@nylorun/runtime 0.25.0-beta → 0.27.0-beta

package/dist/harness/calls.d.ts

@@ -1,31 +1,30 @@
 /**
- * The calls a harness executes, as pure helpers over what routes them: the Model Gate (or the
- * Tenant's provider), the Tool Gate, the MCP pool, the SandboxManager. No store, no record: the
- * session's routing comes with the run (`TurnStart.routing`).
+ * The calls a harness executes, as pure helpers over what routes them: the Model Gate, the Tool
+ * Gate, the MCP pool, the SandboxManager. No store, no record: the session's routing comes with
+ * the run (`TurnStart.routing`). Every model call goes through the Model Gate, in a harness
+ * process and in core's alike (protocol 15): a Runtime with a scripted model serves it from a
+ * gate too (`providerModelGate`).
  */
-import { type AgentManifest } from "@nylorun/core/define";
+import { type AgentManifest, type SandboxManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
+import type { SandboxToolLimits } from "@nylorun/harness";
 import type { AbortReason } from "@nylorun/core/harness-api";
-import type { ModelProvider } from "../core/provider.js";
 import type { ModelGate } from "../gates/model-gate.js";
 import type { ToolGate } from "../gates/tool-gate.js";
 import { type McpPool } from "../mcp/pool.js";
-import { type McpSnapshot } from "../mcp/snapshot.js";
 import type { SandboxManager } from "../sandbox/manager.js";
-/** Where a Tenant's model calls go. */
+/** Where a Tenant's model calls go: its Model Gate. */
 export interface ModelRoute {
     readonly tenantId: string;
     readonly modelGate: ModelGate;
-    readonly modelProvider: ModelProvider;
-    /** True when the model comes from the Tenant vault selection, served by `modelGate`. */
-    readonly useVaultModel: boolean;
 }
 /** What a session's tool calls are routed by. */
 export interface ToolRouting {
     readonly rootManifest: AgentManifest;
-    readonly mcpSnapshot?: McpSnapshot;
     /** The session that owns the tree's sandbox, and the sandbox resource it is attached to. */
     readonly sandboxOwnerId: string;
+    /** The sandbox spec the session pinned (`routing.sandbox.spec`); absent without a sandbox. */
+    readonly spec?: SandboxManifest;
     readonly environmentId?: string;
     /** Variables every sandbox command gets (R2c): secret names set to the sentinel, plain values. */
     readonly environment?: Readonly<Record<string, string>>;
@@ -34,14 +33,12 @@ export interface ToolRouting {
     readonly claim?: string;
 }
 /**
- * Call the model for one effect. A provider failure comes back as a failure outcome
- * (Model Calls §6), whichever provider serves the call; only an abort throws, and the
- * advance decides what the abort means. `atGate` sends the call to the Model Gate even when the
- * Tenant's model is not from the vault: the Tenant's fixture model is answered there (R4.3).
+ * Call the model for one effect, through the Model Gate. A provider failure comes back as a
+ * failure outcome (Model Calls §6), whichever provider serves the call; only an abort throws, and
+ * the advance decides what the abort means. The Tenant's fixture model is answered at the gate
+ * too (R4.3).
  */
-export declare function invokeModel(route: ModelRoute, request: HostEffect, signal: AbortSignal, options?: {
-    readonly atGate?: boolean;
-}): Promise<unknown>;
+export declare function invokeModel(route: ModelRoute, request: HostEffect, signal: AbortSignal): Promise<unknown>;
 /**
  * A signal that follows `signal` only for the abort kinds in `kinds`. An MCP call stops on a
  * cancel; at the Tool Gate it also stops waiting on a shutdown, since the gate keeps the call
@@ -49,13 +46,14 @@ export declare function invokeModel(route: ModelRoute, request: HostEffect, sign
  * so the next advance replays it.
  */
 export declare function abortOn(signal: AbortSignal, kinds: readonly AbortReason[]): AbortSignal;
-/** True when `request` calls `save_artifact`, which the Runtime pinned on `manifest`. */
-export declare function isSaveArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
-/** True when `request` calls `read_artifact` (R2b C11), which the Runtime pinned on `manifest`. */
-export declare function isReadArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
-/** True when `request` calls a tool of a declared MCP server (every one is remote). */
-export declare function isRemoteMcpCall(routing: Pick<ToolRouting, "rootManifest" | "mcpSnapshot">, request: HostEffect): boolean;
+/**
+ * True when `request` calls a tool of an MCP server its agent declares (every one is remote): an
+ * `mcp` call, by its target's `server` (protocol 15).
+ */
+export declare function isRemoteMcpCall(routing: Pick<ToolRouting, "rootManifest">, request: HostEffect): boolean;
 export declare function callMcpTool(mcp: McpPool, routing: ToolRouting, request: HostEffect, signal: AbortSignal, 
+/** The run's Runtime limit `toolAnswerBytes`: the largest answer kept where this process holds the connection. */
+maxResultBytes: number, 
 /** The call's span context (R7.4), sent as `traceparent` where this process holds the connection. */
 traceparent?: string): Promise<unknown>;
 /**
@@ -66,4 +64,8 @@ traceparent?: string): Promise<unknown>;
 export declare function callHttpTool(gate: Pick<ToolGate, "callHttp">, request: HostEffect, signal: AbortSignal, 
 /** The call's span context (R7.4); the gates service reads its own from the journal. */
 traceparent?: string): Promise<unknown>;
-export declare function callSandboxTool(sandbox: SandboxManager, routing: ToolRouting, request: HostEffect, signal: AbortSignal): Promise<unknown>;
+/**
+ * Runs a `sandbox` call: the operation it names, in the session's sandbox (the one its agents
+ * used as tools share), held to the harness's sandbox tool limits.
+ */
+export declare function callSandboxTool(sandbox: SandboxManager, routing: ToolRouting, request: HostEffect, signal: AbortSignal, limits?: SandboxToolLimits): Promise<unknown>;

package/dist/harness/calls.js

@@ -1,26 +1,23 @@
 /**
- * The calls a harness executes, as pure helpers over what routes them: the Model Gate (or the
- * Tenant's provider), the Tool Gate, the MCP pool, the SandboxManager. No store, no record: the
- * session's routing comes with the run (`TurnStart.routing`).
+ * The calls a harness executes, as pure helpers over what routes them: the Model Gate, the Tool
+ * Gate, the MCP pool, the SandboxManager. No store, no record: the session's routing comes with
+ * the run (`TurnStart.routing`). Every model call goes through the Model Gate, in a harness
+ * process and in core's alike (protocol 15): a Runtime with a scripted model serves it from a
+ * gate too (`providerModelGate`).
  */
-import { READ_ARTIFACT_TOOL, SAVE_ARTIFACT_TOOL, } from "@nylorun/core/define";
+import { isSandboxToolName } from "@nylorun/core/define";
 import { runAbortKind } from "@nylorun/harness/api";
 import { httpToolRefOf } from "../gates/http-tool.js";
 import { classifyThrown } from "../model/classify.js";
 import { findServer } from "../mcp/pool.js";
-import { manifestFor, mcpToolOf } from "../mcp/snapshot.js";
-import { isPinnedRuntimeTool, sandboxToolSpec } from "../sandbox/runtime-tools.js";
 /**
- * Call the model for one effect. A provider failure comes back as a failure outcome
- * (Model Calls §6), whichever provider serves the call; only an abort throws, and the
- * advance decides what the abort means. `atGate` sends the call to the Model Gate even when the
- * Tenant's model is not from the vault: the Tenant's fixture model is answered there (R4.3).
+ * Call the model for one effect, through the Model Gate. A provider failure comes back as a
+ * failure outcome (Model Calls §6), whichever provider serves the call; only an abort throws, and
+ * the advance decides what the abort means. The Tenant's fixture model is answered at the gate
+ * too (R4.3).
  */
-export async function invokeModel(route, request, signal, options = {}) {
-    const atGate = route.useVaultModel || options.atGate === true;
+export async function invokeModel(route, request, signal) {
     try {
-        if (!atGate)
-            return await route.modelProvider(request, signal);
         return await route.modelGate.call({
             tenantId: route.tenantId,
             sessionId: request.sessionId,
@@ -28,6 +25,8 @@ export async function invokeModel(route, request, signal, options = {}) {
             agentId: request.agentId,
             effectId: request.effectId,
             invocationId: String(request.context.invocationId),
+            ...(request.agent === undefined ? {} : { agent: request.agent }),
+            ...(request.purpose === undefined ? {} : { purpose: request.purpose }),
             call: request.input,
         }, signal);
     }
@@ -35,7 +34,7 @@ export async function invokeModel(route, request, signal, options = {}) {
         if (signal.aborted) {
             // A call that outlives this process stops only when told to: on a user cancel. After a
             // shutdown or a lost lease the next owner re-sends it and picks up its outcome (P1.2).
-            if (atGate && runAbortKind(signal) === "cancel" && route.modelGate.cancel)
+            if (runAbortKind(signal) === "cancel" && route.modelGate.cancel)
                 await route.modelGate.cancel({
                     tenantId: route.tenantId,
                     sessionId: request.sessionId,
@@ -65,43 +64,34 @@ export function abortOn(signal, kinds) {
         signal.addEventListener("abort", follow, { once: true });
     return controller.signal;
 }
-/** True when `request` calls `save_artifact`, which the Runtime pinned on `manifest`. */
-export function isSaveArtifactCall(manifest, request) {
-    return isArtifactsToolCall(manifest, request, SAVE_ARTIFACT_TOOL);
-}
-/** True when `request` calls `read_artifact` (R2b C11), which the Runtime pinned on `manifest`. */
-export function isReadArtifactCall(manifest, request) {
-    return isArtifactsToolCall(manifest, request, READ_ARTIFACT_TOOL);
-}
-function isArtifactsToolCall(manifest, request, toolName) {
-    return (request.kind === "tool" &&
-        request.toolName === toolName &&
-        isPinnedRuntimeTool(manifest, toolName));
-}
-/** True when `request` calls a tool of a declared MCP server (every one is remote). */
+/**
+ * True when `request` calls a tool of an MCP server its agent declares (every one is remote): an
+ * `mcp` call, by its target's `server` (protocol 15).
+ */
 export function isRemoteMcpCall(routing, request) {
-    if (request.kind !== "tool")
+    if (request.kind !== "tool" || request.target?.kind !== "mcp")
         return false;
-    const tool = mcpToolOf(routing.mcpSnapshot, request);
-    if (!tool)
-        return false;
-    return findServer(routing.rootManifest, tool.agentId, tool.serverName) !== undefined;
+    return findServer(routing.rootManifest, request.agent?.id, request.target.server) !== undefined;
 }
 export async function callMcpTool(mcp, routing, request, signal, 
+/** The run's Runtime limit `toolAnswerBytes`: the largest answer kept where this process holds the connection. */
+maxResultBytes, 
 /** The call's span context (R7.4), sent as `traceparent` where this process holds the connection. */
 traceparent) {
-    const tool = mcpToolOf(routing.mcpSnapshot, request);
-    if (!tool)
-        throw new Error(`MCP tool '${request.toolName ?? ""}' is not in the session snapshot`);
+    // The call names its tool by its identity (protocol 15): the server, and its own name there.
+    const target = request.target;
+    if (target?.kind !== "mcp")
+        throw new Error(`'${request.toolName ?? ""}' is not an MCP tool call`);
     return mcp.call({
         sessionId: request.sessionId,
-        ...(tool.agentId === undefined ? {} : { agentId: tool.agentId }),
-        serverName: tool.serverName,
-        serverToolName: tool.serverToolName,
+        ...(request.agent === undefined ? {} : { agentId: request.agent.id }),
+        serverName: target.server,
+        serverToolName: target.tool,
         args: request.input,
         manifest: routing.rootManifest,
         effectId: request.effectId,
         ...(traceparent ? { traceparent } : {}),
+        maxResultBytes,
         signal,
     });
 }
@@ -123,17 +113,21 @@ traceparent) {
         ...(traceparent ? { traceparent } : {}),
     }, signal);
 }
-export async function callSandboxTool(sandbox, routing, request, signal) {
-    const spec = sandboxToolSpec(manifestFor(routing.rootManifest, request.agent), request.toolName);
+/**
+ * Runs a `sandbox` call: the operation it names, in the session's sandbox (the one its agents
+ * used as tools share), held to the harness's sandbox tool limits.
+ */
+export async function callSandboxTool(sandbox, routing, request, signal, limits) {
+    const { spec } = routing;
     if (!spec)
-        throw new Error(`'${request.toolName ?? ""}' is not a sandbox tool`);
-    // Agents used as tools share the session's sandbox; the tree declares one sandbox spec.
+        throw new Error(`This session has no sandbox to run '${request.toolName ?? ""}' in`);
+    if (request.toolName === undefined || !isSandboxToolName(request.toolName))
+        throw new Error(`'${request.toolName ?? ""}' is not a sandbox operation`);
     return sandbox.run({
         id: routing.sandboxOwnerId,
         activeTurnId: routing.activeTurnId,
-        manifest: routing.rootManifest,
         ...(routing.environmentId === undefined ? {} : { environmentId: routing.environmentId }),
         ...(routing.environment === undefined ? {} : { environment: routing.environment }),
         ...(routing.claim === undefined ? {} : { claim: routing.claim }),
-    }, spec, request.toolName, request.input, signal);
+    }, spec, request.toolName, request.input, signal, limits);
 }

package/dist/harness/executors.d.ts

@@ -1,3 +1,4 @@
+import { type SandboxToolLimits } from "@nylorun/harness";
 import type { HarnessExecutors, HarnessRun, McpRecorder, PreparedRun } from "@nylorun/harness/api";
 import type { ToolGate } from "../gates/tool-gate.js";
 import { type McpPool } from "../mcp/pool.js";
@@ -10,12 +11,18 @@ export interface HarnessExecutorsOptions {
     readonly mcp: McpPool;
     /** The SandboxManager; a harness process creates it once `hello` names the Tenant. */
     readonly sandbox: () => SandboxManager;
+    /**
+     * The sandbox tools' limits the calls run with: the harness's configuration, the same it gives
+     * `createHarness({ sandboxTools })`. Each left out is its default.
+     */
+    readonly sandboxTools?: Partial<SandboxToolLimits>;
 }
 export declare function harnessExecutors(options: HarnessExecutorsOptions): HarnessExecutors;
 /**
- * Readies the run's MCP servers (§10.5 step 3): the first segment of a session discovers their
- * tools and records the snapshot (the first recorded wins); later ones reconnect them and record
- * what failed. Nothing for a session without MCP servers.
+ * Readies the run's MCP servers (§10.5 step 3): a run without MCP facts (`turn.start.mcp`, the
+ * session's first) discovers their tools and records the snapshot (the first recorded wins);
+ * later ones reconnect the snapshot's servers and record what failed. Answers the facts the run
+ * goes on with. Nothing for a session without MCP servers.
  */
 export declare function prepareMcp(pool: McpPool, run: HarnessRun, record: McpRecorder): Promise<PreparedRun | undefined>;
 /** A run's routing, as the call helpers take it. Its sandbox events are claimed for the run. */

package/dist/harness/executors.js

@@ -8,36 +8,42 @@
  * (`--service harness`, `main.ts`) its own, whose sandbox events it claims from core.
  */
 import { hashManifest } from "@nylorun/core/define";
+import { sandboxToolLimitsOf } from "@nylorun/harness";
 import { GateCallLost } from "../gates/tool-client.js";
 import { serversOf } from "../mcp/pool.js";
-import { mcpToolOf } from "../mcp/snapshot.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
-import { abortOn, callHttpTool, callMcpTool, callSandboxTool, invokeModel, isRemoteMcpCall, isSaveArtifactCall, } from "./calls.js";
+import { abortOn, callHttpTool, callMcpTool, callSandboxTool, invokeModel, isRemoteMcpCall, } from "./calls.js";
 export function harnessExecutors(options) {
     const recoversTools = options.toolGate.recovers === true;
+    const sandboxTools = sandboxToolLimitsOf(options.sandboxTools);
     const atGate = (effect, run) => {
         const routing = routingOf(run);
         return isRemoteMcpCall(routing, effect) || isHttpToolCall(routing.rootManifest, effect);
     };
     const recovered = (effect, run) => recoversTools && atGate(effect, run);
     return {
-        // With the Tenant's fixture model on, the Model Gate answers it (R4.3), metered like any call.
-        model: (effect, signal, run) => invokeModel(options.model, effect, signal, { atGate: run.start.options.fixtureModel }),
+        // Every call goes through the Model Gate (protocol 15); with the Tenant's fixture model on,
+        // the gate answers it (R4.3), metered like any call.
+        model: (effect, signal) => invokeModel(options.model, effect, signal),
         tool(effect, signal, run, call) {
             const routing = routingOf(run);
             const traceparent = call?.traceparent;
             // A call at the Tool Gate outlives a shutdown there; a local one finishes and is recorded.
             const kinds = recovered(effect, run) ? ["cancel", "shutdown"] : ["cancel"];
+            // A call is routed by what it names as its target (protocol 15); a flow's HTTP stage names
+            // its stage.
             if (isHttpToolCall(routing.rootManifest, effect))
                 return callHttpTool(options.toolGate, effect, abortOn(signal, kinds), traceparent);
             // A sandbox command joins its call's span (R7.4): a CLI that reads TRACEPARENT traces under it.
-            if (!mcpToolOf(routing.mcpSnapshot, effect))
-                return callSandboxTool(options.sandbox(), traceparent ? { ...routing, environment: { ...routing.environment, TRACEPARENT: traceparent } } : routing, effect, signal);
-            return callMcpTool(options.mcp, routing, effect, abortOn(signal, kinds), traceparent);
+            if (effect.target?.kind === "sandbox")
+                return callSandboxTool(options.sandbox(), traceparent ? { ...routing, environment: { ...routing.environment, TRACEPARENT: traceparent } } : routing, effect, signal, sandboxTools);
+            if (effect.target?.kind !== "mcp")
+                throw new Error(`This harness runs no ${effect.target?.kind ?? "untargeted"} call of '${effect.toolName ?? ""}'`);
+            return callMcpTool(options.mcp, routing, effect, abortOn(signal, kinds), run.start.limits.toolAnswerBytes, traceparent);
         },
         recovers: {
             get model() {
-                return options.model.useVaultModel && options.model.modelGate.recovers === true;
+                return options.model.modelGate.recovers === true;
             },
             tool: recovered,
         },
@@ -51,12 +57,42 @@ export function harnessExecutors(options) {
             });
         },
         prepare: (run, record) => prepareMcp(options.mcp, run, record),
+        files: {
+            read: (run, path, maxBytes, signal) => withSandbox(run, (session, spec) => options.sandbox().readBytes(session, spec, path, maxBytes, signal)),
+            write: (run, path, body, signal) => withSandbox(run, (session, spec) => options.sandbox().writeBytes(session, spec, path, body, signal)),
+            list: (run, dir, maxEntries, signal) => withSandbox(run, async (session, spec) => {
+                const listed = await options.sandbox().listFiles(session, spec, dir, maxEntries, signal);
+                return listed.kind === "listed"
+                    ? { kind: "listed", entries: listed.listing.entries, truncated: listed.listing.truncated }
+                    : listed.kind === "missing"
+                        ? { kind: "missing" }
+                        : listed;
+            }),
+            mount: (run, folder, files, read, signal) => withSandbox(run, (session, spec) => options.sandbox().mountFolder(session, spec, folder, files, read, signal)),
+        },
     };
 }
 /**
- * Readies the run's MCP servers (§10.5 step 3): the first segment of a session discovers their
- * tools and records the snapshot (the first recorded wins); later ones reconnect them and record
- * what failed. Nothing for a session without MCP servers.
+ * Runs `use` on the run's sandbox (the session's, which its agents used as tools share), or
+ * answers `artifact.no_sandbox` for a session without one.
+ */
+async function withSandbox(run, use) {
+    const routing = routingOf(run);
+    const { spec } = routing;
+    if (spec === undefined)
+        return { kind: "failed", code: "artifact.no_sandbox", message: "This session has no sandbox." };
+    return use({
+        id: routing.sandboxOwnerId,
+        activeTurnId: routing.activeTurnId,
+        ...(routing.environmentId === undefined ? {} : { environmentId: routing.environmentId }),
+        ...(routing.claim === undefined ? {} : { claim: routing.claim }),
+    }, spec);
+}
+/**
+ * Readies the run's MCP servers (§10.5 step 3): a run without MCP facts (`turn.start.mcp`, the
+ * session's first) discovers their tools and records the snapshot (the first recorded wins);
+ * later ones reconnect the snapshot's servers and record what failed. Answers the facts the run
+ * goes on with. Nothing for a session without MCP servers.
  */
 export async function prepareMcp(pool, run, record) {
     const routing = routingOf(run);
@@ -65,38 +101,32 @@ export async function prepareMcp(pool, run, record) {
         return undefined;
     const sessionId = run.grant.sessionId;
     let answer;
-    if (!routing.mcpSnapshot) {
+    const facts = run.start.mcp;
+    if (!facts) {
         const found = await pool.discover({
             sessionId,
             manifest,
             manifestHash: hashManifest(manifest),
+            maxInstructionBytes: run.start.limits.recordEntryBytes,
             signal: run.signal,
         });
         answer = await record({ snapshot: found.snapshot, diagnostics: found.diagnostics });
     }
     else {
-        const diagnostics = await pool.reconnect({
-            sessionId,
-            manifest,
-            tools: routing.mcpSnapshot.mcpTools,
-            signal: run.signal,
-        });
+        const diagnostics = await pool.reconnect({ sessionId, manifest, servers: facts.servers, signal: run.signal });
         if (diagnostics.length === 0)
             return undefined;
         answer = await record({ diagnostics });
     }
-    return {
-        sessionTools: answer.sessionTools,
-        ...(answer.snapshot === undefined ? {} : { mcpSnapshot: answer.snapshot }),
-    };
+    return answer.mcp === undefined ? undefined : { mcp: answer.mcp };
 }
 /** A run's routing, as the call helpers take it. Its sandbox events are claimed for the run. */
 export function routingOf(run) {
     const { routing } = run.start;
     return {
         rootManifest: routing.rootManifest,
-        ...(routing.mcpSnapshot ? { mcpSnapshot: routing.mcpSnapshot } : {}),
         sandboxOwnerId: routing.sandbox?.ownerId ?? run.grant.sessionId,
+        ...(routing.sandbox?.spec === undefined ? {} : { spec: routing.sandbox.spec }),
         ...(routing.sandbox?.environmentId === undefined ? {} : { environmentId: routing.sandbox.environmentId }),
         ...(routing.sandbox?.environment === undefined ? {} : { environment: routing.sandbox.environment }),
         activeTurnId: run.grant.turnId,

package/dist/harness/main.js

@@ -28,6 +28,7 @@ import { podHost } from "./pod.js";
 import { prepareDisk } from "./setup.js";
 import { harnessRunTokens } from "./run-tokens.js";
 import { startHarnessService } from "./service.js";
+import { hostTuning } from "../tuning.js";
 /**
  * `baseline` is the allowlisted environment of a pod's sandbox tools (`baselineEnvironment`),
  * read by `host/main.ts`: nothing here reads the process environment.
@@ -77,7 +78,6 @@ export async function runHarness(stack, baseline) {
             : {}),
         paths,
         modelGate: httpModelGate({ url: config.gatesUrl, runTokens }),
-        useVaultModel: true,
         toolGate: httpToolGate({ url: config.gatesUrl, runTokens }),
         logger,
         version: RUNTIME_VERSION,
@@ -107,7 +107,7 @@ export async function runHarness(stack, baseline) {
             // Runs are given back (core resumes them in its next advance), then MCP and sandboxes stop.
             pod?.stop();
             void service
-                .stop(pod ? 7_000 : 10_000)
+                .stop(pod ? hostTuning().harness.podStopMs : hostTuning().harness.stopMs)
                 .catch((error) => logger.warn("harness_stop_failed", { message: error instanceof Error ? error.message : String(error) }))
                 .finally(() => {
                 health.close();

package/dist/harness/pod.d.ts

@@ -1,6 +1,4 @@
 import type { PodHostConfig } from "../host/stack-config.js";
-/** How often the host and egress tokens are renewed. */
-export declare const RENEW_MS: number;
 /** What to run and copy on a new disk (`sandbox/setup.ts` in core), from the join answer. */
 export interface DiskSetup {
     readonly recipeVersion: number;

package/dist/harness/pod.js

@@ -15,8 +15,7 @@ import { randomUUID } from "node:crypto";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { rootCertificates } from "node:tls";
 import { dirname } from "node:path";
-/** How often the host and egress tokens are renewed. */
-export const RENEW_MS = 5 * 60_000;
+import { hostTuning } from "../tuning.js";
 /** The variables CLIs read their trust bundle from: OpenSSL, Node, Python, curl, git, AWS. */
 const TRUST_VARIABLES = [
     "SSL_CERT_FILE",
@@ -44,7 +43,7 @@ export function podHost(config, logger, options = {}) {
                 ...(init.bearer ? { authorization: `Bearer ${init.bearer}` } : {}),
             },
             ...(init.body === undefined ? {} : { body: JSON.stringify(init.body) }),
-            signal: AbortSignal.timeout(15_000),
+            signal: AbortSignal.timeout(hostTuning().harness.podJoinTimeoutMs),
         });
         const text = await response.text();
         if (response.status === 401 || response.status === 400)
@@ -109,11 +108,13 @@ export function podHost(config, logger, options = {}) {
     };
     /** A request with a current host token: the held one, renewed near expiry, or a new join. */
     const authorized = async (path, init) => {
-        const current = held && held.expiresAt - Date.now() > 60_000 ? held : ((await renew()) ?? (await join()));
+        const current = held && held.expiresAt - Date.now() > hostTuning().harness.podRenewEarlyMs
+            ? held
+            : ((await renew()) ?? (await join()));
         return call(`${config.httpUrl}/nylorun/harness/v1/host/${path}`, {
             ...init,
             headers: { ...init.headers, authorization: `Bearer ${current.hostToken}` },
-            signal: AbortSignal.timeout(5 * 60_000),
+            signal: AbortSignal.timeout(hostTuning().harness.podRequestTimeoutMs),
         });
     };
     const renew = async () => {
@@ -134,7 +135,7 @@ export function podHost(config, logger, options = {}) {
     };
     const timer = setInterval(() => {
         void renew().catch((error) => logger.warn("sandbox_host_renew_failed", { message: error instanceof Error ? error.message : String(error) }));
-    }, options.renewMs ?? RENEW_MS);
+    }, options.renewMs ?? hostTuning().harness.podRenewMs);
     timer.unref();
     return {
         async token() {

package/dist/harness/run-tokens.d.ts

@@ -14,5 +14,8 @@ export interface HarnessRunTokens {
     /** Keeps a run's grant: `createHarness({ onGrant })`. */
     grant(grant: RunGrant): void;
 }
-/** Remembers the last token of at most `limit` sessions (least recently granted dropped first). */
+/**
+ * Remembers the last token of at most `limit` sessions (least recently granted dropped first).
+ * Default `harness.runTokensMax` (Host tuning, 10,000).
+ */
 export declare function harnessRunTokens(limit?: number): HarnessRunTokens;

package/dist/harness/run-tokens.js

@@ -1,5 +1,9 @@
-/** Remembers the last token of at most `limit` sessions (least recently granted dropped first). */
-export function harnessRunTokens(limit = 10_000) {
+import { hostTuning } from "../tuning.js";
+/**
+ * Remembers the last token of at most `limit` sessions (least recently granted dropped first).
+ * Default `harness.runTokensMax` (Host tuning, 10,000).
+ */
+export function harnessRunTokens(limit = hostTuning().harness.runTokensMax) {
     const tokens = new Map();
     return {
         token: (sessionId) => tokens.get(sessionId),

package/dist/harness/service.d.ts

@@ -1,10 +1,9 @@
 import type { HarnessOptions } from "@nylorun/harness/api";
-import type { ModelProvider } from "../core/provider.js";
 import type { ModelGate } from "../gates/model-gate.js";
-import type { ToolGate } from "../gates/tool-gate.js";
-import { McpPool } from "../mcp/pool.js";
+import { type ToolGate } from "../gates/tool-gate.js";
 import type { SandboxBackend } from "../sandbox/types.js";
 import { type HarnessClient, type HarnessClientOptions } from "./ws-client.js";
+import { type EngineTuning } from "../tuning.js";
 export interface HarnessServiceOptions {
     readonly url: string;
     readonly token: HarnessClientOptions["token"];
@@ -12,24 +11,23 @@ export interface HarnessServiceOptions {
     readonly paths: {
         readonly sandboxes: string;
     };
-    /** Vault-backed model calls (the gates service's client). */
+    /** Every model call (the gates service's client; a scripted model's gate in tests). */
     readonly modelGate: ModelGate;
-    /** Models served without the vault; a harness process has none (`useVaultModel`). */
-    readonly modelProvider?: ModelProvider;
-    readonly useVaultModel: boolean;
-    /** Remote MCP servers (`openMcp`) and keyed cancels; the gates service's client. */
-    readonly toolGate: Pick<ToolGate, "recovers" | "cancel" | "openMcp" | "callHttp">;
     /**
-     * Authorizes a remote MCP server opened in this process. A harness process has no vault: it
-     * opens remote servers through the Tool Gate, and refuses them without one.
+     * Remote MCP servers (`openMcp`), HTTP tools and keyed cancels: the gates service's client. A
+     * harness process has no vault: it opens MCP servers only through the Tool Gate.
      */
-    readonly authorize?: ConstructorParameters<typeof McpPool>[0]["authorize"];
-    /** How remote MCP servers opened in this process are reached (`TenantConfig.delivery`). */
-    readonly delivery?: ConstructorParameters<typeof McpPool>[0]["policy"];
+    readonly toolGate: Pick<ToolGate, "recovers" | "cancel" | "openMcp" | "callHttp">;
     /** Default: the virtual backend under `paths.sandboxes`. */
     readonly sandboxBackends?: readonly SandboxBackend[];
     /** Delete the workspaces on stop (an ephemeral Runtime's loopback harness). */
     readonly ephemeral?: boolean;
+    /**
+     * The sandbox tools' limits: what our engine's schemas name and what this harness runs them
+     * with. Default the Host tuning's `engine.sandboxTools`; each left out is its default
+     * (`DEFAULT_SANDBOX_TOOL_LIMITS`).
+     */
+    readonly sandboxTools?: HarnessOptions["sandboxTools"];
     readonly logger: HarnessClientOptions["logger"];
     readonly version?: string;
     readonly onGrant?: HarnessOptions["onGrant"];
@@ -41,4 +39,9 @@ export interface HarnessService {
     /** Stops leasing and gives runs back (at most `waitMs`), then closes MCP and sandboxes. */
     stop(waitMs?: number): Promise<void>;
 }
+/**
+ * The options of `createHarness` the Host tuning's `engine` group sets (`tuning.ts`): only the
+ * ones set, so the engine keeps its own default for the rest.
+ */
+export declare function engineOptionsOf(engine: EngineTuning): Pick<HarnessOptions, keyof EngineTuning>;
 export declare function startHarnessService(options: HarnessServiceOptions): HarnessService;