal: AbortSignal): Promise<McpAnswer<Record<string, unknown>>>;
     close(server: McpServerRef): Promise<void>;
     /** Closes connections idle past the timeout. */

package/dist/gates/mcp-handler.js

@@ -13,13 +13,13 @@ export function createMcpHandler(options) {
     const open = options.open ?? openMcpServer;
     const live = new Map();
     const opening = new Map();
-    const keyOf = (server) => JSON.stringify([server.sessionId, server.agentId ?? null, server.capabilityId, server.serverName]);
+    const keyOf = (server) => JSON.stringify([server.sessionId, server.agentId ?? null, server.serverName]);
     /** The declared remote server, from the session's pinned manifest. */
     async function declared(vault, server) {
         const session = await vault.session(server.sessionId);
         if (!session)
             throw new NotDeclared(`Session ${server.sessionId} not found`);
-        const found = findServer(session.manifest, server.agentId, server.capabilityId, server.serverName);
+        const found = findServer(session.manifest, server.agentId, server.serverName);
         if (!found)
             throw new NotDeclared(`MCP server '${server.serverName}' is not declared`);
         return found.server;
@@ -114,7 +114,11 @@ export function createMcpHandler(options) {
     async function callOnce(tenantId, request, signal) {
         for (let attempt = 0;; attempt += 1) {
             try {
-                return await use(tenantId, request.server, (entry) => entry.connection.client.callTool({ name: request.name, arguments: request.arguments }, { signal }), true);
+                return await use(tenantId, request.server, (entry) => entry.connection.client.callTool({ name: request.name, arguments: request.arguments }, {
+                    signal,
+                    ...(request.key === undefined ? {} : { key: request.key }),
+                    ...(request.traceparent === undefined ? {} : { traceparent: request.traceparent }),
+                }), true);
             }
             catch (error) {
                 if (!(error instanceof McpConnectionStale) || attempt > 0)
@@ -170,7 +174,6 @@ export function createMcpHandler(options) {
 function fields(server) {
     return {
         session: server.sessionId,
-        capability: server.capabilityId,
         server: server.serverName,
         ...(server.agentId === undefined ? {} : { agent: server.agentId }),
     };

package/dist/gates/meter.d.ts

@@ -13,8 +13,16 @@ export interface MeterOptions {
     readonly now?: () => Date;
 }
 export declare function createMeter(options: MeterOptions): Meter;
-/** The ledger row of an outcome that carries usage; undefined for a failure. */
-export declare function usageRow(request: ModelGateRequest, outcome: ModelGateOutcome, at: Date): ModelUsageWrite | undefined;
+/** When the gate sent a call and when its answer was complete (R7.1). */
+export interface CallTiming {
+    readonly startedAt: Date;
+    readonly endedAt: Date;
+}
+/**
+ * The ledger row of an outcome that carries usage; undefined for a failure. With `timing`, the
+ * row keeps the gate's start and end of the call, and the adapter's `firstTokenMs`.
+ */
+export declare function usageRow(request: ModelGateRequest, outcome: ModelGateOutcome, at: Date, timing?: CallTiming): ModelUsageWrite | undefined;
 /**
  * Why the budget refuses another call, or undefined. Calls in flight count at the scope's
  * average cost per recorded call.

package/dist/gates/meter.js

@@ -8,6 +8,10 @@
  * the scope at the scope's average cost per call, reaches its limit. Calls in a turn run one
  * at a time, so a scope overspends by at most one call per concurrent call. The refusal is a
  * `budget_exhausted` failure, which the turn does not retry.
+ *
+ * The row also keeps the gate's own timing of the call (R7.1): `now()` before the call and
+ * after it, and the adapter's `firstTokenMs` (`evidence.extras`), so a model call's span is
+ * what the gate measured.
  */
 import { randomUUID } from "node:crypto";
 import { failure } from "../model/classify.js";
@@ -60,8 +64,9 @@ export function createMeter(options) {
             for (const key of keys)
                 inflight.set(key, (inflight.get(key) ?? 0) + 1);
             try {
+                const startedAt = now();
                 const outcome = await call();
-                await record(store, request, outcome);
+                await record(store, request, outcome, { startedAt, endedAt: now() });
                 return outcome;
             }
             finally {
@@ -75,8 +80,8 @@ export function createMeter(options) {
             }
         },
     };
-    async function record(store, request, outcome) {
-        const row = usageRow(request, outcome, now());
+    async function record(store, request, outcome, timing) {
+        const row = usageRow(request, outcome, timing.endedAt, timing);
         if (!row)
             return;
         try {
@@ -96,11 +101,15 @@ export function createMeter(options) {
         }
     }
 }
-/** The ledger row of an outcome that carries usage; undefined for a failure. */
-export function usageRow(request, outcome, at) {
+/**
+ * The ledger row of an outcome that carries usage; undefined for a failure. With `timing`, the
+ * row keeps the gate's start and end of the call, and the adapter's `firstTokenMs`.
+ */
+export function usageRow(request, outcome, at, timing) {
     if (typeof outcome !== "object" || "kind" in outcome || !outcome.usage)
         return undefined;
     const usage = outcome.usage;
+    const firstTokenMs = outcome.evidence?.extras?.firstTokenMs;
     const producer = producerOf(outcome);
     const inputTokens = count(usage.inputTokens);
     const outputTokens = count(usage.outputTokens);
@@ -126,6 +135,12 @@ export function usageRow(request, outcome, at) {
         reasoningTokens: count(usage.reasoningTokens),
         costUsd: Number.isFinite(usage.costUsd) && usage.costUsd > 0 ? usage.costUsd : 0,
         createdAt: at.toISOString(),
+        ...(timing
+            ? { startedAt: timing.startedAt.toISOString(), endedAt: timing.endedAt.toISOString() }
+            : {}),
+        ...(typeof firstTokenMs === "number" && Number.isFinite(firstTokenMs) && firstTokenMs >= 0
+            ? { firstTokenMs: Math.round(firstTokenMs) }
+            : {}),
     };
 }
 /** The ledger rows a budget counts for `request`; undefined when it doesn't apply. */

package/dist/gates/policy.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Tool policy (R5 step 2). Every MCP and HTTP tool call of every harness is decided as core
+ * journals it (`harness-api/record.ts`), which each harness must do before it sends a call:
+ * `deny` fails it to the model as `tool.denied`, unsent; `ask` holds the row until a person
+ * approves it on the session; `allow` runs it. The Tool Gate sends only a call the journal holds
+ * running (`journal.ts`), so a held or refused call cannot run, whichever harness asks.
+ *
+ * The rules are the Tenant's (`PUT /v1/tenant/tool-policy`, the `tool-policy` setting). A rule
+ * matches a call when every selector it sets matches; the strictest matching rule decides
+ * (`deny`, then `ask`, then `allow`), and a call no rule matches runs. A session pinned to a
+ * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
+ * the approval it was opened with. A policy that cannot be read refuses every call.
+ */
+import { type ToolPolicy, type ToolRule } from "@nylorun/core/contracts";
+import type { AgentManifest } from "@nylorun/core/define";
+import type { HostEffect } from "@nylorun/harness/run";
+import { type McpSnapshot } from "../mcp/snapshot.js";
+import type { Tx } from "../store/types.js";
+import type { Session } from "../tenant/context.js";
+/** The `tenant_settings` key the policy is kept under. */
+export declare const TOOL_POLICY_SETTING = "tool-policy";
+/** A call as the policy reads it. */
+export interface PolicyCall {
+    readonly kind: "mcp" | "http";
+    /** The name the model calls the tool by; a flow stage's key. */
+    readonly tool: string;
+    /** The MCP server's name. */
+    readonly server?: string;
+    /** The agent that calls it. */
+    readonly agent: string;
+    readonly input: unknown;
+}
+export type PolicyDecision = {
+    readonly effect: "allow";
+} | {
+    readonly effect: "ask" | "deny";
+    readonly reason: string;
+};
+/** The Tenant's policy; an empty one when none was set. Throws when it cannot be read. */
+export declare function readToolPolicy(t: Pick<Tx, "getSetting">): Promise<ToolPolicy>;
+/**
+ * The decision for `request`, a session's MCP or HTTP tool call: the Tenant's rules and the
+ * pinned manifest's `approval`. A policy that cannot be read refuses the call.
+ */
+export declare function toolCallDecision(t: Pick<Tx, "getSetting">, s: Session, request: HostEffect, kind: "mcp" | "http"): Promise<PolicyDecision>;
+/** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */
+export declare function decide(rules: readonly ToolRule[], call: PolicyCall, pinnedAsk?: boolean): PolicyDecision;
+/** The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2. */
+export declare function pinnedApproval(manifest: AgentManifest, snapshot: McpSnapshot | undefined, request: HostEffect): boolean;

package/dist/gates/policy.js

@@ -0,0 +1,132 @@
+/**
+ * Tool policy (R5 step 2). Every MCP and HTTP tool call of every harness is decided as core
+ * journals it (`harness-api/record.ts`), which each harness must do before it sends a call:
+ * `deny` fails it to the model as `tool.denied`, unsent; `ask` holds the row until a person
+ * approves it on the session; `allow` runs it. The Tool Gate sends only a call the journal holds
+ * running (`journal.ts`), so a held or refused call cannot run, whichever harness asks.
+ *
+ * The rules are the Tenant's (`PUT /v1/tenant/tool-policy`, the `tool-policy` setting). A rule
+ * matches a call when every selector it sets matches; the strictest matching rule decides
+ * (`deny`, then `ask`, then `allow`), and a call no rule matches runs. A session pinned to a
+ * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
+ * the approval it was opened with. A policy that cannot be read refuses every call.
+ */
+import { ToolPolicySchema } from "@nylorun/core/contracts";
+import { mcpToolOf, mcpToolSettingsIn } from "../mcp/snapshot.js";
+import { canonical } from "../store/canonical.js";
+import { turnManifestOf } from "../tenant/session.js";
+import { declaredHttpTool } from "./http-tool.js";
+/** The `tenant_settings` key the policy is kept under. */
+export const TOOL_POLICY_SETTING = "tool-policy";
+const STRICTNESS = { allow: 0, ask: 1, deny: 2 };
+/** The Tenant's policy; an empty one when none was set. Throws when it cannot be read. */
+export async function readToolPolicy(t) {
+    const raw = await t.getSetting(TOOL_POLICY_SETTING);
+    if (raw === undefined)
+        return { rules: [], updatedAt: null };
+    return ToolPolicySchema.parse(JSON.parse(raw));
+}
+/**
+ * The decision for `request`, a session's MCP or HTTP tool call: the Tenant's rules and the
+ * pinned manifest's `approval`. A policy that cannot be read refuses the call.
+ */
+export async function toolCallDecision(t, s, request, kind) {
+    let rules;
+    try {
+        rules = (await readToolPolicy(t)).rules;
+    }
+    catch {
+        return { effect: "deny", reason: "The Tenant's tool policy could not be read, so no tool call runs" };
+    }
+    const mcp = mcpToolOf(s.mcpSnapshot, request);
+    return decide(rules, {
+        kind,
+        tool: request.toolName ?? request.key ?? request.effectId,
+        ...(mcp ? { server: mcp.serverName } : {}),
+        agent: request.agent?.id ?? s.agentId,
+        input: request.input,
+    }, pinnedApproval(turnManifestOf(s), s.mcpSnapshot, request));
+}
+/** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */
+export function decide(rules, call, pinnedAsk = false) {
+    let strictest = pinnedAsk
+        ? { effect: "ask", reason: `The agent's manifest asks for approval of '${call.tool}'` }
+        : undefined;
+    for (const rule of rules) {
+        if (!matches(rule, call))
+            continue;
+        if (strictest && STRICTNESS[rule.effect] <= STRICTNESS[strictest.effect])
+            continue;
+        strictest = { effect: rule.effect, reason: rule.reason ?? describe(rule) };
+    }
+    if (!strictest || strictest.effect === "allow")
+        return { effect: "allow" };
+    return { effect: strictest.effect, reason: strictest.reason };
+}
+/** The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2. */
+export function pinnedApproval(manifest, snapshot, request) {
+    const mcp = mcpToolOf(snapshot, request);
+    if (mcp)
+        return mcpToolSettingsIn(manifest, mcp).approval === "always";
+    return declaredHttpTool(manifest, request.agent?.id, request.toolName)?.approval === "always";
+}
+function matches(rule, call) {
+    if (rule.kind !== undefined && rule.kind !== call.kind)
+        return false;
+    if (rule.tool !== undefined && !glob(rule.tool).test(call.tool))
+        return false;
+    if (rule.server !== undefined && (call.server === undefined || !glob(rule.server).test(call.server)))
+        return false;
+    if (rule.agent !== undefined && !glob(rule.agent).test(call.agent))
+        return false;
+    for (const [path, condition] of Object.entries(rule.when ?? {}))
+        if (!holds(condition, fieldOf(call.input, path)))
+            return false;
+    return true;
+}
+/** A pattern where `*` is any run of characters, matched whole. */
+function glob(pattern) {
+    return new RegExp(`^${pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`);
+}
+/** The value at a dotted `path` of `input`, or undefined. */
+function fieldOf(input, path) {
+    let value = input;
+    for (const key of path.split(".")) {
+        if (!value || typeof value !== "object")
+            return undefined;
+        value = value[key];
+    }
+    return value;
+}
+function holds(condition, value) {
+    if (value === undefined)
+        return false;
+    if (condition.equals !== undefined && canonical(value) !== canonical(condition.equals))
+        return false;
+    if (condition.in !== undefined && !condition.in.some((item) => canonical(item) === canonical(value)))
+        return false;
+    const number = typeof value === "number" ? value : undefined;
+    if (condition.gt !== undefined && !(number !== undefined && number > condition.gt))
+        return false;
+    if (condition.gte !== undefined && !(number !== undefined && number >= condition.gte))
+        return false;
+    if (condition.lt !== undefined && !(number !== undefined && number < condition.lt))
+        return false;
+    if (condition.lte !== undefined && !(number !== undefined && number <= condition.lte))
+        return false;
+    if (condition.matches !== undefined && !(typeof value === "string" && new RegExp(condition.matches).test(value)))
+        return false;
+    return true;
+}
+/** What a rule with no `reason` says. */
+function describe(rule) {
+    const what = [
+        rule.tool === undefined ? undefined : `tool '${rule.tool}'`,
+        rule.server === undefined ? undefined : `server '${rule.server}'`,
+        rule.kind === undefined ? undefined : `${rule.kind} tools`,
+        rule.agent === undefined ? undefined : `agent '${rule.agent}'`,
+        rule.when === undefined ? undefined : `input ${Object.keys(rule.when).join(", ")}`,
+    ].filter((part) => part !== undefined);
+    const verb = rule.effect === "deny" ? "refuses" : "asks a person about";
+    return `The Tenant's tool policy ${verb} ${what.length === 0 ? "every tool call" : `calls of ${what.join(", ")}`}`;
+}

package/dist/gates/tenant-vaults.d.ts

@@ -29,15 +29,15 @@ export interface TenantVault {
     session(sessionId: string): Promise<Session | undefined>;
     /**
      * The authorization of one request to a session's remote MCP server or HTTP tool: its
-     * credential from the session's attached vaults.
+     * credential from the vault of the session's Environment.
      */
     authorizeMcp(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
     /** Vault writes and token signing with the Tenant's vault key (the keys service, F4.2). */
     keys(): Keys;
-    /** Whether a live session on the sandbox has an `environment_secret` bound to `host` (R2c). */
-    environmentSecretBound(sandboxId: string, host: string): Promise<boolean>;
+    /** Whether the Environment's vault has an `environment_secret` bound to `host` (R2c). */
+    environmentSecretBound(environmentId: string, host: string): Promise<boolean>;
     /** The header an `environment_secret` sets on one request to `host` (R2c). */
-    releaseEnvironmentSecret(sandboxId: string, host: string): ReturnType<VaultService["releaseEnvironmentSecret"]>;
+    releaseEnvironmentSecret(environmentId: string, host: string): ReturnType<VaultService["releaseEnvironmentSecret"]>;
 }
 export interface TenantVaults {
     /**
@@ -60,8 +60,8 @@ export interface TenantVaultsOptions {
 }
 export declare function createTenantVaults(options: TenantVaultsOptions): TenantVaults;
 /**
- * A request to a session's remote MCP server, authorized from the session's attached vaults:
- * what the loop does in its own process (`tenant/effects.ts` `authorize`). The vaults come from
- * the session row.
+ * A request to a session's remote MCP server, authorized from its Environment's vault: what the
+ * loop does in its own process (`tenant/effects.ts` `authorize`). The Environment comes from the
+ * session row.
  */
 export declare function authorizeSessionMcp(vault: Pick<VaultService, "authorize">, session: (sessionId: string) => Promise<Session | undefined>, sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;

package/dist/gates/tenant-vaults.js

@@ -52,8 +52,8 @@ export function createTenantVaults(options) {
             session,
             authorizeMcp: (sessionId, request) => authorizeSessionMcp(credentials, session, sessionId, request),
             keys: () => keys,
-            environmentSecretBound: (sandboxId, host) => credentials.environmentSecretBound(sandboxId, host),
-            releaseEnvironmentSecret: (sandboxId, host) => credentials.releaseEnvironmentSecret({ sandboxId, host }),
+            environmentSecretBound: (environmentId, host) => credentials.environmentSecretBound(environmentId, host),
+            releaseEnvironmentSecret: (environmentId, host) => credentials.releaseEnvironmentSecret({ environmentId, host }),
         };
     }
     /** The database's Tenant, once its schema is at this build's version. */
@@ -81,9 +81,9 @@ export function createTenantVaults(options) {
     };
 }
 /**
- * A request to a session's remote MCP server, authorized from the session's attached vaults:
- * what the loop does in its own process (`tenant/effects.ts` `authorize`). The vaults come from
- * the session row.
+ * A request to a session's remote MCP server, authorized from its Environment's vault: what the
+ * loop does in its own process (`tenant/effects.ts` `authorize`). The Environment comes from the
+ * session row.
  */
 export async function authorizeSessionMcp(vault, session, sessionId, request) {
     const found = await session(sessionId);