@nylorun/runtime 0.24.0-beta → 0.26.0-beta

package/dist/sandbox/resolve.d.ts

@@ -1,10 +1,10 @@
 /**
  * Resolves an Environment's recipe (`PUT /v1/environments/{id}`) against its Tenant's limits,
- * and the sandbox spec a recipe gives the session's sandbox capability and the pod. Pure: the
+ * and the sandbox spec a recipe gives a session's pinned manifest (its `runtime` block) and the pod. Pure: the
  * caller supplies the configuration. Every problem is reported, not only the first, so one
  * response lists all of them.
  */
-import type { EnvironmentFile, EnvironmentKind, EnvironmentLifecycle, EnvironmentRecipe, EnvironmentSetupCommand } from "@nylorun/core/contracts";
+import type { EnvironmentFile, EnvironmentKind, EnvironmentLifecycle, EnvironmentRecipe, EnvironmentSecretSlots, EnvironmentSetupCommand } from "@nylorun/core/contracts";
 import { type SandboxManifest } from "@nylorun/core/define";
 import type { PodSandboxSpec } from "./pods/spec.js";
 import { type EffectiveSandboxConfig } from "./tenant-config.js";
@@ -23,6 +23,8 @@ export interface RecipeRequest {
     readonly lifecycle?: EnvironmentLifecycle;
     readonly setup?: readonly EnvironmentSetupCommand[];
     readonly files?: readonly EnvironmentFile[];
+    /** The secret slots (D64): passed through for every kind. */
+    readonly secrets?: EnvironmentSecretSlots;
 }
 export type RecipeResolution = {
     readonly kind: "recipe";
@@ -34,7 +36,7 @@ export type RecipeResolution = {
 /** The recipe `request` asks for an Environment of `kind`, or every reason it cannot have it. */
 export declare function resolveRecipe(kind: EnvironmentKind, request: RecipeRequest, config: EffectiveSandboxConfig): RecipeResolution;
 /**
- * The sandbox spec of a recipe: what the session's sandbox capability pins and the virtual
+ * The sandbox spec of a recipe: what a session's `runtime` block pins and the virtual
  * workspace runs. Idle is the Environment's `lifecycle.idle`, else the Tenant's.
  */
 export declare function sandboxSpecOf(recipe: EnvironmentRecipe, tenantIdle: string): SandboxManifest;

package/dist/sandbox/resolve.js

@@ -20,7 +20,7 @@ export function resolveRecipe(kind, request, config) {
                 errors.push(`${field} is for an Environment with a sandbox: kind none has none.`);
         if (errors.length > 0)
             return { kind: "error", errors };
-        return { kind: "recipe", recipe: { harness, lifecycle: { ...lifecycle } } };
+        return { kind: "recipe", recipe: { harness, lifecycle: { ...lifecycle }, ...slotsOf(request) } };
     }
     if (request.image !== undefined && !pod)
         errors.push("image is for kind pod: a virtual Environment runs no images.");
@@ -57,11 +57,18 @@ export function resolveRecipe(kind, request, config) {
             lifecycle: { ...lifecycle },
             ...(pod && request.setup?.length ? { setup: request.setup.map((command) => ({ ...command })) } : {}),
             ...(pod && request.files?.length ? { files: request.files.map((file) => ({ ...file })) } : {}),
+            ...slotsOf(request),
         },
     };
 }
+/** The request's secret slots, when it declares any. */
+function slotsOf(request) {
+    return request.secrets !== undefined && Object.keys(request.secrets).length > 0
+        ? { secrets: structuredClone(request.secrets) }
+        : {};
+}
 /**
- * The sandbox spec of a recipe: what the session's sandbox capability pins and the virtual
+ * The sandbox spec of a recipe: what a session's `runtime` block pins and the virtual
  * workspace runs. Idle is the Environment's `lifecycle.idle`, else the Tenant's.
  */
 export function sandboxSpecOf(recipe, tenantIdle) {

package/dist/sandbox/runtime-tools.d.ts

@@ -0,0 +1,9 @@
+import { type AgentManifest, type SandboxManifest } from "@nylorun/core/define";
+/**
+ * The session's sandbox spec when `toolName` is one of the sandbox tools the Runtime pinned on
+ * `manifest` (its `runtime` block); undefined for any other tool. A tool's name alone says whose
+ * it is: an author tool may not take a Runtime tool's name.
+ */
+export declare function sandboxToolSpec(manifest: AgentManifest | undefined, toolName: string | undefined): SandboxManifest | undefined;
+/** True when `toolName` is a tool the Runtime pinned on `manifest` (its `runtime.tools`). */
+export declare function isPinnedRuntimeTool(manifest: AgentManifest | undefined, toolName: string | undefined): boolean;

package/dist/sandbox/runtime-tools.js

@@ -0,0 +1,16 @@
+import { isSandboxToolName, runtimeToolOf, } from "@nylorun/core/define";
+/**
+ * The session's sandbox spec when `toolName` is one of the sandbox tools the Runtime pinned on
+ * `manifest` (its `runtime` block); undefined for any other tool. A tool's name alone says whose
+ * it is: an author tool may not take a Runtime tool's name.
+ */
+export function sandboxToolSpec(manifest, toolName) {
+    if (!toolName || !isSandboxToolName(toolName))
+        return undefined;
+    const sandbox = manifest?.runtime?.sandbox;
+    return sandbox !== undefined && runtimeToolOf(manifest, toolName) !== undefined ? sandbox : undefined;
+}
+/** True when `toolName` is a tool the Runtime pinned on `manifest` (its `runtime.tools`). */
+export function isPinnedRuntimeTool(manifest, toolName) {
+    return runtimeToolOf(manifest, toolName) !== undefined;
+}

package/dist/sandbox/session-sandbox.d.ts

@@ -7,12 +7,10 @@ export type SandboxedManifest = {
     readonly ok: false;
     readonly message: string;
 };
-/** The agent's manifest with the sandbox capability added, or why it cannot take one. */
-export declare function withSandboxCapability(manifest: AgentManifest, spec: SandboxManifest): SandboxedManifest;
+/** The agent's pinned manifest with the session's sandbox, or why it cannot take one. */
+export declare function withSandbox(manifest: AgentManifest, spec: SandboxManifest): SandboxedManifest;
 /**
  * The pinned manifest of an agent session without a sandbox: `read_artifact` for each agent of
- * the tree with a remote MCP server or an HTTP tool (R2b C11), and `nylorun.tools` for each with
- * a remote MCP server (R2b C10). Undefined when nothing is added, and the session pins its
- * definition as it is.
+ * the tree (R2b C11, protocol 12), and the skill tools for each with skills.
  */
-export declare function withPlatformTools(manifest: AgentManifest): SandboxedManifest | undefined;
+export declare function withRuntimeTools(manifest: AgentManifest): SandboxedManifest;

package/dist/sandbox/session-sandbox.js

@@ -1,124 +1,77 @@
 /**
- * Gives a session the sandbox chosen when it was opened, and the platform tools its agents
- * need. An agent session's pinned manifest is its definition plus:
+ * Gives a session the sandbox chosen when it was opened, and the Runtime tools its agents need.
+ * An agent session's pinned manifest is its definition with a `runtime` block
+ * (`runtimeManifestFor`) on each agent of the tree:
  *
- * - with a sandbox, the `nylorun.sandbox` capability (the six built-in tools, the sandbox
- *   instructions and the resolved spec) and the `nylorun.artifacts` capability
- *   (`save_artifact`), also added to each agent it uses as a tool, so the tree shares one spec.
- *   The sandbox's instructions name the agent's skills' folders (`/skills/<name>/`);
- * - for each agent of the tree with a remote MCP server or an HTTP tool, `read_artifact` in its
- *   `nylorun.artifacts` capability (R2b C11), with or without a sandbox: the Runtime stores a
- *   result of those tools too large to show as an artifact, and the model reads it in pages.
- *   An agent that declares a tool named `read_artifact` keeps its own, and sees previews only;
- * - for each agent of the tree with a remote MCP server, the `nylorun.tools` capability (R2b
- *   C10), empty: when the session defers some of the agent's MCP tools, its session tools put
- *   `tool_search` and `tool_call` there. An agent that declares either name defers nothing.
+ * - with a sandbox, the six sandbox tools, their instructions and the resolved spec, and
+ *   `save_artifact`, so files the agent makes reach the user (F8.1). The agents it uses as tools
+ *   get the same spec, so the tree shares one sandbox. The sandbox's instructions name the
+ *   agent's skills' folders (`/skills/<name>@<hash>/`);
+ * - with or without a sandbox, `read_artifact` (R2b C11, protocol 12): the Runtime stores a result
+ *   of an MCP or HTTP tool too large to show as an artifact, and the model reads it in pages; a
+ *   file of an earlier turn is a reference line the model reads again with it;
+ * - with skills, `load_skill`, `read_skill_resource` and the skill catalog.
  *
- * The definition in the registry never changes.
+ * `tool_search` and `tool_call` are not pinned: they are session tools, given per run when the
+ * session defers some MCP tools (R2b C10). An author tool may not take any of these names (the
+ * manifest schema refuses it), so a tool's name alone says whose it is. The definition in the
+ * registry never changes.
  */
 import { AgentManifestSchema } from "@nylorun/core/contracts";
-import { READ_ARTIFACT_TOOL, TOOL_CALL_TOOL, TOOL_SEARCH_TOOL, TOOLS_CAPABILITY_ID, artifactsCapabilityManifest, hashManifest, sandboxCapabilityManifest, toolsCapabilityManifest, } from "@nylorun/core/define";
-import { sandboxSpecOf } from "./share.js";
+import { hashManifest, runtimeManifestFor, } from "@nylorun/core/define";
 function isAgentManifest(value) {
     return (typeof value === "object" &&
         value !== null &&
         value.kind !== "workflow" &&
-        Array.isArray(value.capabilities));
+        typeof value.id === "string");
 }
-/** The names of the agent's own skills. */
-function skillNamesOf(manifest) {
-    return manifest.capabilities.flatMap((capability) => Object.keys(capability.skills ?? {})).sort();
-}
-/**
- * True when the agent itself declares a remote MCP server or an HTTP tool, whose results the
- * Runtime may store as artifacts (R2b C11), and no tool of its own is named `read_artifact`.
- */
-function readsStoredResults(manifest) {
-    const remote = manifest.capabilities.some((capability) => Object.keys(capability.mcpServers ?? {}).length > 0 ||
-        (capability.tools ?? []).some((tool) => tool.http !== undefined));
-    const taken = manifest.capabilities.some((capability) => (capability.tools ?? []).some((tool) => tool.name === READ_ARTIFACT_TOOL));
-    return remote && !taken;
-}
-/**
- * True when the agent itself declares a remote MCP server, some of whose tools the session may
- * defer (R2b C10), and names no tool `tool_search` or `tool_call` (it then keeps every tool in
- * its list).
- */
-function defersTools(manifest) {
-    const servers = manifest.capabilities.some((capability) => Object.keys(capability.mcpServers ?? {}).length > 0);
-    const taken = manifest.capabilities.some((capability) => capability.id === TOOLS_CAPABILITY_ID ||
-        (capability.tools ?? []).some((tool) => tool.name === TOOL_SEARCH_TOOL || tool.name === TOOL_CALL_TOOL));
-    return servers && !taken;
-}
-/** `manifest` with the session's capabilities added; the same object when none are. */
-function addCapabilities(manifest, spec) {
+/** `manifest` with its `runtime` block, and each agent it uses as a tool with its own. */
+function pinRuntime(manifest, spec) {
     let changed = false;
-    const capabilities = manifest.capabilities.map((capability) => {
-        if (capability.tools === undefined)
-            return capability;
-        let toolsChanged = false;
-        const tools = capability.tools.map((tool) => {
-            // Agents used as tools share the session's sandbox; flow agents used as tools run in
-            // linked sessions that inherit it. One that declares its own sandbox keeps it.
-            if (tool.agent === undefined || !isAgentManifest(tool.agent))
-                return tool;
-            const agent = addCapabilities(tool.agent, sandboxSpecOf(tool.agent) === undefined ? spec : undefined);
-            if (agent === tool.agent)
-                return tool;
-            toolsChanged = true;
-            return { ...tool, agent };
-        });
-        if (!toolsChanged)
-            return capability;
+    const tools = manifest.tools?.map((tool) => {
+        // Agents used as tools share the session's sandbox; flow agents used as tools run in linked
+        // sessions that inherit it.
+        if (tool.agent === undefined || !isAgentManifest(tool.agent))
+            return tool;
+        const agent = pinRuntime(tool.agent, spec);
+        if (agent === tool.agent)
+            return tool;
         changed = true;
-        return { ...capability, tools };
+        return { ...tool, agent };
+    });
+    const runtime = runtimeManifestFor(manifest, {
+        ...(spec === undefined ? {} : { sandbox: spec }),
+        save: spec !== undefined,
+        read: true,
     });
-    const save = spec !== undefined;
-    const read = readsStoredResults(manifest);
-    const defer = defersTools(manifest);
-    if (!save && !read && !defer && !changed)
+    if (runtime === undefined && !changed)
         return manifest;
     return {
         ...manifest,
-        // With a sandbox comes `save_artifact`, so files the agent makes reach the user (F8.1). The
-        // sandbox's instructions name where the agent's skills are (R2 M4).
-        capabilities: [
-            ...capabilities,
-            ...(spec === undefined
-                ? []
-                : [sandboxCapabilityManifest(spec, { skills: skillNamesOf(manifest) })]),
-            ...(save || read ? [artifactsCapabilityManifest({ save, read })] : []),
-            // Empty: when the session defers MCP tools, its tools put tool_search and tool_call here.
-            ...(defer ? [toolsCapabilityManifest()] : []),
-        ],
+        ...(changed ? { tools } : {}),
+        ...(runtime === undefined ? {} : { runtime }),
     };
 }
-/** `sandboxed` checked as a manifest, with its hash. */
-function checked(original, sandboxed) {
-    const parsed = AgentManifestSchema.safeParse(sandboxed);
+/** `pinned` checked as a manifest, with its hash. */
+function checked(original, pinned) {
+    const parsed = AgentManifestSchema.safeParse(pinned);
     if (!parsed.success) {
         const issues = parsed.error.issues.map((issue) => issue.message);
-        const clash = issues.some((message) => message === "Tool names must be unique");
         return {
             ok: false,
-            message: clash
-                ? `'${original.id}' declares a tool named like a sandbox tool (bash, read, write, edit, grep, glob, save_artifact). Rename it, or open the session on no Environment or one of kind none.`
-                : `'${original.id}' cannot take this sandbox: ${[...new Set(issues)].join("; ")}`,
+            message: `'${original.id}' cannot take the Runtime's tools: ${[...new Set(issues)].join("; ")}`,
         };
     }
-    return { ok: true, manifest: sandboxed, manifestHash: hashManifest(sandboxed) };
+    return { ok: true, manifest: pinned, manifestHash: hashManifest(pinned) };
 }
-/** The agent's manifest with the sandbox capability added, or why it cannot take one. */
-export function withSandboxCapability(manifest, spec) {
-    return checked(manifest, addCapabilities(manifest, spec));
+/** The agent's pinned manifest with the session's sandbox, or why it cannot take one. */
+export function withSandbox(manifest, spec) {
+    return checked(manifest, pinRuntime(manifest, spec));
 }
 /**
  * The pinned manifest of an agent session without a sandbox: `read_artifact` for each agent of
- * the tree with a remote MCP server or an HTTP tool (R2b C11), and `nylorun.tools` for each with
- * a remote MCP server (R2b C10). Undefined when nothing is added, and the session pins its
- * definition as it is.
+ * the tree (R2b C11, protocol 12), and the skill tools for each with skills.
  */
-export function withPlatformTools(manifest) {
-    const pinned = addCapabilities(manifest, undefined);
-    return pinned === manifest ? undefined : checked(manifest, pinned);
+export function withRuntimeTools(manifest) {
+    return checked(manifest, pinRuntime(manifest, undefined));
 }

package/dist/sandbox/setup.d.ts

@@ -37,7 +37,10 @@ export declare function parseSetupReport(value: unknown): SetupReport | undefine
  * command failed and how. A report from an older host, or a success, changes nothing.
  */
 export declare function recordSetup(ctx: TenantContext, id: string, epoch: number, report: SetupReport): Promise<void>;
-/** Whether the engine of `id` should run its setup again: the pod is no longer `failed`. */
+/**
+ * Whether the engine of `id` should run its setup (again): the pod is no longer `failed`, and
+ * the disk version a fork starts from is written (Q17).
+ */
 export declare function setupState(ctx: TenantContext, id: string): Promise<{
     retry: boolean;
     setup?: SetupPlan;

package/dist/sandbox/setup.js

@@ -1,5 +1,7 @@
 import { parseSandboxDuration } from "@nylorun/core/define";
 import { contentKey, readManifest } from "../artifacts/folders.js";
+import { contentTypeFor } from "../artifacts/media-types.js";
+import { definitionFileKey } from "../tenant/definition-files.js";
 import { SETUP_FAILED } from "./pods/lifecycle.js";
 export { SETUP_FAILED };
 /** The most of a failed command's output kept in its event and reason. */
@@ -49,8 +51,12 @@ export async function recordSetup(ctx, id, epoch, report) {
         const pod = environment?.pod;
         if (!environment || !pod || pod.hostEpoch !== epoch || pod.desired !== "running")
             return;
-        if (report.status === "ok")
+        if (report.status === "ok") {
+            // A fork's setup ran on its written disk (Q17): its turns may start.
+            if (environment.diskSeed?.setup && environment.diskSeed.written)
+                await t.updateEnvironment(id, { diskSeed: null }, new Date().toISOString());
             return;
+        }
         const command = report.index === undefined ? undefined : environment.applied.setup?.[report.index];
         const what = command === undefined ? "copying the input files failed" : `command ${report.index + 1} (${command.command.slice(0, 80)}) exited ${report.exitCode ?? "abnormally"}`;
         const tail = (report.output ?? "").trim().slice(-500);
@@ -70,7 +76,10 @@ export async function recordSetup(ctx, id, epoch, report) {
     else
         ctx.config.logger.info("environment setup done", { environmentId: id });
 }
-/** Whether the engine of `id` should run its setup again: the pod is no longer `failed`. */
+/**
+ * Whether the engine of `id` should run its setup (again): the pod is no longer `failed`, and
+ * the disk version a fork starts from is written (Q17).
+ */
 export async function setupState(ctx, id) {
     return ctx.store.tx(async (t) => {
         const environment = await t.environment(id);
@@ -79,6 +88,8 @@ export async function setupState(ctx, id) {
             return { retry: false };
         if (pod.observed === "failed")
             return { retry: false };
+        if (environment.diskSeed && !environment.diskSeed.written)
+            return { retry: false };
         const setup = await setupPlanOf(ctx, t, environment);
         return { retry: true, ...(setup ? { setup } : {}) };
     });
@@ -88,11 +99,37 @@ export async function setupState(ctx, id) {
  * listing, or (with `path`) one of the folder's files. Undefined when there is no such file.
  */
 export async function setupFile(ctx, id, index, path) {
-    const found = await ctx.store.tx(async (t) => {
+    const entry = await ctx.store.tx(async (t) => {
         const environment = await t.environment(id);
-        const file = environment?.applied.files?.[index];
-        if (!file)
+        return environment?.applied.files?.[index];
+    });
+    if (!entry)
+        return undefined;
+    if ("files" in entry) {
+        // Files by hash (Q6): a folder of definition files.
+        if (path === undefined) {
+            const sizes = await ctx.store.tx(async (t) => {
+                const found = new Map();
+                for (const sha256 of new Set(Object.values(entry.files))) {
+                    const row = await t.definitionFile(sha256);
+                    if (row)
+                        found.set(sha256, row.size);
+                }
+                return found;
+            });
+            return {
+                kind: "folder",
+                entries: Object.entries(entry.files).map(([item, sha256]) => ({ path: item, size: sizes.get(sha256) ?? 0 })),
+            };
+        }
+        const sha256 = Object.hasOwn(entry.files, path) ? entry.files[path] : undefined;
+        if (sha256 === undefined)
             return undefined;
+        const got = await ctx.blobs.get(definitionFileKey(sha256));
+        return got ? { kind: "file", contentType: contentTypeFor(path), body: got.body } : undefined;
+    }
+    const file = entry;
+    const found = await ctx.store.tx(async (t) => {
         const artifact = await t.artifact(file.artifactId);
         if (!artifact || artifact.sessionId !== null)
             return undefined;
@@ -115,9 +152,9 @@ export async function setupFile(ctx, id, index, path) {
                 .filter((entry) => entry.type === undefined)
                 .map((entry) => ({ path: entry.path, size: entry.size })),
         };
-    const entry = manifest.entries.find((item) => item.path === path && item.type === undefined);
-    if (!entry)
+    const listed = manifest.entries.find((item) => item.path === path && item.type === undefined);
+    if (!listed)
         return undefined;
-    const got = await ctx.blobs.get(contentKey(entry.sha256));
-    return got ? { kind: "file", contentType: entry.contentType, body: got.body } : undefined;
+    const got = await ctx.blobs.get(contentKey(listed.sha256));
+    return got ? { kind: "file", contentType: listed.contentType, body: got.body } : undefined;
 }

package/dist/sandbox/share.d.ts

@@ -3,7 +3,7 @@
  * workspace, with the spec pinned when the session was opened (`Session.sandbox`). Definitions
  * no longer declare one (Sandboxes v3); `sandboxSpecOf` still reads a pinned manifest's.
  */
-import { type AgentManifest, type CapabilityManifest, type SandboxManifest, type WorkflowManifest } from "@nylorun/core/define";
+import { type AgentManifest, type SandboxManifest, type WorkflowManifest } from "@nylorun/core/define";
 export type SessionSandboxRef = {
     readonly id: string;
     readonly ownerUserId: string;
@@ -15,16 +15,21 @@ export type SessionSandboxRef = {
 };
 /** The session's sandbox spec: the one pinned at open, else the one its definition declares. */
 export declare function sessionSandboxSpec(session: SessionSandboxRef): SandboxManifest | undefined;
-/** Sandbox spec declared on an agent capability or a workflow manifest. */
+/** The sandbox spec of a pinned agent manifest (its `runtime` block) or a workflow manifest. */
 export declare function sandboxSpecOf(manifest: AgentManifest | WorkflowManifest | Record<string, unknown> | undefined): SandboxManifest | undefined;
 /**
- * Where a definition document declares a sandbox: agent capabilities, the agents inlined as
- * tools or embedded in a flow agent, and a workflow's `sandbox`. Definitions no longer declare
- * one (Sandboxes v3), so registration refuses any of these.
+ * Where a definition document declares a sandbox: a workflow's `sandbox`, and the agents embedded
+ * in a flow agent. Definitions no longer declare one (Sandboxes v3), so registration refuses any
+ * of these. An agent manifest cannot: its sandbox is in the `runtime` block, which the schema
+ * refuses at registration.
  */
 export declare function declaredSandboxes(manifest: unknown, into?: string[]): string[];
-/** Synthetic capability so SandboxManager.run can use a workflow (or shared) spec. */
-export declare function capabilityForSandbox(sandbox: SandboxManifest): CapabilityManifest;
+/**
+ * The agents of a definition document that set `runtime`: the document itself, the agents it
+ * uses as tools and those embedded in a flow agent. Only the Runtime writes that block, when it
+ * pins a session's manifest, so registration refuses any of these.
+ */
+export declare function authoredRuntimeBlocks(manifest: unknown, into?: string[]): string[];
 /**
  * The workspace a session's sandbox tools run in: the session, whose log records the
  * workspace's events, and its Environment, whose id keys the workspace.

package/dist/sandbox/share.js

@@ -8,24 +8,19 @@ import {} from "@nylorun/core/define";
 export function sessionSandboxSpec(session) {
     return session.sandbox ?? sandboxSpecOf(session.manifest);
 }
-/** Sandbox spec declared on an agent capability or a workflow manifest. */
+/** The sandbox spec of a pinned agent manifest (its `runtime` block) or a workflow manifest. */
 export function sandboxSpecOf(manifest) {
     if (!manifest || typeof manifest !== "object")
         return undefined;
     if (manifest.kind === "workflow")
         return manifest.sandbox;
-    const capabilities = manifest.capabilities;
-    if (!Array.isArray(capabilities))
-        return undefined;
-    for (const capability of capabilities)
-        if (capability.sandbox)
-            return capability.sandbox;
-    return undefined;
+    return manifest.runtime?.sandbox;
 }
 /**
- * Where a definition document declares a sandbox: agent capabilities, the agents inlined as
- * tools or embedded in a flow agent, and a workflow's `sandbox`. Definitions no longer declare
- * one (Sandboxes v3), so registration refuses any of these.
+ * Where a definition document declares a sandbox: a workflow's `sandbox`, and the agents embedded
+ * in a flow agent. Definitions no longer declare one (Sandboxes v3), so registration refuses any
+ * of these. An agent manifest cannot: its sandbox is in the `runtime` block, which the schema
+ * refuses at registration.
  */
 export function declaredSandboxes(manifest, into = []) {
     if (!manifest || typeof manifest !== "object")
@@ -38,22 +33,29 @@ export function declaredSandboxes(manifest, into = []) {
             declaredSandboxes(agent, into);
         return into;
     }
-    for (const capability of document.capabilities ?? []) {
-        if (capability.sandbox !== undefined)
-            into.push(`'${document.id}' (capability '${capability.id}')`);
-        for (const tool of capability.tools ?? [])
-            declaredSandboxes(tool.agent, into);
-    }
+    for (const tool of document.tools ?? [])
+        declaredSandboxes(tool.agent, into);
     return into;
 }
-/** Synthetic capability so SandboxManager.run can use a workflow (or shared) spec. */
-export function capabilityForSandbox(sandbox) {
-    return {
-        id: "sandbox",
-        type: "agent",
-        sandbox,
-        tools: [],
-    };
+/**
+ * The agents of a definition document that set `runtime`: the document itself, the agents it
+ * uses as tools and those embedded in a flow agent. Only the Runtime writes that block, when it
+ * pins a session's manifest, so registration refuses any of these.
+ */
+export function authoredRuntimeBlocks(manifest, into = []) {
+    if (!manifest || typeof manifest !== "object")
+        return into;
+    const document = manifest;
+    if (document.kind === "workflow") {
+        for (const agent of Object.values(document.agents ?? {}))
+            authoredRuntimeBlocks(agent, into);
+        return into;
+    }
+    if (document.runtime !== undefined)
+        into.push(`'${document.id}'`);
+    for (const tool of document.tools ?? [])
+        authoredRuntimeBlocks(tool.agent, into);
+    return into;
 }
 /**
  * The workspace a session's sandbox tools run in: the session, whose log records the

package/dist/sandbox/skills.d.ts

@@ -2,12 +2,14 @@ import { type AgentManifest } from "@nylorun/core/define";
 import type { SandboxHandle } from "./types.js";
 /** A skill's files, by path in its folder, as `sha256:<hex>`. */
 export type SkillFiles = Readonly<Record<string, string>>;
-/** The skills of the agent and the agents it uses as tools; the first of a name wins. */
+/**
+ * The skill versions of the agent and the agents it uses as tools, by folder
+ * (`/skills/<name>@<hash>`): each distinct version once.
+ */
 export declare function sandboxSkillsOf(manifest: AgentManifest | undefined, into?: Map<string, Readonly<Record<string, string>>>): Map<string, SkillFiles>;
-/** What a mounted skill holds, to tell whether a workspace has these files already. */
-export declare function skillSignature(files: SkillFiles): string;
 /**
- * Writes one skill's files to `/skills/<name>/` of the sandbox, replacing what was there, and
- * makes them read-only. `read` gives a file's bytes by `sha256:<hex>`.
+ * Writes one skill version's files to its folder `root` (`/skills/<name>@<hash>`), replacing a
+ * partial copy a failed mount left, and makes them read-only. `read` gives a file's bytes by
+ * `sha256:<hex>`.
  */
-export declare function mountSkill(handle: SandboxHandle, name: string, files: SkillFiles, read: (sha256: string) => Promise<Uint8Array>, signal: AbortSignal): Promise<void>;
+export declare function mountSkill(handle: SandboxHandle, root: string, files: SkillFiles, read: (sha256: string) => Promise<Uint8Array>, signal: AbortSignal): Promise<void>;

package/dist/sandbox/skills.js

@@ -1,36 +1,37 @@
 /**
- * A sandbox's skills (track R2 M4): each skill of the session's agent, and of the agents it uses
- * as tools (they share its sandbox), gets its files under `/skills/<name>/`, read-only, so the
- * model can read them and run their scripts with bash. The SandboxManager mounts them on a
- * workspace before the first call of a session's run that opens it, and again when a session
- * with other skills uses it; the bytes come from the Tenant's definition files.
+ * A sandbox's skills (track R2 M4, D66): each version of a skill of the session's agent, and of
+ * the agents it uses as tools (they share its sandbox), gets its files in its own folder,
+ * `/skills/<name>@<hash>/` (`skillFolderOf`), read-only, so the model can read them and run their
+ * scripts with bash. A version's folder is written once and never replaced: sessions whose agents
+ * carry different versions of one skill share an Environment, and run turns at once, without
+ * changing each other's files. The SandboxManager mounts the folders a session needs before the
+ * first call that needs them; the bytes come from the Tenant's definition files. Folders live
+ * outside the persisted disk, so a stop clears them and the next open mounts what is in use.
  */
 import { posix } from "node:path";
-import { SKILLS_MOUNT } from "@nylorun/core/define";
-import { canonical } from "../store/canonical.js";
+import { skillFolderOf } from "@nylorun/core/define";
 import { quote } from "./tools.js";
-/** The skills of the agent and the agents it uses as tools; the first of a name wins. */
+/**
+ * The skill versions of the agent and the agents it uses as tools, by folder
+ * (`/skills/<name>@<hash>`): each distinct version once.
+ */
 export function sandboxSkillsOf(manifest, into = new Map()) {
-    for (const capability of manifest?.capabilities ?? []) {
-        for (const skill of Object.values(capability.skills ?? {}))
-            if (!into.has(skill.name))
-                into.set(skill.name, skill.files);
-        for (const tool of capability.tools ?? [])
-            if (tool.agent !== undefined && !("kind" in tool.agent))
-                sandboxSkillsOf(tool.agent, into);
+    for (const skill of Object.values(manifest?.skills ?? {})) {
+        const folder = skillFolderOf(skill);
+        if (!into.has(folder))
+            into.set(folder, skill.files);
     }
+    for (const tool of manifest?.tools ?? [])
+        if (tool.agent !== undefined && !("kind" in tool.agent))
+            sandboxSkillsOf(tool.agent, into);
     return into;
 }
-/** What a mounted skill holds, to tell whether a workspace has these files already. */
-export function skillSignature(files) {
-    return canonical(files);
-}
 /**
- * Writes one skill's files to `/skills/<name>/` of the sandbox, replacing what was there, and
- * makes them read-only. `read` gives a file's bytes by `sha256:<hex>`.
+ * Writes one skill version's files to its folder `root` (`/skills/<name>@<hash>`), replacing a
+ * partial copy a failed mount left, and makes them read-only. `read` gives a file's bytes by
+ * `sha256:<hex>`.
  */
-export async function mountSkill(handle, name, files, read, signal) {
-    const root = `${SKILLS_MOUNT}/${name}`;
+export async function mountSkill(handle, root, files, read, signal) {
     const exec = async (command) => {
         const result = await handle.exec({ command, cwd: "/", timeoutMs: 60_000 }, signal);
         if (result.exitCode !== 0)

package/dist/store/postgres/drizzle/0024_flat_manifest.sql

@@ -0,0 +1,7 @@
+-- Protocol 13: manifest 7, flat (no capabilities), with the Runtime's tools in a `runtime` block.
+-- A fresh start for sessions: one opened before protocol 13 pinned a manifest 5 or 6, which the
+-- engine no longer runs, so it is closed (`session_closed`) and its history stays readable. No
+-- column changes: tool calls are read from the effect journal's documents, whose old
+-- `capabilityId` field is ignored.
+UPDATE "nylorun"."sessions" SET "body" = ("body"::jsonb || '{"closedReason":"protocol_13"}'::jsonb)::json
+WHERE nylorun.doc("body") ->> 'closedReason' IS NULL;

package/dist/store/postgres/drizzle/0025_environment_manifests.sql

@@ -0,0 +1,14 @@
+CREATE TABLE "nylorun"."environment_manifests" (
+	"name" text COLLATE "C" NOT NULL,
+	"version" integer NOT NULL,
+	"body" json NOT NULL,
+	"hash" text COLLATE "C" NOT NULL,
+	"saved_by" json NOT NULL,
+	"created_at" text COLLATE "C" NOT NULL,
+	CONSTRAINT "environment_manifests_pkey" PRIMARY KEY("name","version")
+);
+--> statement-breakpoint
+ALTER TABLE "nylorun"."environments" ADD COLUMN "manifest_name" text COLLATE "C";--> statement-breakpoint
+ALTER TABLE "nylorun"."environments" ADD COLUMN "manifest_version" integer;--> statement-breakpoint
+ALTER TABLE "nylorun"."environments" ADD COLUMN "manifest_hash" text COLLATE "C";--> statement-breakpoint
+CREATE INDEX "environments_manifest" ON "nylorun"."environments" USING btree ("manifest_name","manifest_version");

package/dist/store/postgres/drizzle/0026_environment_forks.sql

@@ -0,0 +1 @@
+ALTER TABLE "nylorun"."environments" ADD COLUMN "forked_from" json;

package/dist/store/postgres/drizzle/0027_environment_image_digest.sql

@@ -0,0 +1 @@
+ALTER TABLE "nylorun"."environments" ADD COLUMN "image_digest" text COLLATE "C";