@nylorun/runtime 0.25.0-beta → 0.27.0-beta

package/dist/harness-api/record.js

@@ -1,13 +1,16 @@
 /**
  * The Record seam of the Harness API: core's journal for the effects of a run. `recordIntent`
  * journals an effect before anything runs it, and either answers it from the journal, hands it
- * to core's own executors (flow work, delegation, `save_artifact`, `read_artifact`,
- * `tool_search` and the skill tools), tells the harness to `execute` it (model calls; MCP, HTTP
- * and sandbox tools, a deferred MCP tool's `tool_call` among them, whose effect names the tool;
- * a flow's HTTP stages and HTTP verifiers), or fails a tool the Runtime cannot run (one that
- * would run the developer's code, R2 M6). `recordOutcome` records what the harness's call returned, an
- * agent's MCP or HTTP tool result first shaped to fit (R2b C11). Both run under the advance's
- * lease: every write is epoch-checked (`ownedSession`), and a lost epoch writes nothing.
+ * to core's own executors (flow work, delegation), tells the harness to `execute` it (model calls;
+ * a flow's HTTP stages and HTTP verifiers; an agent's tool call whose target the session has,
+ * protocol 15: an `mcp` tool it discovered and the turn leaves enabled, by `{server, tool}`; an
+ * `http` tool it declares; a `sandbox` operation when it has a sandbox; a `harness` tool), or
+ * fails a tool call it cannot run (no target, as an author's code tool has, R2 M6, or one the
+ * session lacks). A tool call is routed by its target, never by its name. `recordOutcome`
+ * records what the harness's call returned, as the harness reported it: one record entry, refused
+ * past the Runtime limit `recordEntryBytes` (`limit_exceeded`), since the harness shapes tool
+ * results, not core. Both run under the advance's lease: every write is epoch-checked
+ * (`ownedSession`), and a lost epoch writes nothing.
  *
  * Rows store the request's hash (`requestHash`) and, for a model call, the request without its
  * prompt: drift is a hash compare. Rows written before carry their full request, hashed on read.
@@ -19,26 +22,24 @@
  * harness and the Tool Gate reads with the row.
  */
 import { HarnessApiError, effectRequestHash, isEffectIdOf, } from "@nylorun/core/harness-api";
+import { isSandboxToolName } from "@nylorun/core/define";
 import { isFlowEffect, isFlowToolEffect, recordVerdict, settleAgentEffect, } from "../core/flow-host.js";
-import { sandboxToolSpec } from "../sandbox/runtime-tools.js";
-import { abortOn, isReadArtifactCall, isSaveArtifactCall } from "../harness/calls.js";
-import { callReadArtifact, callSaveArtifact } from "../tenant/artifact-tool.js";
-import { mayNeedShaping, resultBytes, resultLimit, shapeToolOutcome, } from "../tenant/tool-results.js";
-import { callSkillTool, isSkillToolCall } from "../tenant/skill-tool.js";
-import { callToolSearch, isToolSearchCall } from "../tenant/tool-search.js";
+import { sessionSandboxSpec } from "../sandbox/share.js";
+import { readRuntimeLimits } from "../tenant/runtime-limits.js";
+import { checkEntry } from "../record/index.js";
 import { turnManifestOf } from "../tenant/session.js";
-import { isOwnershipLost } from "../store/ownership.js";
-import { manifestFor, mcpToolOf } from "../mcp/snapshot.js";
+import { isEnabledIn, manifestFor, mcpToolIn } from "../mcp/snapshot.js";
+import { findServer } from "../mcp/pool.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
 import { ownedSession } from "../tenant/context.js";
 import { isGateToolEffect, linkedOutcome, recoversModelCalls, recoversToolCalls, resolveNewFlowEffect, } from "../tenant/effects.js";
-import { assistantMessage, contextCompacted, modelFailed, modelOutcomeFacts, } from "../tenant/transcript.js";
+import { assistantMessage, modelFailed, modelOutcomeFacts, } from "../tenant/transcript.js";
 import { abortKind } from "../tenant/worker.js";
 import { redactTokens } from "./redact.js";
 import { toolCallDecision } from "../gates/policy.js";
 import { traceKey } from "../traces/key.js";
 import { effectSpanOf, traceparentOf, turnTraceIdOf } from "../traces/ids.js";
-import { MAX_TOOL_ATTEMPTS, firstSend, interrupted, settleToolRow, toolKindOf, } from "./tool-journal.js";
+import { firstSend, interrupted, settleToolRow, toolKindOf, } from "./tool-journal.js";
 const TURN_CANCELLED = () => new HarnessApiError("turn_cancelled", "Turn cancelled");
 /** The hash a journal row's request was recorded with. */
 export function hashOf(row) {
@@ -137,36 +138,20 @@ export async function recordIntent(scope, effect, requestHash) {
         const agentManifest = manifestFor(s.manifest, request.agent);
         if (!agentManifest)
             throw new Error(`Agent '${request.agent?.id ?? ""}' is not used as a tool`);
-        const executed = request.kind === "model" ||
-            (request.kind === "tool" &&
-                // An MCP tool the turn's manifest disables is not one (R2b C9).
-                (mcpToolOf(s.mcpSnapshot, request, turnManifestOf(s)) !== undefined ||
-                    // HTTP tools (R2 M3) cross the Tool Gate.
-                    isHttpToolCall(s.manifest, request) ||
-                    sandboxToolSpec(agentManifest, request.toolName) !== undefined ||
-                    // `save_artifact` (F8.1) runs beside the sandbox tools, as do `read_artifact` (R2b
-                    // C11) and the skill tools (R2 M4).
-                    isSaveArtifactCall(agentManifest, request) ||
-                    isReadArtifactCall(agentManifest, request) ||
-                    isSkillToolCall(agentManifest, request) ||
-                    // `tool_search` (R2b C10) reads the session's pinned MCP snapshot: core serves it.
-                    isToolSearchCall(s.mcpSnapshot, request) ||
-                    // A tool the run's harness declared and runs itself (R4.2, Q3), by its name: the turn
-                    // refuses a native tool whose name another tool of the agent's has (`harness-api/server.ts`).
-                    (request.toolName !== undefined && scope.nativeTools?.has(request.toolName) === true)));
-        if (!executed) {
-            // A tool that would run the developer's code: refused at save (a turn's manifest only
-            // removes tools), so this is a backstop, as is an MCP tool the turn disabled, which the
-            // model was never offered. The model sees the failure; nothing runs.
-            const disabled = request.kind === "tool" && mcpToolOf(s.mcpSnapshot, request) !== undefined;
+        const refused = request.kind === "tool" ? refusal(s, request) : undefined;
+        if (refused) {
+            // A call with no target (an author's code tool, refused at save, so a backstop), or one
+            // whose target the session lacks: an MCP tool it never discovered or the turn disables, an
+            // HTTP tool its agent does not declare, a sandbox call without a sandbox. The model sees
+            // the failure; nothing runs.
             const row = {
                 request,
                 requestHash,
                 status: "invoking",
-                ...toolKindOf(s, agentManifest, request, scope.nativeTools),
+                ...toolKindOf(s, agentManifest, request),
                 attempts: 0,
             };
-            const outcome = await settleToolRow(t, s, row, disabled ? disabledTool(request) : unrunnableTool(request), { writer: coreIn(scope) });
+            const outcome = await settleToolRow(t, s, row, refused, { writer: coreIn(scope) });
             return { status: "completed", outcome };
         }
         const row = {
@@ -175,7 +160,7 @@ export async function recordIntent(scope, effect, requestHash) {
             requestHash,
             status: "invoking",
             ...(request.kind === "tool"
-                ? { ...firstSend(toolKindOf(s, agentManifest, request, scope.nativeTools)), ...traced() }
+                ? { ...firstSend(toolKindOf(s, agentManifest, request)), ...traced() }
                 : { startedAt: new Date().toISOString() }),
         };
         // The Tenant's tool policy decides an MCP or HTTP tool call as it is journaled (R5 step 2).
@@ -185,28 +170,8 @@ export async function recordIntent(scope, effect, requestHash) {
                 return decided;
         }
         await t.put("effects", request.effectId, row);
-        // `save_artifact` writes the Tenant's artifacts: core runs it, reading the file through the
-        // workspace feature, wherever the sandbox is.
-        if (request.kind === "tool" && isSaveArtifactCall(agentManifest, request))
-            return "save";
-        // `read_artifact` reads the session's artifacts: core serves it, with or without a sandbox.
-        if (isReadArtifactCall(agentManifest, request))
-            return "read";
-        // The skill tools read the agent's definition files: core serves them.
-        if (isSkillToolCall(agentManifest, request))
-            return { skill: agentManifest };
-        if (isToolSearchCall(s.mcpSnapshot, request))
-            return "search";
         return { status: "execute", ...(row.traceparent ? { traceparent: row.traceparent } : {}) };
     });
-    if (answer === "save")
-        return runInCore(scope, request, () => callSaveArtifact(scope.ctx, request, scope.signal));
-    if (answer === "read")
-        return runInCore(scope, request, () => callReadArtifact(scope.ctx, request, scope.signal));
-    if (answer === "search")
-        return runInCore(scope, request, () => callToolSearch(scope.ctx, request));
-    if (typeof answer === "object" && "skill" in answer)
-        return runInCore(scope, request, () => callSkillTool(scope.ctx, answer.skill, request, scope.signal));
     if (answer !== "flow")
         return answer;
     if (!isFlowEffect(request))
@@ -214,27 +179,50 @@ export async function recordIntent(scope, effect, requestHash) {
     return resolveNewFlowEffect(ctx, request, signal, lease);
 }
 /**
- * Runs a tool core serves (`save_artifact`, F8.1; `read_artifact`, R2b C11; `tool_search`, R2b
- * C10; the skill tools, R2 M4) for the run and records its outcome, as a harness would record a
- * call it ran: the run gets
- * the outcome as the intent's answer.
+ * Why an agent's tool call cannot run, by what it names as its target (protocol 15), or
+ * undefined when it can:
+ *
+ * - `mcp`: the tool `{server, tool}` of an MCP server its agent declares, as the session
+ *   discovered it (`tool.unknown` otherwise), left enabled by the turn's manifest (R2b C9,
+ *   `tool.disabled`);
+ * - `http`: an HTTP tool its agent declares under that name (R2 M3), which crosses the Tool Gate;
+ * - `sandbox`: one of the sandbox operations, in a session with a sandbox;
+ * - `harness`: a tool the harness runs in its own process; its egress gate is its only control.
+ *
+ * No target, and anything else, runs nothing (`tool.unavailable`).
  */
-async function runInCore(scope, request, call) {
-    // Core ran the call: its outcome is what core saw, not the harness's claim (R4.9).
-    const writer = coreIn(scope);
-    const core = { ctx: scope.ctx, lease: scope.lease, signal: scope.signal, ...(writer ? { writer } : {}) };
-    let value;
-    try {
-        value = await call();
-    }
-    catch (error) {
-        if (isOwnershipLost(error))
-            throw error;
-        return recordOutcome(core, request.effectId, {
-            error: error instanceof Error ? error.message : String(error),
-        });
+function refusal(s, request) {
+    const target = request.target;
+    switch (target?.kind) {
+        case "mcp": {
+            const agentId = request.agent?.id;
+            if (!findServer(s.manifest, agentId, target.server) || !mcpToolIn(s.mcpSnapshot, agentId, target.server, target.tool))
+                return {
+                    kind: "failed",
+                    code: "tool.unknown",
+                    message: `Tool '${target.tool}' of MCP server '${target.server}' was not discovered for this session.`,
+                };
+            if (!isEnabledIn(turnManifestOf(s), agentId, target.server, target.tool))
+                return {
+                    kind: "failed",
+                    code: "tool.disabled",
+                    message: `Tool '${target.tool}' is disabled by its MCP server's tools settings.`,
+                };
+            return undefined;
+        }
+        case "http":
+            return isHttpToolCall(s.manifest, request) ? undefined : unrunnableTool(request);
+        case "sandbox":
+            return sessionSandboxSpec(s) !== undefined &&
+                request.toolName !== undefined &&
+                isSandboxToolName(request.toolName)
+                ? undefined
+                : unrunnableTool(request);
+        case "harness":
+            return undefined;
+        default:
+            return unrunnableTool(request);
     }
-    return recordOutcome(core, request.effectId, { value });
 }
 /** Core's own write during the scope's run (R4.9): core saw it, in that run. */
 function coreIn(scope) {
@@ -244,9 +232,9 @@ function coreIn(scope) {
 /**
  * The answer to a tool row still `invoking` (R5.3, R5.4): a crash, a shutdown or a lost gate
  * hop interrupted its send. An MCP or HTTP call (it crosses the Tool Gate, which hands the tool
- * its key) is sent again, one more attempt, until `MAX_TOOL_ATTEMPTS`; then it fails to the
- * model. Any other call (sandbox, core-served) has no key to dedupe on: it fails to the model
- * now, and is not run again (Q2).
+ * its key) is sent again, one more attempt, until the Tenant's `toolAttempts`; then it fails to the
+ * model. Any other call (sandbox, harness, core-served) has no key to dedupe on: it fails to the
+ * model now, and is not run again (Q2).
  */
 async function resend(t, s, row, rejoin) {
     if (!isGateToolEffect(s, row.request)) {
@@ -254,8 +242,9 @@ async function resend(t, s, row, rejoin) {
         return { status: "completed", outcome };
     }
     const attempts = (row.attempts ?? 1) + 1;
-    if (attempts > MAX_TOOL_ATTEMPTS) {
-        const outcome = await settleToolRow(t, s, row, interrupted(`The call was interrupted ${MAX_TOOL_ATTEMPTS} times and may have run.`));
+    const { toolAttempts } = await readRuntimeLimits(t);
+    if (attempts > toolAttempts) {
+        const outcome = await settleToolRow(t, s, row, interrupted(`The call was interrupted ${toolAttempts} times and may have run (the Runtime limit toolAttempts).`));
         return { status: "completed", outcome };
     }
     row.attempts = attempts;
@@ -295,16 +284,24 @@ async function bypolicy(t, s, row, kind) {
     await t.put("effects", row.request.effectId, row);
     return { status: "pending" };
 }
-/** The failed outcome of an MCP tool the turn's manifest disables (R2b C9). */
-function disabledTool(request) {
-    return {
-        kind: "failed",
-        code: "tool.disabled",
-        message: `Tool '${request.toolName ?? ""}' is disabled by its MCP server's tools settings.`,
-    };
-}
-/** The failed outcome of a tool the Runtime cannot run: it would run the developer's code. */
+/**
+ * The failed outcome of a tool call the Runtime cannot run: one that names no target (an author's
+ * code tool: the Runtime runs agents from their manifests alone), or one whose target the session
+ * lacks (a sandbox call without a sandbox).
+ */
 function unrunnableTool(request) {
+    if (request.target?.kind === "sandbox")
+        return {
+            kind: "failed",
+            code: "tool.unavailable",
+            message: `Tool '${request.toolName ?? ""}' runs in a sandbox, and this session has none.`,
+        };
+    if (request.target !== undefined)
+        return {
+            kind: "failed",
+            code: "tool.unavailable",
+            message: `Tool '${request.toolName ?? ""}' is not one this session can run (${request.target.kind}).`,
+        };
     return {
         kind: "failed",
         code: "tool.unavailable",
@@ -347,12 +344,16 @@ export async function recordOutcome(scope, effectId, reported) {
         });
     }
     // What a harness reports never carries the Runtime's own tokens into the record (R4).
-    const value = await shaped(scope, effectId, redactTokens(result.value));
+    const value = redactTokens(result.value);
     return ctx.store.tx(async (t) => {
         const s = await t.assertEpoch(lease.sessionId, lease.epoch);
         const effect = await t.get("effects", effectId);
         if (!effect)
             throw new HarnessApiError("invalid", `Effect ${effectId} was never journaled`);
+        // An entry of the record (S0): past the Tenant's `recordEntryBytes`, `limit_exceeded`. The
+        // harness shapes what it reports to fit, storing the rest with `artifact.write`; the row
+        // stays as it was.
+        checkEntry(`The outcome of effect ${effectId} (store the rest with artifact.write)`, value, (await readRuntimeLimits(t)).recordEntryBytes);
         const { request } = effect;
         if (s.status === "cancelled" || s.activeTurnId !== request.turnId || abortKind(signal) === "cancel")
             throw TURN_CANCELLED();
@@ -360,7 +361,7 @@ export async function recordOutcome(scope, effectId, reported) {
             // Settled already: a re-send after a lost hop collected what the first send recorded.
             if (effect.status === "completed")
                 return { status: "completed", outcome: effect.outcome };
-            // What the call returned is the harness's claim, or, for a tool core ran, core's (R4.9).
+            // What the call returned is the harness's claim (R4.9).
             const outcome = await settleToolRow(t, s, effect, value, { writer: scope.writer });
             if (request.context?.role === "verify-http")
                 await recordVerdict(t, request, value);
@@ -372,80 +373,24 @@ export async function recordOutcome(scope, effectId, reported) {
         await t.put("effects", effectId, effect);
         const model = request.kind === "model";
         const failed = model ? modelFailed(request, value) : undefined;
-        // A summary call is never an assistant message; it publishes context.compacted, `partial`
-        // unless it is the last.
-        const summarizing = model && Boolean(request.context.compaction);
-        const compacted = summarizing && !failed ? contextCompacted(request, value) : undefined;
+        // A summary call is never an assistant message: the compaction's transcript edit names it,
+        // and `context.compacted` is written with that edit (Q4).
+        const summarizing = model && request.purpose === "summary";
         const transcript = failed || summarizing || !model ? undefined : assistantMessage(request, value);
         if (request.context?.role === "verify-http")
             await recordVerdict(t, request, value);
         const writer = scope.writer;
         // The call's span (R7.1): the journal's window, and the meter's row for it when a gate ran it.
-        const facts = failed || compacted || transcript
+        const facts = failed || transcript
             ? modelOutcomeFacts(effectId, effect, await t.modelUsageOf(effectId))
             : undefined;
         if (failed)
             await t.event(s.id, request.turnId, "model.failed", { ...failed, ...facts }, writer);
-        if (compacted)
-            await t.event(s.id, request.turnId, "context.compacted", { ...compacted, ...facts }, writer);
         if (transcript)
             await t.event(s.id, request.turnId, "message.assistant", { ...transcript, ...facts }, writer);
         return { status: "completed", outcome: effect.outcome };
     });
 }
-/**
- * The outcome of an agent's remote MCP or HTTP tool call, shaped to fit before anything records
- * it (R2b C11, `tenant/tool-results.ts`): what does not fit becomes the session's artifacts. Any
- * other outcome, and one a cancel will discard, as it is. Only a cancel stops the upload: after a
- * shutdown or a deadline the outcome is still recorded, so the next advance replays it.
- *
- * Its cap is what its step's budget has left (`resultLimit`): a step's results are one transcript
- * entry. Parallel results are counted under the session lock, each reserving its share on its
- * row (`resultBytes`) before it is shaped, so two never spend the same room.
- */
-async function shaped(scope, effectId, value) {
-    const { ctx, lease, signal } = scope;
-    if (abortKind(signal) === "cancel" || !mayNeedShaping(value))
-        return value;
-    const call = await ctx.store.tx(async (t) => {
-        const s = await t.lockSession(lease.sessionId);
-        const effect = await t.get("effects", effectId);
-        if (!s || !effect || effect.status === "completed")
-            return undefined;
-        const request = effect.request;
-        // An agent's tool; a flow's HTTP stage or verifier names no tool, and its output is data.
-        if (request.kind !== "tool" || request.toolName === undefined)
-            return undefined;
-        const mcp = mcpToolOf(s.mcpSnapshot, request) !== undefined;
-        if (!mcp && !isHttpToolCall(s.manifest, request))
-            return undefined;
-        const step = stepOf(request);
-        let used = 0;
-        if (step !== undefined)
-            for (const other of await t.effectsForTurn(s.id, request.turnId, [
-                "invoking",
-                "completed",
-            ])) {
-                if (other.request.effectId === effectId || stepOf(other.request) !== step)
-                    continue;
-                used +=
-                    other.resultBytes ??
-                        (other.status === "completed" ? resultBytes(other.outcome?.value) : 0);
-            }
-        const limit = resultLimit(used);
-        effect.resultBytes = Math.min(resultBytes(value), limit);
-        await t.put("effects", effectId, effect);
-        return { request, session: { id: s.id, ownerUserId: s.ownerUserId }, mcp, limit };
-    });
-    return call ? shapeToolOutcome(ctx, call, value, abortOn(signal, ["cancel"])) : value;
-}
-/** The model step a tool call answers, and whose agent: its results share one transcript entry. */
-function stepOf(request) {
-    if (request.kind !== "tool")
-        return undefined;
-    const stepId = request.context?.stepId;
-    return typeof stepId === "string" ? JSON.stringify([request.agent?.id ?? null, stepId]) : undefined;
-}
 /** What a journal row keeps of a request: a model call without its prompt. */
 function storedRequest(request) {
     if (request.kind !== "model" || request.input === undefined)

package/dist/harness-api/renew.d.ts

@@ -18,7 +18,7 @@ export type Renewal = {
 } | {
     ok: false;
 };
-/** How often a lease is renewed: a third of its length. */
+/** How often a lease is renewed: a third of its length, and at least 1 ms, a timer's least delay. */
 export declare function renewEveryMs(ctx: TenantContext): number;
 /** The run token the advance of `lease` holds, as a run grant carries it. */
 export declare function tokenOf(ctx: TenantContext, lease: Lease): {

package/dist/harness-api/renew.js

@@ -1,8 +1,8 @@
 import { dropRunGrant, renewRunGrant } from "../tenant/run-grants.js";
 import { AdvanceAbort } from "../tenant/worker.js";
-/** How often a lease is renewed: a third of its length. */
+/** How often a lease is renewed: a third of its length, and at least 1 ms, a timer's least delay. */
 export function renewEveryMs(ctx) {
-    return Math.max(10, Math.floor(ctx.ownerLeaseMs / 3));
+    return Math.max(1, Math.floor(ctx.ownerLeaseMs / 3));
 }
 /** The run token the advance of `lease` holds, as a run grant carries it. */
 export function tokenOf(ctx, lease) {

package/dist/harness-api/server.d.ts

@@ -59,14 +59,6 @@ export type RunEnd = {
 /** No harness took the run within `offerWaitMs`. */
  | {
     readonly kind: "unavailable";
-}
-/**
- * The harness that would take the run cannot: a tool it runs itself (`features.tools`) has the
- * name of a tool of the turn's agents. The turn fails with `message`.
- */
- | {
-    readonly kind: "refused";
-    readonly message: string;
 };
 export interface HarnessApiServer {
     /** Serves a harness's channel until it closes. Returns a function that detaches it. */
@@ -112,16 +104,9 @@ export declare class NoWorkspaceHarness extends Error {
     constructor(pod?: string | undefined);
 }
 export interface HarnessApiServerOptions {
+    /** How long an offered run waits for a harness. Default `harnessApi.offerWaitMs` (Host tuning). */
     offerWaitMs?: number;
     /** The sandbox backend preference a harness that serves workspaces selects with. */
     sandboxPreference?: string;
 }
 export declare function createHarnessApiServer(ctx: TenantContext, options?: HarnessApiServerOptions): HarnessApiServer;
-/**
- * The tools a harness runs itself (`features.tools`) whose names the turn already uses: a tool of
- * the turn's agents (their own and the Runtime's `runtime` tools), a session tool, `tool_search` or
- * `tool_call` (session tools a later step may get). Tools are known by name alone, so a native
- * tool must not take one (Harness API 3); `hello` already refuses a name with `__`, which names an
- * MCP server's tools. A flow turn runs no native tools.
- */
-export declare function nativeToolClashes(tools: ReadonlySet<string> | undefined, start: TurnStart): string[];