@nylorun/runtime 0.23.0-beta → 0.25.0-beta

package/dist/harness-api/record.d.ts

@@ -11,8 +11,15 @@
  *
  * Rows store the request's hash (`requestHash`) and, for a model call, the request without its
  * prompt: drift is a hash compare. Rows written before carry their full request, hashed on read.
+ *
+ * Every row a run journals keeps when it was journaled (`startedAt`, R7.1), and a rejoin keeps
+ * it: an outcome's `durationMs` is the journal's window, from the intent to the outcome. A model
+ * call's outcome event also carries what the meter recorded for it (`modelOutcomeFacts`). A tool
+ * row keeps its span's context (`traceparent`, R7.4), which the `execute` answer carries to the
+ * harness and the Tool Gate reads with the row.
  */
 import { type EffectIntent, type IntentAnswer, type OutcomeAnswer, type RecordedOutcome } from "@nylorun/core/harness-api";
+import type { EventWriter } from "@nylorun/core/contracts";
 import { type Lease, type Session, type TenantContext } from "../tenant/context.js";
 import type { Tx } from "../store/types.js";
 /** What a run's journal writes are scoped by: the advance's lease and its signal. */
@@ -20,6 +27,13 @@ export interface RecordScope {
     readonly ctx: TenantContext;
     readonly lease: Lease;
     readonly signal: AbortSignal;
+    /** The tools the run's harness declared it runs itself (`hello` `features.tools`, R4.2), by name. */
+    readonly nativeTools?: ReadonlySet<string>;
+    /**
+     * Who reported what this scope records (R4.9): the run's harness, so the events derived from
+     * its intents and outcomes are its claim. Absent, core recorded what it saw itself.
+     */
+    readonly writer?: EventWriter;
 }
 /** The hash a journal row's request was recorded with. */
 export declare function hashOf(row: {
@@ -41,7 +55,7 @@ export declare function recordIntent(scope: RecordScope, effect: EffectIntent, r
  * `error` that left it uncertain. Only a cancel discards an outcome in hand (§10.7): after any
  * other abort (shutdown, deadline) it is recorded, so the next advance replays it.
  */
-export declare function recordOutcome(scope: RecordScope, effectId: string, result: {
+export declare function recordOutcome(scope: RecordScope, effectId: string, reported: {
     value: unknown;
 } | {
     error: string;

package/dist/harness-api/record.js

@@ -11,10 +11,16 @@
  *
  * Rows store the request's hash (`requestHash`) and, for a model call, the request without its
  * prompt: drift is a hash compare. Rows written before carry their full request, hashed on read.
+ *
+ * Every row a run journals keeps when it was journaled (`startedAt`, R7.1), and a rejoin keeps
+ * it: an outcome's `durationMs` is the journal's window, from the intent to the outcome. A model
+ * call's outcome event also carries what the meter recorded for it (`modelOutcomeFacts`). A tool
+ * row keeps its span's context (`traceparent`, R7.4), which the `execute` answer carries to the
+ * harness and the Tool Gate reads with the row.
  */
-import { HarnessApiError, effectRequestHash, } from "@nylorun/core/harness-api";
+import { HarnessApiError, effectRequestHash, isEffectIdOf, } from "@nylorun/core/harness-api";
 import { isFlowEffect, isFlowToolEffect, recordVerdict, settleAgentEffect, } from "../core/flow-host.js";
-import { sandboxCapabilityOf } from "../sandbox/capability.js";
+import { sandboxToolSpec } from "../sandbox/runtime-tools.js";
 import { abortOn, isReadArtifactCall, isSaveArtifactCall } from "../harness/calls.js";
 import { callReadArtifact, callSaveArtifact } from "../tenant/artifact-tool.js";
 import { mayNeedShaping, resultBytes, resultLimit, shapeToolOutcome, } from "../tenant/tool-results.js";
@@ -26,8 +32,13 @@ import { manifestFor, mcpToolOf } from "../mcp/snapshot.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
 import { ownedSession } from "../tenant/context.js";
 import { isGateToolEffect, linkedOutcome, recoversModelCalls, recoversToolCalls, resolveNewFlowEffect, } from "../tenant/effects.js";
-import { assistantMessage, contextCompacted, modelFailed, toolCompleted, } from "../tenant/transcript.js";
+import { assistantMessage, contextCompacted, modelFailed, modelOutcomeFacts, } from "../tenant/transcript.js";
 import { abortKind } from "../tenant/worker.js";
+import { redactTokens } from "./redact.js";
+import { toolCallDecision } from "../gates/policy.js";
+import { traceKey } from "../traces/key.js";
+import { effectSpanOf, traceparentOf, turnTraceIdOf } from "../traces/ids.js";
+import { MAX_TOOL_ATTEMPTS, firstSend, interrupted, settleToolRow, toolKindOf, } from "./tool-journal.js";
 const TURN_CANCELLED = () => new HarnessApiError("turn_cancelled", "Turn cancelled");
 /** The hash a journal row's request was recorded with. */
 export function hashOf(row) {
@@ -35,10 +46,9 @@ export function hashOf(row) {
 }
 /** The completed outcomes of a segment, which a run replays without asking. */
 export async function bulkOutcomes(t, session, checkpoint) {
-    const prefix = `${checkpoint.turnId}:${checkpoint.segment}:`;
     const rows = await t.effectsForTurn(session.id, checkpoint.turnId, ["completed"]);
     return rows
-        .filter((row) => row.request.effectId.startsWith(prefix) && row.outcome)
+        .filter((row) => isEffectIdOf(row.request.effectId, checkpoint.turnId, checkpoint.segment) && row.outcome)
         .map((row) => ({ effectId: row.request.effectId, requestHash: hashOf(row), outcome: row.outcome }));
 }
 /**
@@ -48,10 +58,14 @@ export async function bulkOutcomes(t, session, checkpoint) {
 export async function recordIntent(scope, effect, requestHash) {
     const { ctx, lease, signal } = scope;
     const request = effect;
+    // Read before the transaction: the first read of the Tenant may create the key.
+    const key = await traceKey(ctx.store);
     const answer = await ctx.store.tx(async (t) => {
         const s = await ownedSession(t, lease, request.sessionId);
         if (s.status === "cancelled" || s.activeTurnId !== request.turnId)
             throw TURN_CANCELLED();
+        // A tool call's span context (R7.4), kept on its row.
+        const traced = () => ({ traceparent: toolTraceparent(key, ctx.store.tenantId, s, request) });
         // An aborted advance starts no effect; the advance decides what the abort means.
         signal.throwIfAborted();
         const existing = await t.get("effects", request.effectId);
@@ -61,12 +75,12 @@ export async function recordIntent(scope, effect, requestHash) {
             if (existing.status === "completed")
                 return { status: "completed", outcome: existing.outcome };
             // A call its previous owner left running at the gate: re-send it, same key and request,
-            // to join it or collect its outcome (P1.2 for model calls, F4.1 for remote MCP and HTTP
-            // tool calls).
+            // to join it or collect its outcome (P1.2).
             if (existing.status === "invoking" && request.kind === "model" && recoversModelCalls(ctx))
                 return { status: "execute", rejoin: true };
-            if (existing.status === "invoking" && recoversToolCalls(ctx) && isGateToolEffect(s, existing.request))
-                return { status: "execute", rejoin: true };
+            // A tool call a crash, a shutdown or a lost gate hop interrupted (R5.3, R5.4).
+            if (existing.status === "invoking" && existing.request.kind === "tool")
+                return resend(t, s, existing, recoversToolCalls(ctx));
             if (request.kind === "agent" && existing.status === "pending" && existing.agentSessionId) {
                 const agent = await t.get("sessions", existing.agentSessionId);
                 const outcome = await linkedOutcome(t, existing, agent);
@@ -86,26 +100,38 @@ export async function recordIntent(scope, effect, requestHash) {
         if (request.kind !== "model" && effectRequestHash(request) !== requestHash)
             throw new HarnessApiError("invalid", "The request hash does not match the request");
         if (flowHttp) {
-            await t.put("effects", request.effectId, { request, requestHash, status: "invoking" });
+            const row = { request, requestHash, status: "invoking", ...firstSend({ toolKind: "http" }), ...traced() };
             await t.event(s.id, s.activeTurnId, "node.started", {
                 path: request.path,
                 kind: "http",
                 key: request.key,
                 ...(request.iterations !== undefined ? { iterations: request.iterations } : {}),
-            });
-            return { status: "execute" };
+            }, scope.writer);
+            const decided = await bypolicy(t, s, row, "http");
+            if (decided)
+                return decided;
+            await t.put("effects", request.effectId, row);
+            return { status: "execute", traceparent: row.traceparent };
         }
         if (request.kind === "delegation") {
             // Lifecycle points of an agent used as a tool: journaled once, so replays never re-emit.
             const outcome = { value: null };
-            await t.put("effects", request.effectId, { request, requestHash, status: "completed", outcome });
+            const at = new Date().toISOString();
+            await t.put("effects", request.effectId, {
+                request,
+                requestHash,
+                status: "completed",
+                outcome,
+                startedAt: at,
+                settledAt: at,
+            });
             const settled = request.effectId.endsWith(":settled");
             const callId = request.context?.callId;
             await t.event(s.id, s.activeTurnId, settled ? "delegation.completed" : "delegation.started", {
                 agent: request.agent,
                 ...(typeof callId === "string" ? { callId } : {}),
                 ...request.input,
-            });
+            }, scope.writer);
             return { status: "completed", outcome };
         }
         const agentManifest = manifestFor(s.manifest, request.agent);
@@ -117,33 +143,50 @@ export async function recordIntent(scope, effect, requestHash) {
                 (mcpToolOf(s.mcpSnapshot, request, turnManifestOf(s)) !== undefined ||
                     // HTTP tools (R2 M3) cross the Tool Gate.
                     isHttpToolCall(s.manifest, request) ||
-                    sandboxCapabilityOf(agentManifest, request.capabilityId, request.toolName) !== undefined ||
+                    sandboxToolSpec(agentManifest, request.toolName) !== undefined ||
                     // `save_artifact` (F8.1) runs beside the sandbox tools, as do `read_artifact` (R2b
                     // C11) and the skill tools (R2 M4).
                     isSaveArtifactCall(agentManifest, request) ||
                     isReadArtifactCall(agentManifest, request) ||
                     isSkillToolCall(agentManifest, request) ||
                     // `tool_search` (R2b C10) reads the session's pinned MCP snapshot: core serves it.
-                    isToolSearchCall(agentManifest, request)));
+                    isToolSearchCall(s.mcpSnapshot, request) ||
+                    // A tool the run's harness declared and runs itself (R4.2, Q3), by its name: the turn
+                    // refuses a native tool whose name another tool of the agent's has (`harness-api/server.ts`).
+                    (request.toolName !== undefined && scope.nativeTools?.has(request.toolName) === true)));
         if (!executed) {
             // A tool that would run the developer's code: refused at save (a turn's manifest only
             // removes tools), so this is a backstop, as is an MCP tool the turn disabled, which the
             // model was never offered. The model sees the failure; nothing runs.
             const disabled = request.kind === "tool" && mcpToolOf(s.mcpSnapshot, request) !== undefined;
-            const outcome = { value: disabled ? disabledTool(request) : unrunnableTool(request) };
-            await t.put("effects", request.effectId, { request, requestHash, status: "completed", outcome });
-            const transcript = toolCompleted(request, outcome.value);
-            if (transcript)
-                await t.event(s.id, request.turnId, "tool.completed", transcript);
+            const row = {
+                request,
+                requestHash,
+                status: "invoking",
+                ...toolKindOf(s, agentManifest, request, scope.nativeTools),
+                attempts: 0,
+            };
+            const outcome = await settleToolRow(t, s, row, disabled ? disabledTool(request) : unrunnableTool(request), { writer: coreIn(scope) });
             return { status: "completed", outcome };
         }
-        await t.put("effects", request.effectId, {
+        const row = {
+            // A model row keeps no prompt; a tool row its whole request.
             request: storedRequest(request),
             requestHash,
             status: "invoking",
-        });
+            ...(request.kind === "tool"
+                ? { ...firstSend(toolKindOf(s, agentManifest, request, scope.nativeTools)), ...traced() }
+                : { startedAt: new Date().toISOString() }),
+        };
+        // The Tenant's tool policy decides an MCP or HTTP tool call as it is journaled (R5 step 2).
+        if (row.toolKind === "mcp" || row.toolKind === "http") {
+            const decided = await bypolicy(t, s, row, row.toolKind);
+            if (decided)
+                return decided;
+        }
+        await t.put("effects", request.effectId, row);
         // `save_artifact` writes the Tenant's artifacts: core runs it, reading the file through the
-        // workspace capability, wherever the sandbox is.
+        // workspace feature, wherever the sandbox is.
         if (request.kind === "tool" && isSaveArtifactCall(agentManifest, request))
             return "save";
         // `read_artifact` reads the session's artifacts: core serves it, with or without a sandbox.
@@ -152,9 +195,9 @@ export async function recordIntent(scope, effect, requestHash) {
         // The skill tools read the agent's definition files: core serves them.
         if (isSkillToolCall(agentManifest, request))
             return { skill: agentManifest };
-        if (isToolSearchCall(agentManifest, request))
+        if (isToolSearchCall(s.mcpSnapshot, request))
             return "search";
-        return { status: "execute" };
+        return { status: "execute", ...(row.traceparent ? { traceparent: row.traceparent } : {}) };
     });
     if (answer === "save")
         return runInCore(scope, request, () => callSaveArtifact(scope.ctx, request, scope.signal));
@@ -177,6 +220,9 @@ export async function recordIntent(scope, effect, requestHash) {
  * the outcome as the intent's answer.
  */
 async function runInCore(scope, request, call) {
+    // Core ran the call: its outcome is what core saw, not the harness's claim (R4.9).
+    const writer = coreIn(scope);
+    const core = { ctx: scope.ctx, lease: scope.lease, signal: scope.signal, ...(writer ? { writer } : {}) };
     let value;
     try {
         value = await call();
@@ -184,11 +230,70 @@ async function runInCore(scope, request, call) {
     catch (error) {
         if (isOwnershipLost(error))
             throw error;
-        return recordOutcome(scope, request.effectId, {
+        return recordOutcome(core, request.effectId, {
             error: error instanceof Error ? error.message : String(error),
         });
     }
-    return recordOutcome(scope, request.effectId, { value });
+    return recordOutcome(core, request.effectId, { value });
+}
+/** Core's own write during the scope's run (R4.9): core saw it, in that run. */
+function coreIn(scope) {
+    const runId = scope.writer?.runId;
+    return runId === undefined ? undefined : { source: { kind: "core", id: "runtime" }, runId };
+}
+/**
+ * The answer to a tool row still `invoking` (R5.3, R5.4): a crash, a shutdown or a lost gate
+ * hop interrupted its send. An MCP or HTTP call (it crosses the Tool Gate, which hands the tool
+ * its key) is sent again, one more attempt, until `MAX_TOOL_ATTEMPTS`; then it fails to the
+ * model. Any other call (sandbox, core-served) has no key to dedupe on: it fails to the model
+ * now, and is not run again (Q2).
+ */
+async function resend(t, s, row, rejoin) {
+    if (!isGateToolEffect(s, row.request)) {
+        const outcome = await settleToolRow(t, s, row, interrupted("A crash interrupted this call before its outcome was recorded. It may have run; it is not run again."));
+        return { status: "completed", outcome };
+    }
+    const attempts = (row.attempts ?? 1) + 1;
+    if (attempts > MAX_TOOL_ATTEMPTS) {
+        const outcome = await settleToolRow(t, s, row, interrupted(`The call was interrupted ${MAX_TOOL_ATTEMPTS} times and may have run.`));
+        return { status: "completed", outcome };
+    }
+    row.attempts = attempts;
+    await t.put("effects", row.request.effectId, row);
+    const traced = row.traceparent ? { traceparent: row.traceparent } : {};
+    return rejoin ? { status: "execute", rejoin: true, ...traced } : { status: "execute", ...traced };
+}
+/** The span context of tool call `request` (R7.4): its turn's trace, and its own span. */
+function toolTraceparent(key, tenantId, s, request) {
+    const traceId = turnTraceIdOf(key, { tenantId, sessionId: s.id, turnId: request.turnId }, s.turnTrace);
+    return traceparentOf(traceId, effectSpanOf(key, request.effectId));
+}
+/**
+ * The Tenant's tool policy on a tool call being journaled (R5 step 2, `gates/policy.ts`), or
+ * undefined when it runs. `deny`: the call fails to the model as `tool.denied`, unsent. `ask`:
+ * the row waits as `held` and the effect is pending; the segment ends waiting, the turn pauses,
+ * and `approve` answers it (`tenant/commands.ts`). The Tool Gate refuses a row not `invoking`, so
+ * neither runs whichever harness sends it. Writes `row`.
+ */
+async function bypolicy(t, s, row, kind) {
+    const decision = await toolCallDecision(t, s, row.request, kind);
+    if (decision.effect === "allow")
+        return undefined;
+    // Nothing was sent.
+    row.attempts = 0;
+    if (decision.effect === "deny") {
+        const outcome = await settleToolRow(t, s, row, {
+            kind: "failed",
+            code: "tool.denied",
+            message: decision.reason,
+            retryable: false,
+        });
+        return { status: "completed", outcome };
+    }
+    row.status = "held";
+    row.hold = { reason: decision.reason, at: new Date().toISOString() };
+    await t.put("effects", row.request.effectId, row);
+    return { status: "pending" };
 }
 /** The failed outcome of an MCP tool the turn's manifest disables (R2b C9). */
 function disabledTool(request) {
@@ -203,7 +308,7 @@ function unrunnableTool(request) {
     return {
         kind: "failed",
         code: "tool.unavailable",
-        message: `Tool '${request.toolName ?? ""}' runs your code, and the Runtime runs no code of yours during a session. Make it an http() tool or serve it from a remote MCP server.`,
+        message: `Tool '${request.toolName ?? ""}' runs your code, but the Runtime runs agents from their manifests alone. Make it an http() tool or serve it from a remote MCP server.`,
     };
 }
 /**
@@ -211,24 +316,38 @@ function unrunnableTool(request) {
  * `error` that left it uncertain. Only a cancel discards an outcome in hand (§10.7): after any
  * other abort (shutdown, deadline) it is recorded, so the next advance replays it.
  */
-export async function recordOutcome(scope, effectId, result) {
+export async function recordOutcome(scope, effectId, reported) {
     const { ctx, lease, signal } = scope;
+    const result = "error" in reported ? { error: redactTokens(reported.error) } : reported;
     if ("error" in result) {
-        await ctx.store.tx(async (t) => {
+        return ctx.store.tx(async (t) => {
             const s = await t.assertEpoch(lease.sessionId, lease.epoch);
             const effect = await t.get("effects", effectId);
             if (!effect)
-                return;
+                return { status: "uncertain" };
             const { request } = effect;
+            const active = s && s.status !== "cancelled" && s.activeTurnId === request.turnId;
+            // A tool call whose fate the harness could not learn fails to the model (R5.3): it may
+            // have run, and nothing sends it again. A cancel already settled it.
+            if (request.kind === "tool") {
+                if (effect.status === "completed")
+                    return { status: "completed", outcome: effect.outcome };
+                if (effect.status !== "invoking" || !active)
+                    return { status: "uncertain" };
+                effect.error = result.error;
+                const outcome = await settleToolRow(t, s, effect, interrupted(`${result.error} (the call may have run; it is not sent again)`), { writer: coreIn(scope) });
+                return { status: "completed", outcome };
+            }
             effect.status = "uncertain";
             effect.error = result.error;
             await t.put("effects", effectId, effect);
-            if (s && s.status !== "cancelled" && s.activeTurnId === request.turnId)
-                await t.event(s.id, request.turnId, "effect.uncertain", { effectId, message: result.error });
+            if (active)
+                await t.event(s.id, request.turnId, "effect.uncertain", { effectId, message: result.error }, scope.writer);
+            return { status: "uncertain" };
         });
-        return { status: "uncertain" };
     }
-    const value = await shaped(scope, effectId, result.value);
+    // What a harness reports never carries the Runtime's own tokens into the record (R4).
+    const value = await shaped(scope, effectId, redactTokens(result.value));
     return ctx.store.tx(async (t) => {
         const s = await t.assertEpoch(lease.sessionId, lease.epoch);
         const effect = await t.get("effects", effectId);
@@ -237,29 +356,40 @@ export async function recordOutcome(scope, effectId, result) {
         const { request } = effect;
         if (s.status === "cancelled" || s.activeTurnId !== request.turnId || abortKind(signal) === "cancel")
             throw TURN_CANCELLED();
+        if (request.kind === "tool") {
+            // Settled already: a re-send after a lost hop collected what the first send recorded.
+            if (effect.status === "completed")
+                return { status: "completed", outcome: effect.outcome };
+            // What the call returned is the harness's claim, or, for a tool core ran, core's (R4.9).
+            const outcome = await settleToolRow(t, s, effect, value, { writer: scope.writer });
+            if (request.context?.role === "verify-http")
+                await recordVerdict(t, request, value);
+            return { status: "completed", outcome };
+        }
         effect.status = "completed";
         effect.outcome = { value };
+        effect.settledAt = new Date().toISOString();
         await t.put("effects", effectId, effect);
         const model = request.kind === "model";
         const failed = model ? modelFailed(request, value) : undefined;
-        // A summary call is never an assistant message; the last one publishes context.compacted.
+        // A summary call is never an assistant message; it publishes context.compacted, `partial`
+        // unless it is the last.
         const summarizing = model && Boolean(request.context.compaction);
         const compacted = summarizing && !failed ? contextCompacted(request, value) : undefined;
-        const transcript = failed || summarizing
-            ? undefined
-            : model
-                ? assistantMessage(request, value)
-                : toolCompleted(request, value);
+        const transcript = failed || summarizing || !model ? undefined : assistantMessage(request, value);
         if (request.context?.role === "verify-http")
             await recordVerdict(t, request, value);
+        const writer = scope.writer;
+        // The call's span (R7.1): the journal's window, and the meter's row for it when a gate ran it.
+        const facts = failed || compacted || transcript
+            ? modelOutcomeFacts(effectId, effect, await t.modelUsageOf(effectId))
+            : undefined;
         if (failed)
-            await t.event(s.id, request.turnId, "model.failed", failed);
+            await t.event(s.id, request.turnId, "model.failed", { ...failed, ...facts }, writer);
         if (compacted)
-            await t.event(s.id, request.turnId, "context.compacted", compacted);
-        if (transcript && model)
-            await t.event(s.id, request.turnId, "message.assistant", transcript);
-        else if (transcript)
-            await t.event(s.id, request.turnId, "tool.completed", transcript);
+            await t.event(s.id, request.turnId, "context.compacted", { ...compacted, ...facts }, writer);
+        if (transcript)
+            await t.event(s.id, request.turnId, "message.assistant", { ...transcript, ...facts }, writer);
         return { status: "completed", outcome: effect.outcome };
     });
 }
@@ -283,8 +413,8 @@ async function shaped(scope, effectId, value) {
         if (!s || !effect || effect.status === "completed")
             return undefined;
         const request = effect.request;
-        // An agent's tool; a flow's HTTP stage or verifier names no capability, and its output is data.
-        if (request.kind !== "tool" || request.capabilityId === undefined)
+        // An agent's tool; a flow's HTTP stage or verifier names no tool, and its output is data.
+        if (request.kind !== "tool" || request.toolName === undefined)
             return undefined;
         const mcp = mcpToolOf(s.mcpSnapshot, request) !== undefined;
         if (!mcp && !isHttpToolCall(s.manifest, request))

package/dist/harness-api/redact.d.ts

@@ -0,0 +1,3 @@
+export declare const REDACTED_TOKEN = "[nylorun token redacted]";
+/** `value` with every Nylorun-signed token in its strings replaced; the same value when there is none. */
+export declare function redactTokens<T>(value: T): T;

package/dist/harness-api/redact.js

@@ -0,0 +1,45 @@
+/**
+ * Keeps the Runtime's own tokens out of the record (track R4). A harness runs
+ * model-written commands with the egress token in their proxy variables, and holds its run and
+ * host tokens; a command that prints its environment, or a model that repeats it, would put
+ * them into a tool result, an assistant message or a transcript edit. Core replaces every
+ * Nylorun-signed token (a compact JWT whose `typ` is `nylorun-…`) in what a harness reports with
+ * `[nylorun token redacted]` before recording it, whichever harness reported it. Other values
+ * pass through unchanged, and the walk keeps the value's shape.
+ */
+import { tokenType } from "../tenant/jwt.js";
+export const REDACTED_TOKEN = "[nylorun token redacted]";
+/** A compact JWT: three base64url parts, the first two JSON objects. */
+const COMPACT_JWT = /eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{16,}/g;
+function redactString(text) {
+    if (!text.includes("eyJ"))
+        return text;
+    return text.replace(COMPACT_JWT, (token) => (tokenType(token)?.startsWith("nylorun-") ? REDACTED_TOKEN : token));
+}
+/** `value` with every Nylorun-signed token in its strings replaced; the same value when there is none. */
+export function redactTokens(value) {
+    if (typeof value === "string")
+        return redactString(value);
+    if (Array.isArray(value)) {
+        let changed = false;
+        const next = value.map((item) => {
+            const redacted = redactTokens(item);
+            if (redacted !== item)
+                changed = true;
+            return redacted;
+        });
+        return (changed ? next : value);
+    }
+    if (value !== null && typeof value === "object") {
+        let changed = false;
+        const next = {};
+        for (const [key, item] of Object.entries(value)) {
+            const redacted = redactTokens(item);
+            if (redacted !== item)
+                changed = true;
+            next[key] = redacted;
+        }
+        return (changed ? next : value);
+    }
+    return value;
+}

package/dist/harness-api/server.d.ts

@@ -5,6 +5,12 @@ import type { RunOf } from "../tenant/run-grants.js";
 export interface HarnessPeer {
     /** For logs. */
     readonly name: string;
+    /**
+     * The harness id its credential is for (R4.1): `nylorun` for the harness token, a custom
+     * harness's id for its own token. Its `hello` must name it. Absent for an in-process
+     * harness, which may name any id; a pod's host is checked against its Environment's harness.
+     */
+    readonly harness?: string;
     /** A pod sandbox's engine (F7.2): the sandbox it hosts, at the host epoch of its token. */
     readonly host?: {
         readonly sandboxId: string;
@@ -28,6 +34,8 @@ export interface RunOffer {
      * only a harness that hosts no sandbox does.
      */
     readonly pod?: string;
+    /** The session's harness (R4.1): only a connection that said this id takes it. Default ours. */
+    readonly harness?: string;
     /** How long to wait for a harness to take it. Default the server's `offerWaitMs`. */
     readonly waitMs?: number;
 }
@@ -51,6 +59,14 @@ export type RunEnd = {
 /** No harness took the run within `offerWaitMs`. */
  | {
     readonly kind: "unavailable";
+}
+/**
+ * The harness that would take the run cannot: a tool it runs itself (`features.tools`) has the
+ * name of a tool of the turn's agents. The turn fails with `message`.
+ */
+ | {
+    readonly kind: "refused";
+    readonly message: string;
 };
 export interface HarnessApiServer {
     /** Serves a harness's channel until it closes. Returns a function that detaches it. */
@@ -58,19 +74,26 @@ export interface HarnessApiServer {
     offer(offer: RunOffer): Promise<RunEnd>;
     /**
      * Sends a `workspace.*` request to a harness that serves workspaces: with `pod`, the host of
-     * that pod sandbox; otherwise one that hosts no sandbox. Throws `NoWorkspaceHarness` when
-     * none is attached.
+     * that pod sandbox (with `minEpoch`, one that joined at that host epoch or later, so a pod's
+     * new volume is never written through its old host); otherwise one that hosts no sandbox.
+     * Throws `NoWorkspaceHarness` when none is attached.
      */
     workspace<M extends CoreMethod>(method: M, params: ParamsOf<M>, signal?: AbortSignal, target?: {
         readonly pod?: string;
+        readonly minEpoch?: number;
     }): Promise<ResultOf<M>>;
     /**
      * Pod sandbox `sandboxId`'s host epoch moved to `epoch` (F7.2): connections hosting it at an
      * older epoch are closed.
      */
     revokeHost(sandboxId: string, epoch: number): void;
-    /** Whether a host of pod sandbox `sandboxId` is connected. */
-    hosting(sandboxId: string): boolean;
+    /**
+     * Whether a host of pod sandbox `sandboxId` is connected: with `minEpoch`, one that joined at
+     * that host epoch or later. A restore or a lost volume moves the epoch before the old host's
+     * connection is closed (`host.revoked` is delivered after the commit), so a caller that writes
+     * the new volume passes the Environment's epoch.
+     */
+    hosting(sandboxId: string, minEpoch?: number): boolean;
     /** Harnesses attached now, and whether one serves workspaces. */
     status(): HarnessStatus;
     /** Harnesses attached now. */
@@ -94,3 +117,11 @@ export interface HarnessApiServerOptions {
     sandboxPreference?: string;
 }
 export declare function createHarnessApiServer(ctx: TenantContext, options?: HarnessApiServerOptions): HarnessApiServer;
+/**
+ * The tools a harness runs itself (`features.tools`) whose names the turn already uses: a tool of
+ * the turn's agents (their own and the Runtime's `runtime` tools), a session tool, `tool_search` or
+ * `tool_call` (session tools a later step may get). Tools are known by name alone, so a native
+ * tool must not take one (Harness API 3); `hello` already refuses a name with `__`, which names an
+ * MCP server's tools. A flow turn runs no native tools.
+ */
+export declare function nativeToolClashes(tools: ReadonlySet<string> | undefined, start: TurnStart): string[];