@nylorun/runtime 0.24.0-beta → 0.25.0-beta

package/dist/harness/service.js

@@ -82,16 +82,16 @@ export function startHarnessService(options) {
                 if ("disk" in params) {
                     // A disk version's read or write (R2d step 3).
                     const call = params;
-                    const answer = await sandbox().disk(refOf(call.session), { id: "sandbox", type: "agent", sandbox: call.spec, tools: [] }, fromWireOp(call.disk), signal);
+                    const answer = await sandbox().disk(refOf(call.session), call.spec, fromWireOp(call.disk), signal);
                     return "code" in answer ? answer : toWireAnswer(answer);
                 }
                 if (method === "workspace.read" && "list" in params) {
                     const call = params;
-                    return sandbox().listFiles(refOf(call.session), { id: "sandbox", type: "agent", sandbox: call.spec, tools: [] }, call.list.dir, call.list.maxEntries, signal);
+                    return sandbox().listFiles(refOf(call.session), call.spec, call.list.dir, call.list.maxEntries, signal);
                 }
                 if (method === "workspace.read" && "bytes" in params) {
                     const call = params;
-                    const read = await sandbox().readBytes(refOf(call.session), { id: "sandbox", type: "agent", sandbox: call.spec, tools: [] }, call.bytes.path, call.bytes.maxBytes, signal);
+                    const read = await sandbox().readBytes(refOf(call.session), call.spec, call.bytes.path, call.bytes.maxBytes, signal);
                     return read.kind === "read"
                         ? { kind: "read", path: read.path, base64: Buffer.from(read.bytes).toString("base64") }
                         : read;
@@ -99,7 +99,7 @@ export function startHarnessService(options) {
                 const call = params;
                 if (METHODS[call.tool] !== method)
                     throw new HarnessApiError("invalid", `${method} does not run ${call.tool}`);
-                return sandbox().run(refOf(call.session), { id: "sandbox", type: "agent", sandbox: call.spec, tools: [] }, call.tool, call.input, signal);
+                return sandbox().run(refOf(call.session), call.spec, call.tool, call.input, signal);
             }
             case "workspace.report":
                 return sandbox().report();
@@ -138,7 +138,7 @@ export function startHarnessService(options) {
         // Our harness: its hello names our harness id (R4.1).
         name: DEFAULT_HARNESS,
         ...(options.version ? { version: options.version } : {}),
-        capabilities: { workspace: { backends: backends.map((backend) => backend.name) } },
+        features: { workspace: { backends: backends.map((backend) => backend.name) } },
         onHello(answer) {
             tenantId = answer.tenantId;
             manager ??= new SandboxManager({

package/dist/harness/setup.d.ts

@@ -6,6 +6,8 @@ export interface DiskSetupOptions {
     readonly host: Pick<PodHost, "setup" | "setupState" | "reportSetup" | "setupFile"> & {
         /** The volume starts from a disk version (R2d step 3): it holds what setup made. */
         readonly seeded?: boolean;
+        /** A fork onto other setup (Q17): run it once core has written the version. */
+        readonly afterSeed?: boolean;
     };
     /** Runs one command as the sandbox tools do (`localExec`). */
     readonly exec: (request: ExecRequest, signal: AbortSignal) => Promise<ExecResult>;

package/dist/harness/setup.js

@@ -8,12 +8,18 @@
  *
  * A failure is reported to core, which fails the pod and the turn waiting for it; the engine then
  * polls until a turn start asks the pod to run again, and runs the setup again from the start.
+ *
+ * A volume seeded from a disk version skips it (the version holds what setup made), except on a
+ * fork onto other setup (Q17): the engine connects first, waits until core has written the
+ * version, then runs the setup on it as above. Turns wait until it reports the setup done.
  */
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { dirname, posix } from "node:path";
 /** How often a failed setup asks whether to run again. */
 export const SETUP_RETRY_POLL_MS = 5_000;
+/** How often a fork's setup asks whether its disk version is written (Q17). */
+const AFTER_SEED_POLL_MS = 1_000;
 /** The end of a failed command's output kept in its report. */
 const REPORT_TAIL = 4 * 1024;
 async function readText(path) {
@@ -89,7 +95,25 @@ async function runOnce(options, setup) {
 export async function prepareDisk(options) {
     let setup = options.host.setup;
     const volumeId = await readText(options.volumeFile);
-    if (options.host.seeded) {
+    if (options.host.afterSeed) {
+        // A fork onto other setup (Q17): wait until core has written the disk version, then run it.
+        for (;;) {
+            if (options.signal?.aborted)
+                return;
+            const state = await options.host.setupState().catch(() => undefined);
+            if (state?.retry) {
+                setup = state.setup;
+                break;
+            }
+            await new Promise((resolve) => setTimeout(resolve, options.pollMs ?? AFTER_SEED_POLL_MS));
+        }
+        if (!setup) {
+            // Nothing to run: say so, so the fork's turns may start.
+            await options.host.reportSetup({ status: "ok" }).catch(() => undefined);
+            return;
+        }
+    }
+    else if (options.host.seeded) {
         // A volume seeded from a disk version: the version holds what setup made, so mark it done.
         if (volumeId) {
             const done = { volumeId, recipeVersion: setup?.recipeVersion ?? 0, status: "ok" };

package/dist/harness-api/record.d.ts

@@ -27,7 +27,7 @@ export interface RecordScope {
     readonly ctx: TenantContext;
     readonly lease: Lease;
     readonly signal: AbortSignal;
-    /** The tools the run's harness declared it runs itself (`hello` `capabilities.tools`, R4.2). */
+    /** The tools the run's harness declared it runs itself (`hello` `features.tools`, R4.2), by name. */
     readonly nativeTools?: ReadonlySet<string>;
     /**
      * Who reported what this scope records (R4.9): the run's harness, so the events derived from

package/dist/harness-api/record.js

@@ -18,9 +18,9 @@
  * row keeps its span's context (`traceparent`, R7.4), which the `execute` answer carries to the
  * harness and the Tool Gate reads with the row.
  */
-import { HARNESS_TOOLS_CAPABILITY, HarnessApiError, effectRequestHash, isEffectIdOf, } from "@nylorun/core/harness-api";
+import { HarnessApiError, effectRequestHash, isEffectIdOf, } from "@nylorun/core/harness-api";
 import { isFlowEffect, isFlowToolEffect, recordVerdict, settleAgentEffect, } from "../core/flow-host.js";
-import { sandboxCapabilityOf } from "../sandbox/capability.js";
+import { sandboxToolSpec } from "../sandbox/runtime-tools.js";
 import { abortOn, isReadArtifactCall, isSaveArtifactCall } from "../harness/calls.js";
 import { callReadArtifact, callSaveArtifact } from "../tenant/artifact-tool.js";
 import { mayNeedShaping, resultBytes, resultLimit, shapeToolOutcome, } from "../tenant/tool-results.js";
@@ -143,17 +143,17 @@ export async function recordIntent(scope, effect, requestHash) {
                 (mcpToolOf(s.mcpSnapshot, request, turnManifestOf(s)) !== undefined ||
                     // HTTP tools (R2 M3) cross the Tool Gate.
                     isHttpToolCall(s.manifest, request) ||
-                    sandboxCapabilityOf(agentManifest, request.capabilityId, request.toolName) !== undefined ||
+                    sandboxToolSpec(agentManifest, request.toolName) !== undefined ||
                     // `save_artifact` (F8.1) runs beside the sandbox tools, as do `read_artifact` (R2b
                     // C11) and the skill tools (R2 M4).
                     isSaveArtifactCall(agentManifest, request) ||
                     isReadArtifactCall(agentManifest, request) ||
                     isSkillToolCall(agentManifest, request) ||
                     // `tool_search` (R2b C10) reads the session's pinned MCP snapshot: core serves it.
-                    isToolSearchCall(agentManifest, request) ||
-                    // A tool the run's harness declared and runs itself (R4.2, Q3).
-                    (request.capabilityId === HARNESS_TOOLS_CAPABILITY &&
-                        scope.nativeTools?.has(request.toolName ?? "") === true)));
+                    isToolSearchCall(s.mcpSnapshot, request) ||
+                    // A tool the run's harness declared and runs itself (R4.2, Q3), by its name: the turn
+                    // refuses a native tool whose name another tool of the agent's has (`harness-api/server.ts`).
+                    (request.toolName !== undefined && scope.nativeTools?.has(request.toolName) === true)));
         if (!executed) {
             // A tool that would run the developer's code: refused at save (a turn's manifest only
             // removes tools), so this is a backstop, as is an MCP tool the turn disabled, which the
@@ -163,7 +163,7 @@ export async function recordIntent(scope, effect, requestHash) {
                 request,
                 requestHash,
                 status: "invoking",
-                ...toolKindOf(s, agentManifest, request),
+                ...toolKindOf(s, agentManifest, request, scope.nativeTools),
                 attempts: 0,
             };
             const outcome = await settleToolRow(t, s, row, disabled ? disabledTool(request) : unrunnableTool(request), { writer: coreIn(scope) });
@@ -175,7 +175,7 @@ export async function recordIntent(scope, effect, requestHash) {
             requestHash,
             status: "invoking",
             ...(request.kind === "tool"
-                ? { ...firstSend(toolKindOf(s, agentManifest, request)), ...traced() }
+                ? { ...firstSend(toolKindOf(s, agentManifest, request, scope.nativeTools)), ...traced() }
                 : { startedAt: new Date().toISOString() }),
         };
         // The Tenant's tool policy decides an MCP or HTTP tool call as it is journaled (R5 step 2).
@@ -186,7 +186,7 @@ export async function recordIntent(scope, effect, requestHash) {
         }
         await t.put("effects", request.effectId, row);
         // `save_artifact` writes the Tenant's artifacts: core runs it, reading the file through the
-        // workspace capability, wherever the sandbox is.
+        // workspace feature, wherever the sandbox is.
         if (request.kind === "tool" && isSaveArtifactCall(agentManifest, request))
             return "save";
         // `read_artifact` reads the session's artifacts: core serves it, with or without a sandbox.
@@ -195,7 +195,7 @@ export async function recordIntent(scope, effect, requestHash) {
         // The skill tools read the agent's definition files: core serves them.
         if (isSkillToolCall(agentManifest, request))
             return { skill: agentManifest };
-        if (isToolSearchCall(agentManifest, request))
+        if (isToolSearchCall(s.mcpSnapshot, request))
             return "search";
         return { status: "execute", ...(row.traceparent ? { traceparent: row.traceparent } : {}) };
     });
@@ -413,8 +413,8 @@ async function shaped(scope, effectId, value) {
         if (!s || !effect || effect.status === "completed")
             return undefined;
         const request = effect.request;
-        // An agent's tool; a flow's HTTP stage or verifier names no capability, and its output is data.
-        if (request.kind !== "tool" || request.capabilityId === undefined)
+        // An agent's tool; a flow's HTTP stage or verifier names no tool, and its output is data.
+        if (request.kind !== "tool" || request.toolName === undefined)
             return undefined;
         const mcp = mcpToolOf(s.mcpSnapshot, request) !== undefined;
         if (!mcp && !isHttpToolCall(s.manifest, request))

package/dist/harness-api/server.d.ts

@@ -59,6 +59,14 @@ export type RunEnd = {
 /** No harness took the run within `offerWaitMs`. */
  | {
     readonly kind: "unavailable";
+}
+/**
+ * The harness that would take the run cannot: a tool it runs itself (`features.tools`) has the
+ * name of a tool of the turn's agents. The turn fails with `message`.
+ */
+ | {
+    readonly kind: "refused";
+    readonly message: string;
 };
 export interface HarnessApiServer {
     /** Serves a harness's channel until it closes. Returns a function that detaches it. */
@@ -66,19 +74,26 @@ export interface HarnessApiServer {
     offer(offer: RunOffer): Promise<RunEnd>;
     /**
      * Sends a `workspace.*` request to a harness that serves workspaces: with `pod`, the host of
-     * that pod sandbox; otherwise one that hosts no sandbox. Throws `NoWorkspaceHarness` when
-     * none is attached.
+     * that pod sandbox (with `minEpoch`, one that joined at that host epoch or later, so a pod's
+     * new volume is never written through its old host); otherwise one that hosts no sandbox.
+     * Throws `NoWorkspaceHarness` when none is attached.
      */
     workspace<M extends CoreMethod>(method: M, params: ParamsOf<M>, signal?: AbortSignal, target?: {
         readonly pod?: string;
+        readonly minEpoch?: number;
     }): Promise<ResultOf<M>>;
     /**
      * Pod sandbox `sandboxId`'s host epoch moved to `epoch` (F7.2): connections hosting it at an
      * older epoch are closed.
      */
     revokeHost(sandboxId: string, epoch: number): void;
-    /** Whether a host of pod sandbox `sandboxId` is connected. */
-    hosting(sandboxId: string): boolean;
+    /**
+     * Whether a host of pod sandbox `sandboxId` is connected: with `minEpoch`, one that joined at
+     * that host epoch or later. A restore or a lost volume moves the epoch before the old host's
+     * connection is closed (`host.revoked` is delivered after the commit), so a caller that writes
+     * the new volume passes the Environment's epoch.
+     */
+    hosting(sandboxId: string, minEpoch?: number): boolean;
     /** Harnesses attached now, and whether one serves workspaces. */
     status(): HarnessStatus;
     /** Harnesses attached now. */
@@ -102,3 +117,11 @@ export interface HarnessApiServerOptions {
     sandboxPreference?: string;
 }
 export declare function createHarnessApiServer(ctx: TenantContext, options?: HarnessApiServerOptions): HarnessApiServer;
+/**
+ * The tools a harness runs itself (`features.tools`) whose names the turn already uses: a tool of
+ * the turn's agents (their own and the Runtime's `runtime` tools), a session tool, `tool_search` or
+ * `tool_call` (session tools a later step may get). Tools are known by name alone, so a native
+ * tool must not take one (Harness API 3); `hello` already refuses a name with `__`, which names an
+ * MCP server's tools. A flow turn runs no native tools.
+ */
+export declare function nativeToolClashes(tools: ReadonlySet<string> | undefined, start: TurnStart): string[];

package/dist/harness-api/server.js

@@ -27,6 +27,7 @@
 import { randomUUID } from "node:crypto";
 import { DEFAULT_HARNESS, HARNESS_API_VERSION, HARNESS_CLAIMS, MAX_HARNESS_STATE_BYTES, isHarnessId, HarnessApiError, } from "@nylorun/core/harness-api";
 import { definitionFilesOf } from "@nylorun/core/contracts";
+import { TOOL_CALL_TOOL, TOOL_SEARCH_TOOL, delegatesOf, } from "@nylorun/core/define";
 import { isOwnershipLost } from "../store/ownership.js";
 import { harnessOf, ownedSession } from "../tenant/context.js";
 import { mcpDiscovered, pinDeferral, sessionToolsOf, } from "../mcp/snapshot.js";
@@ -80,6 +81,15 @@ export function createHarnessApiServer(ctx, options = {}) {
                 continue;
             }
             queued.splice(i, 1);
+            const clash = nativeToolClashes(waiting[at].connection.tools, run.offer.start);
+            if (clash.length > 0) {
+                // The harness keeps waiting for a run its tools fit; this turn fails (Harness API 3).
+                run.end({
+                    kind: "refused",
+                    message: `Harness '${waiting[at].connection.harness}' runs tools named like tools of this turn's agents: ${clash.join(", ")}. A tool the harness runs itself needs a name no other tool of the session has.`,
+                });
+                continue;
+            }
             const lease = waiting.splice(at, 1)[0];
             run.connection = lease.connection;
             // The run token the advance holds now (F5): the gate calls of this run present it.
@@ -111,14 +121,14 @@ export function createHarnessApiServer(ctx, options = {}) {
     const serve = (connection) => async (method, params, signal) => {
         const p = params;
         if (method === "hello") {
-            const { api, name, capabilities } = p;
+            const { api, name, features } = p;
             // R3's next version adds a window of supported versions; until then there is one.
             if (api !== HARNESS_API_VERSION)
                 throw new HarnessApiError("invalid", `unsupported Harness API version ${api}: this Runtime speaks ${HARNESS_API_VERSION}`);
             connection.harness = await harnessIdOf(connection, name);
-            connection.workspace = capabilities.workspace !== undefined;
-            if (capabilities.tools?.length)
-                connection.tools = new Set(capabilities.tools.map((tool) => tool.name));
+            connection.workspace = features.workspace !== undefined;
+            if (features.tools?.length)
+                connection.tools = new Set(features.tools.map((tool) => tool.name));
             return {
                 api: HARNESS_API_VERSION,
                 tenantId: ctx.config.tenantId,
@@ -258,12 +268,12 @@ export function createHarnessApiServer(ctx, options = {}) {
                 current.mcpSnapshot = pinDeferral(snapshot, current.manifest, contextWindow);
                 current.mcpDiagnostics = diagnostics;
                 await t.put("sessions", current.id, current);
-                await t.event(current.id, run.grant.turnId, "mcp.discovered", mcpDiscovered(current.mcpSnapshot, diagnostics), run.connection ? writerOf(run.connection, run.grant.runId) : undefined);
+                await t.event(current.id, run.grant.turnId, "mcp.discovered", mcpDiscovered(current.mcpSnapshot, diagnostics, current.manifest), run.connection ? writerOf(run.connection, run.grant.runId) : undefined);
             }
             else if (diagnostics.length > 0) {
                 const prior = [...(current.mcpDiagnostics ?? [])];
                 for (const item of diagnostics) {
-                    const index = prior.findIndex((existing) => existing.capabilityId === item.capabilityId && existing.serverName === item.serverName);
+                    const index = prior.findIndex((existing) => (existing.agentId ?? null) === (item.agentId ?? null) && existing.serverName === item.serverName);
                     if (index >= 0)
                         prior[index] = item;
                     else
@@ -336,8 +346,10 @@ export function createHarnessApiServer(ctx, options = {}) {
                     !connection.channel.closed),
             };
         },
-        hosting(sandboxId) {
-            return [...connections].some((connection) => connection.host?.sandboxId === sandboxId && !connection.channel.closed);
+        hosting(sandboxId, minEpoch) {
+            return [...connections].some((connection) => connection.host?.sandboxId === sandboxId &&
+                connection.host.epoch >= (minEpoch ?? 0) &&
+                !connection.channel.closed);
         },
         revokeHost(sandboxId, epoch) {
             for (const connection of [...connections])
@@ -356,6 +368,7 @@ export function createHarnessApiServer(ctx, options = {}) {
             const connection = [...connections].find((item) => item.workspace &&
                 !item.channel.closed &&
                 item.host?.sandboxId === pod &&
+                (item.host === undefined || item.host.epoch >= (target?.minEpoch ?? 0)) &&
                 (pod !== undefined || item.harness === harness));
             if (!connection)
                 throw new NoWorkspaceHarness(pod);
@@ -496,3 +509,23 @@ function isSnapshot(value) {
         typeof snapshot.manifestHash === "string" &&
         Array.isArray(snapshot.mcpTools));
 }
+/**
+ * The tools a harness runs itself (`features.tools`) whose names the turn already uses: a tool of
+ * the turn's agents (their own and the Runtime's `runtime` tools), a session tool, `tool_search` or
+ * `tool_call` (session tools a later step may get). Tools are known by name alone, so a native
+ * tool must not take one (Harness API 3); `hello` already refuses a name with `__`, which names an
+ * MCP server's tools. A flow turn runs no native tools.
+ */
+export function nativeToolClashes(tools, start) {
+    if (!tools?.size || start.engine !== "agent")
+        return [];
+    const manifest = start.manifest;
+    const taken = new Set([TOOL_SEARCH_TOOL, TOOL_CALL_TOOL]);
+    for (const agent of [manifest, ...delegatesOf(manifest).map((delegate) => delegate.manifest)])
+        for (const tool of [...(agent.tools ?? []), ...(agent.runtime?.tools ?? [])])
+            taken.add(tool.name);
+    for (const tool of (start.sessionTools ?? []))
+        if (typeof tool?.name === "string")
+            taken.add(tool.name);
+    return [...tools].filter((name) => taken.has(name)).sort();
+}

package/dist/harness-api/tool-journal.d.ts

@@ -18,7 +18,7 @@
  * (`policy`). A flow's HTTP stage, which names no tool call, ends in `node.completed` instead.
  */
 import type { EventWriter } from "@nylorun/core/contracts";
-import type { AgentManifest } from "@nylorun/core/define";
+import { type AgentManifest, type PluginLabel } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
 import type { Session } from "../tenant/context.js";
 import { type GateTimes, type ToolCallFacts, type ToolCallKind, type ToolCallStatus, type ToolPolicyFact } from "../tenant/transcript.js";
@@ -40,6 +40,9 @@ export interface ToolRowFacts {
     };
     toolKind?: ToolCallKind;
     server?: string;
+    /** The skill the call ran, and the plugin that brought its skill or MCP server. */
+    skill?: string;
+    plugin?: PluginLabel;
     attempts?: number;
     startedAt?: string;
     settledAt?: string;
@@ -57,16 +60,22 @@ export type ToolRow = EffectDoc & ToolRowFacts & {
     };
     error?: string;
 };
-/** Where a tool call runs, and its MCP server or HTTP tool capability. */
-export declare function toolKindOf(s: Pick<Session, "manifest" | "mcpSnapshot">, agentManifest: AgentManifest | undefined, request: HostEffect): {
+/** Where a tool call runs, and what it traces to (Q7, Q11). */
+export interface ToolCallPlace {
     toolKind: ToolCallKind;
+    /** Its MCP server or, for an agent's HTTP tool, its URL's host. */
     server?: string;
-};
+    skill?: string;
+    plugin?: PluginLabel;
+}
+/**
+ * Where a tool call runs, and what it traces to: an MCP call names its server and the plugin
+ * that brought it; a skill tool, or a sandbox tool whose input names `/skills/<name>@<hash>/`, names the
+ * skill and its plugin. A tool the turn's harness declared (`nativeTools`) runs in the harness.
+ */
+export declare function toolKindOf(s: Pick<Session, "manifest" | "mcpSnapshot">, agentManifest: AgentManifest | undefined, request: HostEffect, nativeTools?: ReadonlySet<string>): ToolCallPlace;
 /** The facts a new tool row starts with: its first send, now. */
-export declare function firstSend(kind: {
-    toolKind: ToolCallKind;
-    server?: string;
-}, now?: Date): ToolRowFacts;
+export declare function firstSend(kind: ToolCallPlace, now?: Date): ToolRowFacts;
 /** A failed outcome the Runtime gives a call a crash interrupted: it may have run. */
 export declare function interrupted(message: string): {
     kind: string;

package/dist/harness-api/tool-journal.js

@@ -1,21 +1,49 @@
+import { pluginOf, skillOfToolCall } from "@nylorun/core/define";
 import { isFlowToolEffect } from "../core/flow-host.js";
-import { isHttpToolCall } from "../gates/http-tool.js";
+import { declaredHttpTool, isHttpToolCall } from "../gates/http-tool.js";
 import { mcpToolOf } from "../mcp/snapshot.js";
-import { sandboxCapabilityOf } from "../sandbox/capability.js";
+import { sandboxToolSpec } from "../sandbox/runtime-tools.js";
 import { toolCompleted, } from "../tenant/transcript.js";
 import { toolCallDuration, toolCallStatus } from "./tool-status.js";
 /** How many times a tool call is sent before it fails to the model as `tool.interrupted`. */
 export const MAX_TOOL_ATTEMPTS = 3;
-/** Where a tool call runs, and its MCP server or HTTP tool capability. */
-export function toolKindOf(s, agentManifest, request) {
+/**
+ * Where a tool call runs, and what it traces to: an MCP call names its server and the plugin
+ * that brought it; a skill tool, or a sandbox tool whose input names `/skills/<name>@<hash>/`, names the
+ * skill and its plugin. A tool the turn's harness declared (`nativeTools`) runs in the harness.
+ */
+export function toolKindOf(s, agentManifest, request, nativeTools) {
     const mcp = mcpToolOf(s.mcpSnapshot, request);
-    if (mcp)
-        return { toolKind: "mcp", server: mcp.serverName };
-    if (isHttpToolCall(s.manifest, request))
-        return { toolKind: "http", ...(request.capabilityId ? { server: request.capabilityId } : {}) };
-    if (sandboxCapabilityOf(agentManifest, request.capabilityId, request.toolName))
-        return { toolKind: "sandbox" };
-    return { toolKind: "platform" };
+    if (mcp) {
+        const plugin = pluginOf(agentManifest, { server: mcp.serverName });
+        return { toolKind: "mcp", server: mcp.serverName, ...(plugin === undefined ? {} : { plugin }) };
+    }
+    if (isHttpToolCall(s.manifest, request)) {
+        const host = httpHostOf(declaredHttpTool(s.manifest, request.agent?.id, request.toolName)?.http.url);
+        return { toolKind: "http", ...(host === undefined ? {} : { server: host }) };
+    }
+    if (request.toolName !== undefined && nativeTools?.has(request.toolName))
+        return { toolKind: "harness" };
+    const skill = skillOfToolCall(agentManifest, request.toolName, request.input);
+    const plugin = skill === undefined ? undefined : pluginOf(agentManifest, { skill });
+    const traced = {
+        ...(skill === undefined ? {} : { skill }),
+        ...(plugin === undefined ? {} : { plugin }),
+    };
+    if (sandboxToolSpec(agentManifest, request.toolName))
+        return { toolKind: "sandbox", ...traced };
+    return { toolKind: "platform", ...traced };
+}
+/** The host (and port, when it names one) of an HTTP tool's URL. */
+function httpHostOf(url) {
+    if (url === undefined)
+        return undefined;
+    try {
+        return new URL(url).host || undefined;
+    }
+    catch {
+        return undefined;
+    }
 }
 /** The facts a new tool row starts with: its first send, now. */
 export function firstSend(kind, now = new Date()) {
@@ -33,6 +61,8 @@ export function factsOf(row, status, gate) {
         status,
         ...(row.toolKind === undefined ? {} : { kind: row.toolKind }),
         ...(row.server === undefined ? {} : { server: row.server }),
+        ...(row.skill === undefined ? {} : { skill: row.skill }),
+        ...(row.plugin === undefined ? {} : { plugin: row.plugin }),
         ...(row.attempts === undefined ? {} : { attempts: row.attempts }),
         ...(durationMs === undefined ? {} : { durationMs }),
         effectId: row.request.effectId,

package/dist/harness-api/workspace.d.ts

@@ -1,4 +1,4 @@
-import type { CapabilityManifest, SandboxToolName } from "@nylorun/core/define";
+import type { SandboxManifest, SandboxToolName } from "@nylorun/core/define";
 import type { SandboxManager, SandboxSessionRef } from "../sandbox/manager.js";
 import { type DiskOp } from "../sandbox/disk-fs.js";
 import type { SandboxSelectionReport } from "../sandbox/select.js";
@@ -13,13 +13,13 @@ export type WorkspaceReport = SandboxSelectionReport & {
 type Exists = (id: string) => boolean | Promise<boolean>;
 export interface WorkspacePort {
     /** Runs one sandbox tool in the workspace of `session`. */
-    run(session: SandboxSessionRef, capability: CapabilityManifest, toolName: SandboxToolName, input: unknown, signal: AbortSignal): Promise<SandboxToolOutcome>;
+    run(session: SandboxSessionRef, sandbox: SandboxManifest | undefined, toolName: SandboxToolName, input: unknown, signal: AbortSignal): Promise<SandboxToolOutcome>;
     /** Lists the files under `dir` of the workspace of `session` (the turn-end export, F8.2). */
-    listFiles(session: SandboxSessionRef, capability: CapabilityManifest, dir: string, maxEntries: number, signal: AbortSignal): ReturnType<SandboxManager["listFiles"]>;
+    listFiles(session: SandboxSessionRef, sandbox: SandboxManifest | undefined, dir: string, maxEntries: number, signal: AbortSignal): ReturnType<SandboxManager["listFiles"]>;
     /** Reads a file of the workspace of `session` as bytes, at most `maxBytes` (`save_artifact`). */
-    readBytes(session: SandboxSessionRef, capability: CapabilityManifest, path: string, maxBytes: number, signal: AbortSignal): ReturnType<SandboxManager["readBytes"]>;
+    readBytes(session: SandboxSessionRef, sandbox: SandboxManifest | undefined, path: string, maxBytes: number, signal: AbortSignal): ReturnType<SandboxManager["readBytes"]>;
     /** One operation on the disk of the workspace of `session` (R2d step 3). */
-    disk(session: SandboxSessionRef, capability: CapabilityManifest, op: DiskOp, signal: AbortSignal): ReturnType<SandboxManager["disk"]>;
+    disk(session: SandboxSessionRef, sandbox: SandboxManifest | undefined, op: DiskOp, signal: AbortSignal): ReturnType<SandboxManager["disk"]>;
     report(): Promise<WorkspaceReport>;
     /** One Tenant sweep pass: stop idle workspaces, remove those whose owner is gone. */
     sweep(options: {
@@ -43,6 +43,8 @@ export interface RemoteWorkspaceOptions {
     readonly preference: string;
     /** The pod sandbox whose host serves these workspaces (F7.2). */
     readonly pod?: string;
+    /** With `pod`: the oldest host epoch that may serve them (`SandboxSessionRef.hostEpoch`). */
+    readonly minEpoch?: number;
 }
 /** The workspaces of the harness that serves them. */
 export declare function remoteWorkspace(options: RemoteWorkspaceOptions): WorkspacePort;

package/dist/harness-api/workspace.js

@@ -1,5 +1,5 @@
 /**
- * The workspace capability (F6.2): what core does with the Tenant's sandbox workspaces outside a
+ * The workspace feature (F6.2): what core does with the Tenant's sandbox workspaces outside a
  * run. `ctx.sandbox` is a `WorkspacePort`: the sandbox tool route (`POST
  * /v1/sessions/:id/sandbox/:tool`), Tenant status, the Tenant sweep, a sandbox resource's deletion and a sandboxes reset.
  *
@@ -25,10 +25,10 @@ import { NoWorkspaceHarness } from "./server.js";
 /** The Tenant's own SandboxManager. */
 export function localWorkspace(manager) {
     return {
-        run: (session, capability, toolName, input, signal) => manager.run(session, capability, toolName, input, signal),
-        listFiles: (session, capability, dir, maxEntries, signal) => manager.listFiles(session, capability, dir, maxEntries, signal),
-        readBytes: (session, capability, path, maxBytes, signal) => manager.readBytes(session, capability, path, maxBytes, signal),
-        disk: (session, capability, op, signal) => manager.disk(session, capability, op, signal),
+        run: (session, sandbox, toolName, input, signal) => manager.run(session, sandbox, toolName, input, signal),
+        listFiles: (session, sandbox, dir, maxEntries, signal) => manager.listFiles(session, sandbox, dir, maxEntries, signal),
+        readBytes: (session, sandbox, path, maxBytes, signal) => manager.readBytes(session, sandbox, path, maxBytes, signal),
+        disk: (session, sandbox, op, signal) => manager.disk(session, sandbox, op, signal),
         report: () => manager.report(),
         sweep: (options) => manager.sweep(options),
         removeSandbox: (environmentId) => manager.removeSandbox(environmentId),
@@ -54,7 +54,9 @@ function sessionOf(session) {
 /** The workspaces of the harness that serves them. */
 export function remoteWorkspace(options) {
     const { store } = options;
-    const target = options.pod === undefined ? undefined : { pod: options.pod };
+    const target = options.pod === undefined
+        ? undefined
+        : { pod: options.pod, ...(options.minEpoch === undefined ? {} : { minEpoch: options.minEpoch }) };
     const unavailable = (error) => error.pod === undefined
         ? fail(503, error.message, { code: "request_rejected" })
         : fail(409, error.message, { code: "environment_unavailable" });
@@ -98,11 +100,11 @@ export function remoteWorkspace(options) {
         });
     };
     return {
-        async run(session, capability, toolName, input, signal) {
+        async run(session, sandbox, toolName, input, signal) {
             try {
                 return (await options.server.workspace(METHODS[toolName], {
                     session: sessionOf(session),
-                    spec: capability.sandbox ?? {},
+                    spec: sandbox ?? {},
                     tool: toolName,
                     input: input ?? {},
                 }, signal, target));
@@ -117,9 +119,9 @@ export function remoteWorkspace(options) {
                 throw error;
             }
         },
-        async listFiles(session, capability, dir, maxEntries, signal) {
+        async listFiles(session, sandbox, dir, maxEntries, signal) {
             try {
-                const answer = (await options.server.workspace("workspace.read", { session: sessionOf(session), spec: capability.sandbox ?? {}, list: { dir, maxEntries } }, signal, target));
+                const answer = (await options.server.workspace("workspace.read", { session: sessionOf(session), spec: sandbox ?? {}, list: { dir, maxEntries } }, signal, target));
                 if (answer.kind === "listed")
                     return {
                         kind: "listed",
@@ -137,11 +139,11 @@ export function remoteWorkspace(options) {
                 throw error;
             }
         },
-        async readBytes(session, capability, path, maxBytes, signal) {
+        async readBytes(session, sandbox, path, maxBytes, signal) {
             try {
                 const answer = (await options.server.workspace("workspace.read", {
                     session: sessionOf(session),
-                    spec: capability.sandbox ?? {},
+                    spec: sandbox ?? {},
                     bytes: { path, maxBytes },
                 }, signal, target));
                 if (answer.kind === "read")
@@ -156,9 +158,9 @@ export function remoteWorkspace(options) {
                 throw error;
             }
         },
-        async disk(session, capability, op, signal) {
+        async disk(session, sandbox, op, signal) {
             try {
-                const answer = (await options.server.workspace("list" in op || "read" in op ? "workspace.read" : "workspace.write", { session: sessionOf(session), spec: capability.sandbox ?? {}, disk: toWireOp(op) }, signal, target));
+                const answer = (await options.server.workspace("list" in op || "read" in op ? "workspace.read" : "workspace.write", { session: sessionOf(session), spec: sandbox ?? {}, disk: toWireOp(op) }, signal, target));
                 return answer.kind === "failed"
                     ? { kind: "failed", code: String(answer.code), message: String(answer.message) }
                     : fromWireAnswer(answer);
@@ -204,13 +206,17 @@ export function remoteWorkspace(options) {
  */
 export function withPodWorkspaces(base, options) {
     const routed = async (session) => session.environmentId !== undefined && (await options.isPod(session.environmentId))
-        ? remoteWorkspace({ ...options, pod: session.environmentId })
+        ? remoteWorkspace({
+            ...options,
+            pod: session.environmentId,
+            ...(session.hostEpoch === undefined ? {} : { minEpoch: session.hostEpoch }),
+        })
         : base;
     return {
         ...base,
-        run: async (session, capability, toolName, input, signal) => (await routed(session)).run(session, capability, toolName, input, signal),
-        listFiles: async (session, capability, dir, maxEntries, signal) => (await routed(session)).listFiles(session, capability, dir, maxEntries, signal),
-        readBytes: async (session, capability, path, maxBytes, signal) => (await routed(session)).readBytes(session, capability, path, maxBytes, signal),
-        disk: async (session, capability, op, signal) => (await routed(session)).disk(session, capability, op, signal),
+        run: async (session, sandbox, toolName, input, signal) => (await routed(session)).run(session, sandbox, toolName, input, signal),
+        listFiles: async (session, sandbox, dir, maxEntries, signal) => (await routed(session)).listFiles(session, sandbox, dir, maxEntries, signal),
+        readBytes: async (session, sandbox, path, maxBytes, signal) => (await routed(session)).readBytes(session, sandbox, path, maxBytes, signal),
+        disk: async (session, sandbox, op, signal) => (await routed(session)).disk(session, sandbox, op, signal),
     };
 }

package/dist/host/gates.js

@@ -178,8 +178,8 @@ export async function startEgress(options) {
         sandboxes: { live: async (sandboxId) => storeEgressSandboxes((await tenant.open()).store).live(sandboxId) },
         // Each connection on the Tenant's record (R7.3): the gates' one write into it.
         record: {
-            holder: async (environmentId) => storeEgressRecord((await tenant.open()).store).holder(environmentId),
-            write: async (holder, connection) => storeEgressRecord((await tenant.open()).store).write(holder, connection),
+            runningTurns: async (environmentId) => storeEgressRecord((await tenant.open()).store).runningTurns(environmentId),
+            write: async (connection) => storeEgressRecord((await tenant.open()).store).write(connection),
         },
         credentials: {
             bound: async (sandboxId, host) => (await tenant.open()).environmentSecretBound(sandboxId, host),

package/dist/host/stack-config.js

@@ -459,7 +459,7 @@ function parseSandboxes(env) {
         return undefined;
     const token = read(env, "NYLORUN_SANDBOXES_TOKEN");
     if (token === undefined || token.length < 32)
-        throw new StackConfigError("NYLORUN_SANDBOXES_TOKEN (at least 32 characters) is required with NYLORUN_SANDBOXES_URL (`nylorun sandbox enable` sets both)");
+        throw new StackConfigError("NYLORUN_SANDBOXES_TOKEN (at least 32 characters) is required with NYLORUN_SANDBOXES_URL (`nylorun local sandbox enable` sets both)");
     const harnessImage = read(env, "NYLORUN_SANDBOX_HARNESS_IMAGE");
     if (harnessImage === undefined || /\s/.test(harnessImage))
         throw new StackConfigError("NYLORUN_SANDBOX_HARNESS_IMAGE is required with NYLORUN_SANDBOXES_URL: the Runtime image sandbox pods copy the engine from (`nylorun start` sets it)");