@nylorun/runtime 0.25.0-beta → 0.27.0-beta

package/dist/gates/inflight.js

@@ -1,3 +1,4 @@
+import { hostTuning } from "../tuning.js";
 /** A re-send whose request differs from the call already running under its key. */
 export class InflightConflict extends Error {
     name = "InflightConflict";
@@ -7,8 +8,8 @@ export class InflightStale extends Error {
     name = "InflightStale";
 }
 export function createInflightCalls(options = {}) {
-    const ttlMs = options.ttlMs ?? 30 * 60_000;
-    const max = options.max ?? 10_000;
+    const ttlMs = options.ttlMs ?? hostTuning().gates.inflightTtlMs;
+    const max = options.max ?? hostTuning().gates.inflightMax;
     const now = options.now ?? Date.now;
     const entries = new Map();
     /** Drops expired outcomes, then the oldest settled ones while over `max`. */

package/dist/gates/journal.js

@@ -1,4 +1,3 @@
-import { mcpToolOf } from "../mcp/snapshot.js";
 import { canonical } from "../store/canonical.js";
 import { httpToolRefOf } from "./http-tool.js";
 export function journalCheck(vaults) {
@@ -25,12 +24,11 @@ export function journalCheck(vaults) {
                         return `Effect '${key}' was journaled with other input`;
                     return held(row);
                 }
-                const session = await t.get("sessions", request.sessionId);
-                const tool = mcpToolOf(session?.mcpSnapshot, request);
-                if (!tool ||
-                    tool.serverName !== call.server.serverName ||
-                    (tool.agentId ?? null) !== (call.server.agentId ?? null) ||
-                    tool.serverToolName !== call.name)
+                const target = request.target;
+                if (target?.kind !== "mcp" ||
+                    target.server !== call.server.serverName ||
+                    target.tool !== call.name ||
+                    (request.agent?.id ?? null) !== (call.server.agentId ?? null))
                     return `Effect '${key}' calls another tool`;
                 if (canonical(argumentsOf(request.input)) !== canonical(call.arguments))
                     return `Effect '${key}' was journaled with other input`;

package/dist/gates/mcp-handler.d.ts

@@ -4,12 +4,13 @@ import type { OutboundPolicy } from "../tenant/outbound.js";
 import type { Logger } from "../tenant/types.js";
 import type { McpAnswer } from "./tool-contract.js";
 import { type TenantVaults } from "./tenant-vaults.js";
-/** A connection unused this long is closed; the next request opens it again. */
-export declare const GATE_MCP_IDLE_MS: number;
 export interface McpHandlerOptions {
     readonly vaults: TenantVaults;
     readonly logger: Logger;
-    /** Default `GATE_MCP_IDLE_MS`. */
+    /**
+     * A connection unused this long is closed; the next request opens it again. Default
+     * `gates.mcpIdleMs` (Host tuning, 15 min).
+     */
     readonly idleMs?: number;
     readonly now?: () => number;
     /** Tests replace how a server is opened. */

package/dist/gates/mcp-handler.js

@@ -1,14 +1,14 @@
 import { McpCallFailed, McpConnectionStale, openMcpServer, unreachable, } from "../mcp/connect.js";
 import { findServer } from "../mcp/pool.js";
+import { readRuntimeLimits } from "../tenant/runtime-limits.js";
 import { GateRefusal } from "./tenant-vaults.js";
-/** A connection unused this long is closed; the next request opens it again. */
-export const GATE_MCP_IDLE_MS = 15 * 60_000;
+import { hostTuning } from "../tuning.js";
 /** The server is not one the session may reach through the gate. */
 class NotDeclared extends Error {
 }
 export function createMcpHandler(options) {
     const { vaults, logger } = options;
-    const idleMs = options.idleMs ?? GATE_MCP_IDLE_MS;
+    const idleMs = options.idleMs ?? hostTuning().gates.mcpIdleMs;
     const now = options.now ?? Date.now;
     const open = options.open ?? openMcpServer;
     const live = new Map();
@@ -42,6 +42,7 @@ export function createMcpHandler(options) {
                         ...(server.agentId === undefined ? {} : { agentId: server.agentId }),
                     }),
                     policy: options.delivery ?? {},
+                    errorExcerptChars: (await vault.store.tx((t) => readRuntimeLimits(t))).errorExcerptChars,
                 });
                 const entry = { connection, lastUsedAt: now(), active: 0 };
                 live.set(key, entry);
@@ -80,7 +81,11 @@ export function createMcpHandler(options) {
             // the session is not the server's failure, and stays as it was.
             if (!call || error instanceof GateRefusal || error instanceof NotDeclared)
                 throw error;
-            throw unreachable(server.serverName, error);
+            const limits = await vaults
+                .open(tenantId)
+                .then((vault) => vault.store.tx((t) => readRuntimeLimits(t)))
+                .catch(() => undefined);
+            throw unreachable(server.serverName, error, limits?.errorExcerptChars);
         }
     }
     async function use(tenantId, server, run, call = false) {
@@ -112,10 +117,15 @@ export function createMcpHandler(options) {
      * the call sent once more (R2b C7).
      */
     async function callOnce(tenantId, request, signal) {
+        // The Tenant's Runtime limits, read for this call: the largest answer the gate keeps, and how
+        // much of a failed one its error quotes.
+        const { toolAnswerBytes, errorExcerptChars } = await (await vaults.open(tenantId)).store.tx((t) => readRuntimeLimits(t));
         for (let attempt = 0;; attempt += 1) {
             try {
                 return await use(tenantId, request.server, (entry) => entry.connection.client.callTool({ name: request.name, arguments: request.arguments }, {
                     signal,
+                    maxResultBytes: toolAnswerBytes,
+                    errorExcerptChars,
                     ...(request.key === undefined ? {} : { key: request.key }),
                     ...(request.traceparent === undefined ? {} : { traceparent: request.traceparent }),
                 }), true);
@@ -188,7 +198,7 @@ function errorOf(error) {
             ...(error.code === "credential_rejected" ? { code: 401 } : {}),
             failure: error.failure,
         };
-    const message = error instanceof Error ? error.message.slice(0, 2000) : String(error);
+    const message = error instanceof Error ? error.message.slice(0, hostTuning().gates.errorMessageChars) : String(error);
     const code = error && typeof error === "object" && "code" in error && typeof error.code === "number"
         ? error.code
         : undefined;

package/dist/gates/model-gate.d.ts

@@ -4,11 +4,13 @@
  * call needs that the loop must not hold: the provider credential, pi-ai, its retries and
  * idle watchdog, failure classification and scrubbing.
  *
- * Two implementations: `inProcessModelGate` (embedding, the ephemeral Runtime, tests) and the
+ * Three implementations: `inProcessModelGate` (embedding, the ephemeral Runtime, tests), the
  * HTTP client of the gates service (the `gateway` container), which keeps the credential out
- * of the loop process. Both return what `piModel` returns, so the effect journal is the same
+ * of the loop process, and `providerModelGate`, which serves a Runtime's scripted model (tests,
+ * `model: {kind: "scripted"}`) the same way, metered. Both return what `piModel` returns, so the effect journal is the same
  * either way.
  */
+import type { AgentRef } from "@nylorun/core/define";
 import type { RuntimeModelAdapter, RuntimeModelCall } from "../contracts.js";
 export type { ModelCallSettings } from "../model/pi-model.js";
 /**
@@ -25,6 +27,13 @@ export interface ModelGateRequest {
     /** The effect's journal id; sent as `Idempotency-Key` (acted on from P1.2). */
     readonly effectId: string;
     readonly invocationId: string;
+    /**
+     * The agent used as a tool the call is for; absent for the session's root agent. In process
+     * only: a scripted provider reads it (`providerModelGate`).
+     */
+    readonly agent?: AgentRef;
+    /** A call that summarizes history for a compaction (protocol 15); in process only, like `agent`. */
+    readonly purpose?: "summary";
     readonly call: RuntimeModelCall;
 }
 /** A model candidate or a failure outcome: exactly what `piModel` returns. */

package/dist/gates/policy.d.ts

@@ -10,11 +10,17 @@
  * (`deny`, then `ask`, then `allow`), and a call no rule matches runs. A session pinned to a
  * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
  * the approval it was opened with. A policy that cannot be read refuses every call.
+ *
+ * A rule's `tool` matches the tool's identity (protocol 15): an MCP tool's own name on its
+ * server (`server` names the server), an HTTP tool's declared name, a flow stage's key. The name
+ * a harness gave the model never matches. A stored rule whose `tool` has `__` in it (an MCP tool
+ * named by its old model-facing `server__tool` name) makes the policy unreadable, so every call
+ * is refused until the policy names it by `server` and `tool`: a rule never silently stops
+ * matching.
  */
 import { type ToolPolicy, type ToolRule } from "@nylorun/core/contracts";
 import type { AgentManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
-import { type McpSnapshot } from "../mcp/snapshot.js";
 import type { Tx } from "../store/types.js";
 import type { Session } from "../tenant/context.js";
 /** The `tenant_settings` key the policy is kept under. */
@@ -22,13 +28,18 @@ export declare const TOOL_POLICY_SETTING = "tool-policy";
 /** A call as the policy reads it. */
 export interface PolicyCall {
     readonly kind: "mcp" | "http";
-    /** The name the model calls the tool by; a flow stage's key. */
+    /**
+     * The tool's identity: an MCP tool's own name on its server, an HTTP tool's declared name, a
+     * flow stage's key.
+     */
     readonly tool: string;
     /** The MCP server's name. */
     readonly server?: string;
     /** The agent that calls it. */
     readonly agent: string;
     readonly input: unknown;
+    /** The name the model called it by, for display only: no rule matches it. */
+    readonly name?: string;
 }
 export type PolicyDecision = {
     readonly effect: "allow";
@@ -36,14 +47,26 @@ export type PolicyDecision = {
     readonly effect: "ask" | "deny";
     readonly reason: string;
 };
-/** The Tenant's policy; an empty one when none was set. Throws when it cannot be read. */
+/** A stored policy this Runtime cannot apply: every call is refused, with `message` as why. */
+export declare class ToolPolicyUnreadable extends Error {
+    constructor(message: string);
+}
+/**
+ * The Tenant's policy; an empty one when none was set. Throws when it cannot be read, a
+ * `ToolPolicyUnreadable` saying which rule when one names an MCP tool by a model-facing name.
+ */
 export declare function readToolPolicy(t: Pick<Tx, "getSetting">): Promise<ToolPolicy>;
 /**
  * The decision for `request`, a session's MCP or HTTP tool call: the Tenant's rules and the
  * pinned manifest's `approval`. A policy that cannot be read refuses the call.
  */
 export declare function toolCallDecision(t: Pick<Tx, "getSetting">, s: Session, request: HostEffect, kind: "mcp" | "http"): Promise<PolicyDecision>;
+/** `request` as the policy reads it: by its target's identity (protocol 15). */
+export declare function policyCallOf(s: Pick<Session, "agentId">, request: HostEffect, kind: "mcp" | "http"): PolicyCall;
 /** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */
 export declare function decide(rules: readonly ToolRule[], call: PolicyCall, pinnedAsk?: boolean): PolicyDecision;
-/** The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2. */
-export declare function pinnedApproval(manifest: AgentManifest, snapshot: McpSnapshot | undefined, request: HostEffect): boolean;
+/**
+ * The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2: an
+ * MCP tool's settings by its own name, an HTTP tool's declaration by its declared name.
+ */
+export declare function pinnedApproval(manifest: AgentManifest, request: HostEffect): boolean;

package/dist/gates/policy.js

@@ -10,21 +10,44 @@
  * (`deny`, then `ask`, then `allow`), and a call no rule matches runs. A session pinned to a
  * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
  * the approval it was opened with. A policy that cannot be read refuses every call.
+ *
+ * A rule's `tool` matches the tool's identity (protocol 15): an MCP tool's own name on its
+ * server (`server` names the server), an HTTP tool's declared name, a flow stage's key. The name
+ * a harness gave the model never matches. A stored rule whose `tool` has `__` in it (an MCP tool
+ * named by its old model-facing `server__tool` name) makes the policy unreadable, so every call
+ * is refused until the policy names it by `server` and `tool`: a rule never silently stops
+ * matching.
  */
 import { ToolPolicySchema } from "@nylorun/core/contracts";
-import { mcpToolOf, mcpToolSettingsIn } from "../mcp/snapshot.js";
+import { mcpToolSettingsIn } from "../mcp/snapshot.js";
 import { canonical } from "../store/canonical.js";
 import { turnManifestOf } from "../tenant/session.js";
 import { declaredHttpTool } from "./http-tool.js";
 /** The `tenant_settings` key the policy is kept under. */
 export const TOOL_POLICY_SETTING = "tool-policy";
 const STRICTNESS = { allow: 0, ask: 1, deny: 2 };
-/** The Tenant's policy; an empty one when none was set. Throws when it cannot be read. */
+/** A stored policy this Runtime cannot apply: every call is refused, with `message` as why. */
+export class ToolPolicyUnreadable extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ToolPolicyUnreadable";
+    }
+}
+/**
+ * The Tenant's policy; an empty one when none was set. Throws when it cannot be read, a
+ * `ToolPolicyUnreadable` saying which rule when one names an MCP tool by a model-facing name.
+ */
 export async function readToolPolicy(t) {
     const raw = await t.getSetting(TOOL_POLICY_SETTING);
     if (raw === undefined)
         return { rules: [], updatedAt: null };
-    return ToolPolicySchema.parse(JSON.parse(raw));
+    const parsed = ToolPolicySchema.safeParse(JSON.parse(raw));
+    if (parsed.success)
+        return parsed.data;
+    const issue = parsed.error.issues[0];
+    throw new ToolPolicyUnreadable(issue?.path.at(-1) === "tool"
+        ? `Rule ${Number(issue.path[1]) + 1} of the Tenant's tool policy names a tool by a model-facing name: ${issue.message}. Set the policy again (PUT /v1/tenant/tool-policy)`
+        : `The Tenant's tool policy could not be read: ${issue?.message ?? "malformed"}`);
 }
 /**
  * The decision for `request`, a session's MCP or HTTP tool call: the Tenant's rules and the
@@ -35,22 +58,37 @@ export async function toolCallDecision(t, s, request, kind) {
     try {
         rules = (await readToolPolicy(t)).rules;
     }
-    catch {
-        return { effect: "deny", reason: "The Tenant's tool policy could not be read, so no tool call runs" };
+    catch (error) {
+        return {
+            effect: "deny",
+            reason: error instanceof ToolPolicyUnreadable
+                ? `${error.message}, so no tool call runs`
+                : "The Tenant's tool policy could not be read, so no tool call runs",
+        };
     }
-    const mcp = mcpToolOf(s.mcpSnapshot, request);
-    return decide(rules, {
+    return decide(rules, policyCallOf(s, request, kind), pinnedApproval(turnManifestOf(s), request));
+}
+/** `request` as the policy reads it: by its target's identity (protocol 15). */
+export function policyCallOf(s, request, kind) {
+    const target = request.target;
+    return {
         kind,
-        tool: request.toolName ?? request.key ?? request.effectId,
-        ...(mcp ? { server: mcp.serverName } : {}),
+        tool: target?.kind === "mcp" || target?.kind === "http"
+            ? target.tool
+            : (request.key ?? request.effectId),
+        ...(target?.kind === "mcp" ? { server: target.server } : {}),
         agent: request.agent?.id ?? s.agentId,
         input: request.input,
-    }, pinnedApproval(turnManifestOf(s), s.mcpSnapshot, request));
+        ...(request.toolName === undefined ? {} : { name: request.toolName }),
+    };
 }
 /** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */
 export function decide(rules, call, pinnedAsk = false) {
     let strictest = pinnedAsk
-        ? { effect: "ask", reason: `The agent's manifest asks for approval of '${call.tool}'` }
+        ? {
+            effect: "ask",
+            reason: `The agent's manifest asks for approval of '${call.server === undefined ? call.tool : `${call.server} / ${call.tool}`}'`,
+        }
         : undefined;
     for (const rule of rules) {
         if (!matches(rule, call))
@@ -63,12 +101,17 @@ export function decide(rules, call, pinnedAsk = false) {
         return { effect: "allow" };
     return { effect: strictest.effect, reason: strictest.reason };
 }
-/** The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2. */
-export function pinnedApproval(manifest, snapshot, request) {
-    const mcp = mcpToolOf(snapshot, request);
-    if (mcp)
-        return mcpToolSettingsIn(manifest, mcp).approval === "always";
-    return declaredHttpTool(manifest, request.agent?.id, request.toolName)?.approval === "always";
+/**
+ * The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2: an
+ * MCP tool's settings by its own name, an HTTP tool's declaration by its declared name.
+ */
+export function pinnedApproval(manifest, request) {
+    const target = request.target;
+    if (target?.kind === "mcp")
+        return mcpToolSettingsIn(manifest, request.agent?.id, target.server, target.tool).approval === "always";
+    if (target?.kind === "http")
+        return declaredHttpTool(manifest, request.agent?.id, target.tool)?.approval === "always";
+    return false;
 }
 function matches(rule, call) {
     if (rule.kind !== undefined && rule.kind !== call.kind)

package/dist/gates/provider-gate.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A Model Gate over a `ModelProvider` (protocol 15): how a Runtime whose model is scripted (tests,
+ * `model: {kind: "scripted"}` or `"fixture"`, an embedder's provider) serves its harness's model
+ * calls. The harness calls the gate as it calls any (`invokeModel`), in process or not: no harness
+ * calls a provider directly.
+ *
+ * The provider gets the call as an effect (`HostEffect`), rebuilt from the request: the ids, the
+ * agent used as a tool, the call's purpose, and the call as its `input`. With a store, each call
+ * is metered in the usage ledger like the Tenant's own gate's, and the Tenant's fixture model
+ * setting is answered first (R4.3). It dies with its process: it never `recovers`.
+ */
+import type { HostEffect } from "@nylorun/harness/run";
+import type { ModelProvider } from "../core/provider.js";
+import type { SessionStore } from "../store/types.js";
+import type { Logger } from "../tenant/types.js";
+import type { ModelGate, ModelGateRequest } from "./model-gate.js";
+/** The effect a provider sees for `request`. */
+export declare function providerEffect(request: ModelGateRequest): HostEffect;
+export declare function providerModelGate(provider: ModelProvider, options?: {
+    readonly store?: SessionStore;
+    readonly logger?: Logger;
+}): ModelGate;

package/dist/gates/provider-gate.js

@@ -0,0 +1,30 @@
+import { serve } from "./in-process.js";
+import { createMeter } from "./meter.js";
+/** The effect a provider sees for `request`. */
+export function providerEffect(request) {
+    return {
+        effectId: request.effectId,
+        sessionId: request.sessionId,
+        turnId: request.turnId,
+        agentId: request.agentId,
+        // The gate is told no definition hash; a provider routes by the call, never by the hash.
+        manifestHash: "",
+        kind: "model",
+        ...(request.agent === undefined ? {} : { agent: request.agent }),
+        ...(request.purpose === undefined ? {} : { purpose: request.purpose }),
+        input: request.call,
+        context: { invocationId: request.invocationId },
+    };
+}
+export function providerModelGate(provider, options = {}) {
+    const direct = {
+        call: async (request, signal) => (await provider(providerEffect(request), signal)),
+    };
+    const { store, logger } = options;
+    if (!store || !logger)
+        return direct;
+    const meter = createMeter({ logger });
+    return {
+        call: (request, signal) => meter.call(store, request, () => serve(store, direct, request, signal)),
+    };
+}

package/dist/gates/tool-calls.d.ts

@@ -21,8 +21,6 @@ import type { Logger } from "../tenant/types.js";
 import { type InflightCallsOptions, type InflightOwner } from "./inflight.js";
 import type { TenantVaults } from "./tenant-vaults.js";
 import type { McpAnswer } from "./tool-contract.js";
-/** How long a settled crossing is kept. */
-export declare const TOOL_CROSSING_TTL_MS: number;
 /** A tool call's answer: an MCP `CallToolResult`, or an HTTP tool's outcome. */
 export type ToolCallAnswer = McpAnswer<Record<string, unknown>>;
 export interface ToolCalls {
@@ -40,7 +38,7 @@ export interface ToolCalls {
     cancel(key: string, sessionId?: string): boolean;
     /** Aborts every running call (gateway shutdown). */
     close(): void;
-    /** Deletes crossings settled more than `TOOL_CROSSING_TTL_MS` ago. */
+    /** Deletes crossings settled more than `gates.toolCrossingTtlMs` (Host tuning, 24 h) ago. */
     prune(): Promise<void>;
 }
 export interface ToolCallsOptions {

package/dist/gates/tool-calls.js

@@ -1,6 +1,5 @@
 import { createInflightCalls, InflightConflict, } from "./inflight.js";
-/** How long a settled crossing is kept. */
-export const TOOL_CROSSING_TTL_MS = 24 * 60 * 60_000;
+import { hostTuning } from "../tuning.js";
 const CANCELLED = {
     ok: false,
     error: { message: "The call was cancelled while it ran; it may have reached its server" },
@@ -71,7 +70,7 @@ export function createToolCalls(options) {
         async prune() {
             try {
                 const vault = await vaults.open(undefined);
-                const before = new Date(now() - TOOL_CROSSING_TTL_MS).toISOString();
+                const before = new Date(now() - hostTuning().gates.toolCrossingTtlMs).toISOString();
                 await vault.store.tx((t) => t.pruneToolCrossings(before));
             }
             catch {

package/dist/gates/tool-client.d.ts

@@ -21,7 +21,7 @@ export interface HttpToolGateOptions {
     readonly runTokens?: RunTokens;
     /** Sent as `Nylorun-Tenant`; the gate checks it against its database's Tenant. */
     readonly tenantId?: string;
-    /** How long an MCP request may stay silent. Default `GATE_CLIENT_TIMEOUT_MS`. */
+    /** How long an MCP request may stay silent. Default `gates.clientTimeoutMs` (Host tuning). */
     readonly timeoutMs?: number;
 }
 export declare function httpToolGate(options: HttpToolGateOptions): ToolGate;

package/dist/gates/tool-client.js

@@ -26,7 +26,7 @@ import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { McpCallFailed, } from "../mcp/connect.js";
 import { TENANT_HEADER } from "./contract.js";
-import { GATE_CLIENT_TIMEOUT_MS } from "./http-client.js";
+import { hostTuning } from "../tuning.js";
 import { HTTP_CALLS_PATH, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, TOOL_CALLS_PATH, } from "./tool-contract.js";
 /**
  * A keyed call whose answer the hop lost (R5.3): the gate never got it, the connection broke,
@@ -36,11 +36,9 @@ import { HTTP_CALLS_PATH, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, TOOL_
 export class GateCallLost extends Error {
     name = "GateCallLost";
 }
-/** How long a close or a cancel may take; neither changes an outcome. */
-const SHORT_TIMEOUT_MS = 2_000;
 export function httpToolGate(options) {
     const where = new URL(options.url).origin;
-    const timeoutMs = options.timeoutMs ?? GATE_CLIENT_TIMEOUT_MS;
+    const timeoutMs = options.timeoutMs ?? hostTuning().gates.clientTimeoutMs;
     function exchange(path, body, request) {
         const url = new URL(path, options.url);
         const send = url.protocol === "https:" ? httpsRequest : httpRequest;
@@ -88,7 +86,7 @@ export function httpToolGate(options) {
                 responded = true;
                 readBody(response).then((text) => settle({ kind: "answer", status: response.statusCode ?? 0, text }), (error) => failed(error));
             });
-            outgoing.on("socket", (socket) => socket.setKeepAlive(true, 30_000));
+            outgoing.on("socket", (socket) => socket.setKeepAlive(true, hostTuning().gates.keepAliveMs));
             outgoing.on("finish", () => {
                 sent = true;
             });
@@ -147,7 +145,8 @@ export function httpToolGate(options) {
     }
     async function fireAndForget(path, scope) {
         await exchange(path, scope.body, {
-            timeoutMs: SHORT_TIMEOUT_MS,
+            // A close or a cancel is short (`gates.shortTimeoutMs`); neither changes an outcome.
+            timeoutMs: hostTuning().gates.shortTimeoutMs,
             ...(scope.bearer ? { bearer: scope.bearer } : {}),
         });
     }

package/dist/gates/tool-contract.d.ts

@@ -23,14 +23,17 @@
  * - `POST /nylorun/v1/mcp/close` `{server}`: closes the server's connection; `204`.
  * Each answers `200 {ok: true, result}` or `200 {ok: false, error}`: an MCP failure is an
  * answer, not a gate error. A tool call's failure is coded (`error.failure`, R2b C7), and neither
- * a result nor a failure carries a credential value the gate sent (C8). An answer past 8 MiB is
- * `mcp.too-large` (C11), as an HTTP tool's is `http.too-large`; core shapes what fits into a
- * result the model can take (`tenant/tool-results.ts`). A keyed call whose earlier attempt was
+ * a result nor a failure carries a credential value the gate sent (C8). An answer past the
+ * Tenant's Runtime limit `toolAnswerBytes` (default 8 MiB), which also caps the bodies the gate
+ * reads, is `mcp.too-large` (C11), as an HTTP tool's is `http.too-large`; the harness shapes
+ * what fits into a result the model can take (`shapeToolOutcome`, protocol 15). The tool-calls
+ * body names the tool by its identity: the server (`{agentId?, serverName}`) and the server's
+ * own name for the tool (`name`). A keyed call whose earlier attempt was
  * lost with the gateway runs again under the same key (R5.3); one another gateway process holds
  * answers `{ok: false, error: {uncertain: true}}`, and the caller sends it again.
  *
  * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
- * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, toolName}`), or a
+ * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, toolName}`, its declared name), or a
  * flow's HTTP stage or HTTP verifier by its stage key (`{sessionId?, stage}`); the gate finds its
  * URL, method and credential in the session's pinned manifest
  * (`gates/http-tool.ts`). A run token's turn is the call's; `turnId` counts only under core's
@@ -39,7 +42,7 @@
  * model sees), or `{ok: false, error: {uncertain: true}}` for a call another gateway process holds.
  */
 import type { McpCallFailure } from "../mcp/connect.js";
-export { HTTP_CALLS_PATH, HttpCallBodySchema, MAX_TOOL_BODY_BYTES, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, McpServerRefSchema, TOOL_CALLS_PATH, ToolCallBodySchema, type HttpCallBody, type ToolCallBody, } from "@nylorun/core/harness-api";
+export { HTTP_CALLS_PATH, HttpCallBodySchema, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, McpServerRefSchema, TOOL_CALLS_PATH, ToolCallBodySchema, type HttpCallBody, type ToolCallBody, } from "@nylorun/core/harness-api";
 /** Why an MCP request failed, as the loop's diagnostics read it (`mcp/connect.ts`). */
 export interface McpGateError {
     readonly message: string;

package/dist/gates/tool-contract.js

@@ -1 +1 @@
-export { HTTP_CALLS_PATH, HttpCallBodySchema, MAX_TOOL_BODY_BYTES, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, McpServerRefSchema, TOOL_CALLS_PATH, ToolCallBodySchema, } from "@nylorun/core/harness-api";
+export { HTTP_CALLS_PATH, HttpCallBodySchema, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, McpServerRefSchema, TOOL_CALLS_PATH, ToolCallBodySchema, } from "@nylorun/core/harness-api";

package/dist/gates/tool-gate.d.ts

@@ -6,17 +6,20 @@
  *
  * Two implementations: `inProcessToolGate` (embedding, the ephemeral Runtime, tests), which
  * opens remote servers and calls HTTP tools in this process, and the HTTP client of the gates
- * service (`tool-client.ts`, the `gateway` container). The sandbox tools never cross it.
+ * service (`tool-client.ts`, the `gateway` container). The sandbox tools never cross it. A
+ * harness's MCP pool opens every server through a gate (`openMcp`), in process too (protocol
+ * 15): the vault authorizes a connection only here.
  */
-import type { LiveConnection } from "../mcp/connect.js";
-import type { McpServerRef } from "../mcp/pool.js";
+import { openMcpServer, type LiveConnection } from "../mcp/connect.js";
+import { type McpServerRef } from "../mcp/pool.js";
 import type { OutboundPolicy } from "../tenant/outbound.js";
 import type { Logger } from "../tenant/types.js";
 import { type HttpOutcome, type HttpToolCall, type HttpToolTenant } from "./http-tool.js";
 export interface ToolGate {
     /**
-     * Opens a remote (`streamable-http` or `sse`) MCP server of a session. Absent: the loop's
-     * pool opens it itself, with the Tenant vault.
+     * Opens a remote (`streamable-http` or `sse`) MCP server of a session: the one its pinned
+     * manifest declares, authorized with the Tenant vault. Absent: this Runtime opens no MCP
+     * server.
      */
     openMcp?(server: McpServerRef): Promise<LiveConnection>;
     /**
@@ -39,9 +42,17 @@ export interface ToolGate {
     }): Promise<void>;
 }
 /**
- * The Tool Gate in the caller's process: remote MCP through the pool, and HTTP tools with
- * `tenant`'s sessions and vault.
+ * The Tool Gate in the caller's process: remote MCP servers and HTTP tools with `tenant`'s
+ * sessions and vault. `openMcp` finds the server in the session's pinned manifest (as the gates
+ * service does), so a caller names a server, never a URL or a credential. `open` replaces how a
+ * server is opened (tests).
  */
 export declare function inProcessToolGate(policy?: OutboundPolicy, tenant?: HttpToolTenant & {
     readonly logger?: Logger;
+    readonly open?: typeof openMcpServer;
 }): ToolGate;
+/**
+ * How a harness's MCP pool opens a server: through `gate`, or, for a Runtime whose gate opens
+ * none, never (the call fails to the model as `mcp.unreachable`).
+ */
+export declare function openMcpThrough(gate: Pick<ToolGate, "openMcp">): (server: McpServerRef) => Promise<LiveConnection>;

package/dist/gates/tool-gate.js

@@ -1,14 +1,56 @@
+/**
+ * The Tool Gate seam (blueprint §12, F4.1). Every tool call that leaves the loop crosses one
+ * `ToolGate`: a remote MCP server's connection and calls, and an HTTP tool's request (R2 M3).
+ * The gate owns what those need that the loop must not hold: the MCP and HTTP tool credentials,
+ * and the outbound route.
+ *
+ * Two implementations: `inProcessToolGate` (embedding, the ephemeral Runtime, tests), which
+ * opens remote servers and calls HTTP tools in this process, and the HTTP client of the gates
+ * service (`tool-client.ts`, the `gateway` container). The sandbox tools never cross it. A
+ * harness's MCP pool opens every server through a gate (`openMcp`), in process too (protocol
+ * 15): the vault authorizes a connection only here.
+ */
+import { openMcpServer } from "../mcp/connect.js";
+import { findServer } from "../mcp/pool.js";
 import { runHttpTool } from "./http-tool.js";
 /**
- * The Tool Gate in the caller's process: remote MCP through the pool, and HTTP tools with
- * `tenant`'s sessions and vault.
+ * The Tool Gate in the caller's process: remote MCP servers and HTTP tools with `tenant`'s
+ * sessions and vault. `openMcp` finds the server in the session's pinned manifest (as the gates
+ * service does), so a caller names a server, never a URL or a credential. `open` replaces how a
+ * server is opened (tests).
  */
 export function inProcessToolGate(policy = {}, tenant) {
+    if (!tenant)
+        return {};
+    const open = tenant.open ?? openMcpServer;
     return {
-        ...(tenant
-            ? {
-                callHttp: (call, signal) => runHttpTool(tenant, call, { policy, signal, ...(tenant.logger ? { logger: tenant.logger } : {}) }),
-            }
-            : {}),
+        callHttp: (call, signal) => runHttpTool(tenant, call, { policy, signal, ...(tenant.logger ? { logger: tenant.logger } : {}) }),
+        async openMcp(server) {
+            const session = await tenant.session(server.sessionId);
+            if (!session)
+                throw new Error(`Session ${server.sessionId} not found`);
+            const declared = findServer(session.manifest, server.agentId, server.serverName);
+            if (!declared)
+                throw new Error(`MCP server '${server.serverName}' is not declared`);
+            return open({
+                server: declared.server,
+                policy,
+                errorExcerptChars: (await tenant.limits()).errorExcerptChars,
+                authorize: (url) => tenant.authorize(server.sessionId, {
+                    url,
+                    serverName: server.serverName,
+                    ...(server.agentId === undefined ? {} : { agentId: server.agentId }),
+                }),
+            });
+        },
     };
 }
+/**
+ * How a harness's MCP pool opens a server: through `gate`, or, for a Runtime whose gate opens
+ * none, never (the call fails to the model as `mcp.unreachable`).
+ */
+export function openMcpThrough(gate) {
+    return (server) => gate.openMcp
+        ? gate.openMcp(server)
+        : Promise.reject(new Error("This Runtime opens MCP servers only through a Tool Gate, and has none"));
+}