@nylorun/runtime 0.24.0-beta → 0.26.0-beta

package/dist/tenant/model-setting.js

@@ -1,3 +1,17 @@
+/**
+ * The Tenant's model settings: the fixture model, and the inputs the operator added to catalog
+ * models (`model.inputs`, below).
+ *
+ * The Tenant-level fixture model: Tenant setting `model.fixture`, seeded with
+ * `fixtureModel: true` (`PUT /v1/tenant/config/seed`, Host feature `tenant-fixture-model`).
+ * A Tenant with it answers every model call with the Runtime's deterministic fixture model
+ * (`core/provider.ts` `toolFixtureModel`) instead of its configured model. Smoke checks seed
+ * it (scripts/lib/stack-tenant.mjs).
+ *
+ * The setting is read once per advance, in a transaction the advance makes anyway, so a Tenant
+ * seeded on another node takes it at its next advance.
+ */
+import { ModelInputSchema } from "@nylorun/core/contracts";
 export const FIXTURE_MODEL_SETTING = "model.fixture";
 /** Whether the Tenant uses the fixture model. */
 export async function usesFixtureModel(t) {
@@ -10,3 +24,40 @@ export async function seedFixtureModel(t) {
     await t.putSetting(FIXTURE_MODEL_SETTING, "true");
     return true;
 }
+/**
+ * The inputs the operator added to catalog models (protocol 12, `PUT /v1/tenant/models/inputs`):
+ * Tenant setting `model.inputs`, JSON `{ "<provider>/<model>": ModelInput[] }`. A custom
+ * endpoint keeps its own in its `settings.inputs` instead.
+ */
+export const MODEL_INPUTS_SETTING = "model.inputs";
+/** The added inputs by `<provider>/<model>`. Bad JSON, keys and inputs are left out: never throws. */
+export async function readAddedInputs(t) {
+    const raw = await t.getSetting(MODEL_INPUTS_SETTING);
+    if (raw === undefined)
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return {};
+    const added = {};
+    for (const [key, value] of Object.entries(parsed)) {
+        if (!key.includes("/") || !Array.isArray(value))
+            continue;
+        added[key] = value.filter((input) => ModelInputSchema.safeParse(input).success);
+    }
+    return added;
+}
+/** Sets the inputs added to `<provider>/<model>`; an empty list removes its entry. */
+export async function writeAddedInputs(t, key, inputs) {
+    const added = await readAddedInputs(t);
+    if (inputs.length === 0)
+        delete added[key];
+    else
+        added[key] = [...inputs];
+    await t.putSetting(MODEL_INPUTS_SETTING, JSON.stringify(added));
+}

package/dist/tenant/outbound.d.ts

@@ -37,14 +37,15 @@ export declare function isPrivateAddress(address: string): boolean;
 /** Why the Host refuses `url`, or `undefined` when it may be called. */
 export declare function refusal(url: URL, policy: OutboundPolicy): string | undefined;
 /**
- * POSTs (or, with `method`, PUTs or PATCHes) the JSON `body` to `url` under `policy`. Never
+ * Sends one request to `url` under `policy`: with `method` (default `POST`) and the JSON `body`,
+ * or with no body (and no `content-type`) when `body` is undefined, as for a `GET`. Never
  * throws; `signal` aborts the request.
  */
-export declare function post(target: string, body: string, headers: Record<string, string>, options: {
+export declare function send(target: string, body: string | undefined, headers: Record<string, string>, options: {
     policy: OutboundPolicy;
     signal: AbortSignal;
     maxResponseBytes?: number;
-    method?: "POST" | "PUT" | "PATCH";
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
 }): Promise<OutboundResult>;
 /**
  * A refusal of `guardedFetch`: the Host's policy forbids the URL or every address it resolves
@@ -59,13 +60,13 @@ export declare class OutboundRefused extends Error {
 export declare class OutboundFailed extends Error {
     readonly code: string;
     /**
-     * The request was sent in full before it failed, as `post()`'s `lost` (R2b C7): the server
+     * The request was sent in full before it failed, as `send()`'s `lost` (R2b C7): the server
      * may have acted on it. False for a failure to resolve or connect.
      */
     readonly sent: boolean;
     constructor(message: string, code: string, 
     /**
-     * The request was sent in full before it failed, as `post()`'s `lost` (R2b C7): the server
+     * The request was sent in full before it failed, as `send()`'s `lost` (R2b C7): the server
      * may have acted on it. False for a failure to resolve or connect.
      */
     sent?: boolean);

package/dist/tenant/outbound.js

@@ -76,10 +76,11 @@ function guardedLookup(policy) {
     });
 }
 /**
- * POSTs (or, with `method`, PUTs or PATCHes) the JSON `body` to `url` under `policy`. Never
+ * Sends one request to `url` under `policy`: with `method` (default `POST`) and the JSON `body`,
+ * or with no body (and no `content-type`) when `body` is undefined, as for a `GET`. Never
  * throws; `signal` aborts the request.
  */
-export async function post(target, body, headers, options) {
+export async function send(target, body, headers, options) {
     const { policy, signal } = options;
     const limit = options.maxResponseBytes ?? MAX_RESPONSE_BYTES;
     const url = new URL(target);
@@ -108,8 +109,9 @@ export async function post(target, body, headers, options) {
             headers: {
                 ...headers,
                 host: originalHost,
-                "content-type": "application/json",
-                "content-length": String(Buffer.byteLength(body)),
+                ...(body === undefined
+                    ? {}
+                    : { "content-type": "application/json", "content-length": String(Buffer.byteLength(body)) }),
             },
             lookup: lookup,
             signal,
@@ -156,7 +158,7 @@ export class OutboundFailed extends Error {
     sent;
     constructor(message, code, 
     /**
-     * The request was sent in full before it failed, as `post()`'s `lost` (R2b C7): the server
+     * The request was sent in full before it failed, as `send()`'s `lost` (R2b C7): the server
      * may have acted on it. False for a failure to resolve or connect.
      */
     sent = false) {
@@ -223,7 +225,7 @@ export function guardedFetch(policy, options = {}) {
             outgoing["content-length"] = String(body.byteLength);
         return await new Promise((resolve, reject) => {
             let settled = false;
-            // Set when the request is fully sent, as `post()` does: a failure after it may follow
+            // Set when the request is fully sent, as `send()` does: a failure after it may follow
             // the server acting on the request.
             let delivered = false;
             const settle = (fn) => {

package/dist/tenant/sessions.d.ts

@@ -25,10 +25,14 @@ export declare function listAgentsPublic(ctx: TenantContext, agents: ReadonlySet
         description?: any;
     }[];
 }>;
-export declare function putDefinition(ctx: TenantContext, agentId: string, body: PutAgentRequest): Promise<{
+export declare function putDefinition(ctx: TenantContext, agentId: string, body: PutAgentRequest, options?: {
+    /** Run every check and save nothing (`?dryRun=true`, protocol 14). */
+    dryRun?: boolean;
+}): Promise<{
     agentId: string;
     manifestHash: string;
     implementationVersion: string;
+    dryRun?: boolean | undefined;
 }>;
 /**
  * `access`, when the request acts for a person, limits the list to that person's sessions of

package/dist/tenant/sessions.js

@@ -9,8 +9,8 @@ import { approvalRefusal, codeToolRefusal } from "@nylorun/core/define";
 import { aggregateWaits, isWorkflowManifest } from "../core/flow-host.js";
 import { canonical } from "../store/canonical.js";
 import { sandboxSpecOf } from "../sandbox/resolve.js";
-import { withPlatformTools, withSandboxCapability } from "../sandbox/session-sandbox.js";
-import { declaredSandboxes } from "../sandbox/share.js";
+import { withRuntimeTools, withSandbox } from "../sandbox/session-sandbox.js";
+import { authoredRuntimeBlocks, declaredSandboxes } from "../sandbox/share.js";
 import { effectiveSandboxConfig, readSandboxConfig } from "../sandbox/tenant-config.js";
 import { HARNESS_ID, checkPlacement, requirePods } from "../sandbox/placement.js";
 import { openEnvironment, recordAttachment } from "./environments.js";
@@ -51,7 +51,7 @@ export async function listAgentsPublic(ctx, agents) {
         })),
     };
 }
-export async function putDefinition(ctx, agentId, body) {
+export async function putDefinition(ctx, agentId, body, options = {}) {
     if (body.manifest.id !== agentId)
         fail(400, "Agent id mismatch");
     DefinitionDocumentSchema.parse(body.manifest);
@@ -66,6 +66,9 @@ export async function putDefinition(ctx, agentId, body) {
     const declared = declaredSandboxes(body.manifest);
     if (declared.length > 0)
         fail(400, `${declared.join(", ")} declares a sandbox. Agents no longer declare one: remove .sandbox(), create an Environment with the sandbox (PUT /v1/environments/{id}) and open the session on it, createSession({ environment }). See MIGRATION.md.`);
+    const runtime = authoredRuntimeBlocks(body.manifest);
+    if (runtime.length > 0)
+        fail(400, `${runtime.join(", ")} sets runtime, which only the Runtime writes when it pins a session's agent. Remove it and register the manifest your builder makes.`);
     const definition = {
         ...body,
         manifestHash: hashManifest(body.manifest),
@@ -75,6 +78,8 @@ export async function putDefinition(ctx, agentId, body) {
         const missing = await missingDefinitionFiles(t, body.manifest);
         if (missing.length > 0)
             fail(400, `The definition names ${missing.length} file(s) the Runtime does not hold; upload each with PUT /v1/files/<sha256> first: ${missing.join(", ")}`, { code: "definition_files_missing", details: { missing } });
+        if (options.dryRun)
+            return;
         await t.put("definitions", agentId, definition);
         await t.insertDefinitionFileUses(agentId, definition.manifestHash, files);
     });
@@ -82,6 +87,7 @@ export async function putDefinition(ctx, agentId, body) {
         agentId,
         manifestHash: definition.manifestHash,
         implementationVersion: body.implementationVersion,
+        ...(options.dryRun ? { dryRun: true } : {}),
     };
 }
 /**
@@ -150,6 +156,8 @@ export async function putSession(ctx, id, body, access, options = {}) {
                 ownerUserId: body.ownerUserId,
                 opaque,
             });
+        if (!isWorkflowManifest(definition.manifest))
+            await checkRequirements(t, definition.manifest, environment);
         const config = await readSandboxConfig(t);
         // The harness the session runs for its life (R4.1): its Environment's, else ours. A flow
         // runs in core and our engine, whatever its Environment names.
@@ -163,7 +171,7 @@ export async function putSession(ctx, id, body, access, options = {}) {
         const spec = environment === undefined || environment.kind === "none"
             ? undefined
             : sandboxSpecOf(environment.applied, effectiveSandboxConfig(config).limits.idle);
-        const pinned = spec === undefined ? platformTools(definition) : pin(definition, spec);
+        const pinned = spec === undefined ? runtimeTools(definition) : pin(definition, spec);
         const created = {
             id,
             agentId: body.agentId,
@@ -189,25 +197,50 @@ export async function putSession(ctx, id, body, access, options = {}) {
     });
 }
 /**
- * The manifest a session without a sandbox pins: its agents' `read_artifact` (R2b C11), when
- * one has a remote MCP server or an HTTP tool; nothing otherwise, and for a workflow.
+ * Refuses a session whose agent requires what its Environment lacks (protocol 14, D65): a
+ * sandbox (`any`: kind `virtual` or `pod`), a pod, or a secret its vault does not hold. Every
+ * gap is named in one `409 environment_unsuitable`.
  */
-function platformTools(definition) {
+async function checkRequirements(t, manifest, environment) {
+    const requires = manifest.requires;
+    if (requires === undefined)
+        return;
+    const missing = [];
+    const kind = environment?.kind;
+    if (requires.sandbox === "any" && kind !== "virtual" && kind !== "pod")
+        missing.push("sandbox");
+    if (requires.sandbox === "pod" && kind !== "pod")
+        missing.push("pod");
+    if (requires.secrets?.length) {
+        const vault = environment === undefined ? undefined : await t.vaultOfEnvironment(environment.id);
+        const held = new Set(vault ? (await t.credentialsForVault(vault.id)).map((row) => row.name) : []);
+        for (const name of requires.secrets)
+            if (!held.has(name))
+                missing.push(`secret:${name}`);
+    }
+    if (missing.length === 0)
+        return;
+    const where = environment === undefined ? "the session names no Environment" : `Environment ${environment.id} lacks it`;
+    fail(409, `Agent ${manifest.id} requires ${missing.map((gap) => (gap.startsWith("secret:") ? `the secret ${gap.slice(7)}` : gap === "pod" ? "a pod Environment" : "a sandbox")).join(", ")}, and ${where}.`, { code: "environment_unsuitable", details: { missing } });
+}
+/**
+ * The manifest a session without a sandbox pins: each agent's `runtime` block, with
+ * `read_artifact` (R2b C11) and its skill tools; nothing for a workflow.
+ */
+function runtimeTools(definition) {
     if (isWorkflowManifest(definition.manifest))
         return {};
-    const pinned = withPlatformTools(definition.manifest);
-    if (pinned === undefined)
-        return {};
+    const pinned = withRuntimeTools(definition.manifest);
     if (!pinned.ok)
         return fail(400, pinned.message);
     return { manifest: pinned.manifest, manifestHash: pinned.manifestHash };
 }
-/** The manifest a session with a sandbox pins: the definition with the sandbox capability. */
+/** The manifest a session with a sandbox pins: the definition with the sandbox in its `runtime` block. */
 function pin(definition, spec) {
     // A workflow's manifest stays as registered: its agents inherit the sandbox when they start.
     if (isWorkflowManifest(definition.manifest))
         return {};
-    const sandboxed = withSandboxCapability(definition.manifest, spec);
+    const sandboxed = withSandbox(definition.manifest, spec);
     if (!sandboxed.ok)
         return fail(400, sandboxed.message);
     return { manifest: sandboxed.manifest, manifestHash: sandboxed.manifestHash };

package/dist/tenant/skill-tool.d.ts

@@ -1,11 +1,11 @@
 /**
- * The skill tools (track R2 M4): `load_skill` and `read_skill_resource`, which the build gives
- * the first capability with skills. The Runtime runs them itself, like `save_artifact`, from the
+ * The skill tools (track R2 M4): `load_skill` and `read_skill_resource`, which the Runtime pins
+ * in the `runtime` block of an agent with skills. The Runtime runs them itself, like `save_artifact`, from the
  * definition files uploaded with the agent: no developer process is involved.
  *
  * - `load_skill`: the skill's instructions (its `SKILL.md` after the frontmatter), the paths of
  *   its other files, and, when the session has a sandbox, where they are in it
- *   (`/skills/<name>/`, read-only).
+ *   (`/skills/<name>@<hash>/`, read-only, D66).
  * - `read_skill_resource`: one text file of the skill. A binary file is refused: the model reads
  *   it in the sandbox, when there is one.
  *

package/dist/tenant/skill-tool.js

@@ -1,19 +1,14 @@
-import { LOAD_SKILL_TOOL, SANDBOX_CAPABILITY_ID, SKILL_ENTRY, SKILLS_MOUNT, isSkillTool, skillInstructions, } from "@nylorun/core/define";
-import { sandboxCapabilityOf } from "../sandbox/capability.js";
+import { LOAD_SKILL_TOOL, SKILL_ENTRY, skillFolderOf, isSkillTool, skillInstructions, } from "@nylorun/core/define";
+import { sandboxToolSpec } from "../sandbox/runtime-tools.js";
 import { readDefinitionFile } from "./definition-files.js";
 const failed = (code, message) => ({ kind: "failed", code, message });
 /** True when `request` calls a skill tool the Runtime serves for `manifest`'s agent. */
 export function isSkillToolCall(manifest, request) {
-    return (request.kind === "tool" &&
-        isSkillTool(manifest?.capabilities.find((capability) => capability.id === request.capabilityId), request.toolName));
+    return request.kind === "tool" && isSkillTool(manifest, request.toolName);
 }
 /** Every skill of the agent, by name. */
 function skillsOf(manifest) {
-    const skills = new Map();
-    for (const capability of manifest.capabilities)
-        for (const skill of Object.values(capability.skills ?? {}))
-            skills.set(skill.name, skill);
-    return skills;
+    return new Map(Object.values(manifest.skills ?? {}).map((skill) => [skill.name, skill]));
 }
 /** UTF-8 text, or undefined for bytes that are not (a NUL byte, or invalid UTF-8). */
 function textOf(bytes) {
@@ -35,8 +30,8 @@ export async function callSkillTool(ctx, manifest, request, signal) {
         return request.toolName === LOAD_SKILL_TOOL
             ? { kind: "completed", output: { unknown: name, available: [...skills.keys()].sort() } }
             : failed("skill.unknown", `There is no skill '${name}'.`);
-    const sandboxed = sandboxCapabilityOf(manifest, SANDBOX_CAPABILITY_ID, "bash") !== undefined;
-    const directory = `${SKILLS_MOUNT}/${skill.name}/`;
+    const sandboxed = sandboxToolSpec(manifest, "bash") !== undefined;
+    const directory = `${skillFolderOf(skill)}/`;
     const read = async (path) => {
         const bytes = await readDefinitionFile(ctx.blobs, skill.files[path], signal);
         if (!bytes)

package/dist/tenant/sweep.js

@@ -29,7 +29,7 @@
  *    wiped (§17.11), or a parked outbox row.
  * 4. **Sandboxes.** Idle sandboxes are stopped, records of compute no longer held are marked
  *    stopped, and sandboxes whose session or Environment is gone are removed, by the
- *    workspace capability (`harness-api/workspace.ts`: here, or in the harness that serves
+ *    workspace feature (`harness-api/workspace.ts`: here, or in the harness that serves
  *    workspaces). Idle MCP connections of the in-process harness are closed. As often as the
  *    orphan scan, pod Environments whose change stalled get a reconcile (`reconcileStalePods`).
  *    Environments unused for their `lifecycle.deleteAfter` are deleted

package/dist/tenant/tool-results.js

@@ -170,7 +170,7 @@ async function shapeBinary(shaping, part, index) {
         kept.size <= MODEL_FILE_MAX_BYTES)
         shaping.files.push({
             mediaType: contentType,
-            reference: { artifactId: kept.artifactId, version: kept.version, name },
+            reference: { artifactId: kept.artifactId, version: kept.version, name, size: kept.size },
         });
     return {
         type: part.type,

package/dist/tenant/tool-search.d.ts

@@ -1,16 +1,12 @@
-/**
- * `tool_search` (R2b C10, Q20): core finds an agent's deferred MCP tools in the session's pinned
- * snapshot, ranked with BM25 over their names and descriptions, and returns each match's name,
- * description and `inputSchema`, for the model to run with `tool_call`. It reads only the pinned
- * snapshot, so the same query finds the same tools for the session's life; a tool the turn's
- * manifest disables is never found.
- */
-import { type AgentManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
-import { type McpToolRecord } from "../mcp/snapshot.js";
+import { type McpSnapshot, type McpToolRecord } from "../mcp/snapshot.js";
 import { type TenantContext } from "./context.js";
-/** True when `request` calls `tool_search` of the `nylorun.tools` capability `manifest` has. */
-export declare function isToolSearchCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
+/**
+ * True when `request` calls `tool_search`, the session tool an agent gets when the session's
+ * pinned snapshot holds deferred tools of its own. The name is reserved: no tool of the agent's
+ * own takes it.
+ */
+export declare function isToolSearchCall(snapshot: McpSnapshot | undefined, request: HostEffect): boolean;
 /** Runs `tool_search` for the run's agent. */
 export declare function callToolSearch(ctx: TenantContext, request: HostEffect): Promise<{
     output?: undefined;

package/dist/tenant/tool-search.js

@@ -5,19 +5,22 @@
  * snapshot, so the same query finds the same tools for the session's life; a tool the turn's
  * manifest disables is never found.
  */
-import { TOOL_SEARCH_DEFAULT_LIMIT, TOOL_SEARCH_MAX_LIMIT, TOOL_SEARCH_TOOL, TOOLS_CAPABILITY_ID, } from "@nylorun/core/define";
+import { TOOL_SEARCH_DEFAULT_LIMIT, TOOL_SEARCH_MAX_LIMIT, TOOL_SEARCH_TOOL, } from "@nylorun/core/define";
 import { isEnabledIn } from "../mcp/snapshot.js";
 import { sessionOf } from "./context.js";
 import { turnManifestOf } from "./session.js";
 /** BM25's term saturation and length normalization, the usual values. */
 const K1 = 1.2;
 const B = 0.75;
-/** True when `request` calls `tool_search` of the `nylorun.tools` capability `manifest` has. */
-export function isToolSearchCall(manifest, request) {
+/**
+ * True when `request` calls `tool_search`, the session tool an agent gets when the session's
+ * pinned snapshot holds deferred tools of its own. The name is reserved: no tool of the agent's
+ * own takes it.
+ */
+export function isToolSearchCall(snapshot, request) {
     return (request.kind === "tool" &&
-        request.capabilityId === TOOLS_CAPABILITY_ID &&
         request.toolName === TOOL_SEARCH_TOOL &&
-        manifest?.capabilities.some((capability) => capability.id === TOOLS_CAPABILITY_ID) === true);
+        snapshot?.mcpTools.some((tool) => tool.deferred === true && tool.agentId === request.agent?.id) === true);
 }
 /** Runs `tool_search` for the run's agent. */
 export async function callToolSearch(ctx, request) {