@nylorun/runtime 0.25.0-beta → 0.27.0-beta

package/dist/harness-api/workspace.d.ts

@@ -14,10 +14,6 @@ type Exists = (id: string) => boolean | Promise<boolean>;
 export interface WorkspacePort {
     /** Runs one sandbox tool in the workspace of `session`. */
     run(session: SandboxSessionRef, sandbox: SandboxManifest | undefined, toolName: SandboxToolName, input: unknown, signal: AbortSignal): Promise<SandboxToolOutcome>;
-    /** Lists the files under `dir` of the workspace of `session` (the turn-end export, F8.2). */
-    listFiles(session: SandboxSessionRef, sandbox: SandboxManifest | undefined, dir: string, maxEntries: number, signal: AbortSignal): ReturnType<SandboxManager["listFiles"]>;
-    /** Reads a file of the workspace of `session` as bytes, at most `maxBytes` (`save_artifact`). */
-    readBytes(session: SandboxSessionRef, sandbox: SandboxManifest | undefined, path: string, maxBytes: number, signal: AbortSignal): ReturnType<SandboxManager["readBytes"]>;
     /** One operation on the disk of the workspace of `session` (R2d step 3). */
     disk(session: SandboxSessionRef, sandbox: SandboxManifest | undefined, op: DiskOp, signal: AbortSignal): ReturnType<SandboxManager["disk"]>;
     report(): Promise<WorkspaceReport>;

package/dist/harness-api/workspace.js

@@ -13,8 +13,8 @@
  *   removes theirs (`workspace.remove`); it also keeps the `sandboxes` table in step with the
  *   list.
  * - **Pod sandboxes** (F7.2, `withPodWorkspaces`): a session attached to a pod sandbox has its
- *   workspace in the pod, served by the sandbox's engine (its host connection). Its tool calls,
- *   listings and reads go there whatever serves the other workspaces; with the pod stopped or
+ *   workspace in the pod, served by the sandbox's engine (its host connection). Its tool calls
+ *   and disk operations go there whatever serves the other workspaces; with the pod stopped or
  *   starting they are `409 environment_unavailable`.
  */
 import { HarnessApiError } from "@nylorun/core/harness-api";
@@ -26,8 +26,6 @@ import { NoWorkspaceHarness } from "./server.js";
 export function localWorkspace(manager) {
     return {
         run: (session, sandbox, toolName, input, signal) => manager.run(session, sandbox, toolName, input, signal),
-        listFiles: (session, sandbox, dir, maxEntries, signal) => manager.listFiles(session, sandbox, dir, maxEntries, signal),
-        readBytes: (session, sandbox, path, maxBytes, signal) => manager.readBytes(session, sandbox, path, maxBytes, signal),
         disk: (session, sandbox, op, signal) => manager.disk(session, sandbox, op, signal),
         report: () => manager.report(),
         sweep: (options) => manager.sweep(options),
@@ -119,45 +117,6 @@ export function remoteWorkspace(options) {
                 throw error;
             }
         },
-        async listFiles(session, sandbox, dir, maxEntries, signal) {
-            try {
-                const answer = (await options.server.workspace("workspace.read", { session: sessionOf(session), spec: sandbox ?? {}, list: { dir, maxEntries } }, signal, target));
-                if (answer.kind === "listed")
-                    return {
-                        kind: "listed",
-                        path: String(answer.path),
-                        listing: answer.listing,
-                    };
-                if (answer.kind === "missing")
-                    return { kind: "missing", path: String(answer.path) };
-                return { kind: "failed", code: String(answer.code), message: String(answer.message) };
-            }
-            catch (error) {
-                // No harness holds the workspaces: there is nothing to export.
-                if (error instanceof NoWorkspaceHarness)
-                    return { kind: "missing", path: dir };
-                throw error;
-            }
-        },
-        async readBytes(session, sandbox, path, maxBytes, signal) {
-            try {
-                const answer = (await options.server.workspace("workspace.read", {
-                    session: sessionOf(session),
-                    spec: sandbox ?? {},
-                    bytes: { path, maxBytes },
-                }, signal, target));
-                if (answer.kind === "read")
-                    return { kind: "read", path: String(answer.path), bytes: new Uint8Array(Buffer.from(String(answer.base64), "base64")) };
-                if (answer.kind === "missing")
-                    return { kind: "missing", path: String(answer.path) };
-                return { kind: "failed", code: String(answer.code), message: String(answer.message) };
-            }
-            catch (error) {
-                if (error instanceof NoWorkspaceHarness)
-                    return { kind: "failed", code: "sandbox.unavailable", message: error.message };
-                throw error;
-            }
-        },
         async disk(session, sandbox, op, signal) {
             try {
                 const answer = (await options.server.workspace("list" in op || "read" in op ? "workspace.read" : "workspace.write", { session: sessionOf(session), spec: sandbox ?? {}, disk: toWireOp(op) }, signal, target));
@@ -215,8 +174,6 @@ export function withPodWorkspaces(base, options) {
     return {
         ...base,
         run: async (session, sandbox, toolName, input, signal) => (await routed(session)).run(session, sandbox, toolName, input, signal),
-        listFiles: async (session, sandbox, dir, maxEntries, signal) => (await routed(session)).listFiles(session, sandbox, dir, maxEntries, signal),
-        readBytes: async (session, sandbox, path, maxBytes, signal) => (await routed(session)).readBytes(session, sandbox, path, maxBytes, signal),
         disk: async (session, sandbox, op, signal) => (await routed(session)).disk(session, sandbox, op, signal),
     };
 }

package/dist/harness-api/ws-server.js

@@ -6,8 +6,8 @@
  * An upgrade is accepted only on `/nylorun/harness/v1`, with a `Host` in the allowlist (421),
  * `Authorization: Bearer <token>` (compared in constant time; 401) and `Nylorun-Harness-Api: 1`
  * (426), while the Tenant is open (503). Frames are at most 64 MiB and every one is validated
- * (`createChannel({ validate: true })`). Core pings every 30 s and drops a harness silent for
- * 90 s; the connection then counts as lost (`connection.lost`).
+ * (`createChannel({ validate: true })`). Core pings every `harness.pingMs` (Host tuning, 30 s) and
+ * drops a harness silent for `harness.silenceMs` (90 s); the connection then counts as lost (`connection.lost`).
  *
  * Sandbox pods (F7.2, D42) reach this listener too, on the Docker host's published port, and hold
  * no harness token. A pod's engine exchanges its join token for a host token with `POST
@@ -30,15 +30,12 @@ import { tokenType } from "../tenant/jwt.js";
 import { HOST_TOKEN_TYP } from "../tenant/host-token.js";
 import { HostAuthError } from "../sandbox/join.js";
 import { parseSetupReport } from "../sandbox/setup.js";
+import { hostTuning } from "../tuning.js";
 export { HOST_JOIN_PATH, HOST_RENEW_PATH };
 /** Where a pod's engine reads its setup and reports it (R2d step 2, `sandbox/setup.ts`). */
 export const HOST_SETUP_PATH = `${HARNESS_API_PATH}/host/setup`;
 /** Where it reads its input files: `/{index}`, and a folder's file `/{index}/{path}`. */
 export const HOST_FILES_PATH = `${HARNESS_API_PATH}/host/files`;
-/** A join's body is small. */
-const MAX_JOIN_BODY = 8 * 1024;
-/** A setup report carries the end of a command's output. */
-const MAX_REPORT_BODY = 64 * 1024;
 function refuse(socket, status, text, headers = {}) {
     const lines = [
         `HTTP/1.1 ${status} ${text}`,
@@ -85,7 +82,9 @@ export async function startHarnessListener(options) {
         });
         response.end(text);
     };
-    const readBody = (request, max = MAX_JOIN_BODY) => new Promise((resolve, reject) => {
+    // A join's body is small (`harnessApi.joinBodyBytes`); a setup report carries the end of a
+    // command's output (`harnessApi.reportBodyBytes`).
+    const readBody = (request, max = hostTuning().harnessApi.joinBodyBytes) => new Promise((resolve, reject) => {
         let size = 0;
         const chunks = [];
         request.on("data", (chunk) => {
@@ -139,7 +138,7 @@ export async function startHarnessListener(options) {
                     return reply(response, 200, await authority.setup(token));
                 if (request.method !== "POST")
                     return reply(response, 405, undefined, { allow: "GET, POST" });
-                const report = parseSetupReport(JSON.parse(await readBody(request, MAX_REPORT_BODY)));
+                const report = parseSetupReport(JSON.parse(await readBody(request, hostTuning().harnessApi.reportBodyBytes)));
                 if (!report)
                     throw new HostAuthError(400, "The report is malformed");
                 await authority.reportSetup(token, report);
@@ -148,7 +147,8 @@ export async function startHarnessListener(options) {
             if (request.method !== "GET")
                 return reply(response, 405, undefined, { allow: "GET" });
             const [index, ...rest] = path.slice(HOST_FILES_PATH.length + 1).split("/");
-            if (!/^\d{1,2}$/.test(index ?? ""))
+            // Any entry of the recipe: `setupFile` answers none for an index past its last.
+            if (!/^\d+$/.test(index ?? "") || !Number.isSafeInteger(Number(index)))
                 return reply(response, 404);
             const file = await authority.setupFile(token, Number(index), rest.length === 0 ? undefined : rest.map((part) => decodeURIComponent(part)).join("/"));
             if (!file)
@@ -281,7 +281,7 @@ export async function startHarnessListener(options) {
             setTimeout(() => {
                 for (const client of wss.clients)
                     client.terminate();
-            }, 1_000).unref();
+            }, hostTuning().harnessApi.closeGraceMs).unref();
             await closed;
             wss.close();
         },

package/dist/host/create-host.js

@@ -1,6 +1,7 @@
 import { createServer, } from "node:http";
 import { getRequestListener, RequestError } from "@hono/node-server";
 import { createHostApp } from "./app.js";
+import { hostTuning } from "../tuning.js";
 import { isLoopbackHost } from "./stack-config.js";
 import { bindListener as bind, EXIT_NON_LOOPBACK, headerValue, HostListenError, isAllowedRequestHost, pathnameIsLogged, redactRoutePath, rejectedResponse, sendRejected, } from "./http.js";
 export function createHost(options) {
@@ -132,7 +133,7 @@ export function createHost(options) {
             const graceful = await Promise.race([
                 stopped.then(() => true),
                 new Promise((resolve) => {
-                    grace = setTimeout(() => resolve(false), SHUTDOWN_GRACE_MS);
+                    grace = setTimeout(() => resolve(false), hostTuning().host.shutdownGraceMs);
                     grace.unref();
                 }),
             ]);
@@ -172,8 +173,6 @@ const SENT = {
 function alreadySent(response) {
     return response.headers.has("x-hono-already-sent") ? SENT : response;
 }
-/** How long shutdown waits for requests in progress before closing their connections. */
-const SHUTDOWN_GRACE_MS = 10_000;
 /**
  * A response that has started and not ended is a stream: JSON answers are written and ended
  * at once. (`getHeader` cannot tell, since streams pass their headers to `writeHead`.)

package/dist/host/execution.js

@@ -1,7 +1,6 @@
 import { startWorker, stopWorker } from "../infra/workers.js";
 import { TenantWorkers, } from "../tenant/worker.js";
-/** How many sweep arms `armAll` sends at once. */
-const ARM_CONCURRENCY = 16;
+import { hostTuning } from "../tuning.js";
 export function createHostExecution(options) {
     const { execution, services, logger } = options;
     const workers = new TenantWorkers({
@@ -58,7 +57,7 @@ export function createHostExecution(options) {
                     }
                 }
             };
-            await Promise.all(Array.from({ length: Math.min(ARM_CONCURRENCY, queue.length) }, next));
+            await Promise.all(Array.from({ length: Math.min(hostTuning().sweep.armConcurrency, queue.length) }, next));
             if (failures.length > 0)
                 throw new AggregateError(failures, `Arming ${failures.length} Tenant sweep(s) failed`);
         },

package/dist/host/gates.d.ts

@@ -15,14 +15,11 @@ import { type InflightCallsOptions } from "../gates/inflight.js";
 import type { openMcpServer } from "../mcp/connect.js";
 import type { OutboundPolicy } from "../tenant/outbound.js";
 import { type BlobStore } from "../blob/index.js";
-import type { ModelCallSettings } from "../gates/model-gate.js";
 import { type TenantVaults } from "../gates/tenant-vaults.js";
 import type { PostgresClient } from "../store/postgres/connect.js";
 import type { Logger } from "../tenant/types.js";
 import type { EgressConfig, GatesConfig } from "./stack-config.js";
 import { type EgressGate, type StartEgressGateOptions } from "../gates/egress.js";
-/** Above the gate's 600 s provider request timeout and the loop's 630 s client timeout. */
-export declare const GATES_REQUEST_TIMEOUT_MS = 660000;
 export interface StartGatesOptions {
     readonly gates: GatesConfig;
     readonly logger: Logger;
@@ -32,11 +29,7 @@ export interface StartGatesOptions {
     readonly database?: PostgresClient;
     /** Replaces the Postgres-backed Tenant vault (tests). */
     readonly vaults?: TenantVaults;
-    /** Retries and timeouts of model calls (tests). */
-    readonly settings?: ModelCallSettings;
-    /** Largest model call body (tests). */
-    readonly maxBodyBytes?: number;
-    /** How long `close` lets running calls finish. Default 10 s. */
+    /** How long `close` lets running calls finish. Default `gates.drainMs` (Host tuning, 10 s). */
     readonly drainMs?: number;
     /** How long keyed outcomes are kept, and how many (tests). */
     readonly inflight?: InflightCallsOptions;
@@ -45,7 +38,7 @@ export interface StartGatesOptions {
      * Default: no limits.
      */
     readonly delivery?: OutboundPolicy;
-    /** How long an MCP connection may sit unused. Default `GATE_MCP_IDLE_MS`. */
+    /** How long an MCP connection may sit unused. Default `gates.mcpIdleMs` (Host tuning, 15 min). */
     readonly mcpIdleMs?: number;
     /** Tests replace how a remote MCP server is opened. */
     readonly openMcp?: typeof openMcpServer;

package/dist/host/gates.js

@@ -15,7 +15,7 @@ import { getRequestListener } from "@hono/node-server";
 import { createGatesApp } from "../api/gate/routes.js";
 import { createModelCallHandler } from "../gates/handler.js";
 import { createInflightCalls } from "../gates/inflight.js";
-import { createMcpHandler, GATE_MCP_IDLE_MS } from "../gates/mcp-handler.js";
+import { createMcpHandler } from "../gates/mcp-handler.js";
 import { createToolCalls } from "../gates/tool-calls.js";
 import { gateHttpTools } from "../gates/http-tool.js";
 import { existsSync } from "node:fs";
@@ -24,13 +24,13 @@ import { staleRun, verifyRunToken } from "../tenant/run-token.js";
 import { createFsBlobStore } from "../blob/index.js";
 import { createTenantVaults } from "../gates/tenant-vaults.js";
 import { journalCheck } from "../gates/journal.js";
+import { readRuntimeLimits } from "../tenant/runtime-limits.js";
 import { probeDatabase } from "../infra/database.js";
 import { bindListener, headerValue, isAllowedRequestHost, sendRejected } from "./http.js";
 import { startEgressGate, storeEgressRecord, storeEgressSandboxes, } from "../gates/egress.js";
 import { verifyEgressToken } from "../sandbox/egress-token.js";
 import { leafKeyPair } from "../keys/x509.js";
-/** Above the gate's 600 s provider request timeout and the loop's 630 s client timeout. */
-export const GATES_REQUEST_TIMEOUT_MS = 660_000;
+import { hostTuning } from "../tuning.js";
 export async function startGates(options) {
     const { gates, logger, database } = options;
     let vaults = options.vaults;
@@ -47,8 +47,9 @@ export async function startGates(options) {
         (options.hostRoot !== undefined
             ? createFsBlobStore({ root: tenantPaths(options.hostRoot).blobs })
             : undefined);
+    const tuning = hostTuning().gates;
     const inflight = createInflightCalls(options.inflight);
-    const mcpIdleMs = options.mcpIdleMs ?? GATE_MCP_IDLE_MS;
+    const mcpIdleMs = options.mcpIdleMs ?? tuning.mcpIdleMs;
     const mcp = createMcpHandler({
         vaults,
         logger,
@@ -61,9 +62,9 @@ export async function startGates(options) {
         logger,
         ...(options.inflight ? { inflight: options.inflight } : {}),
     });
-    const sweep = setInterval(() => void mcp.sweep(), Math.max(1_000, Math.min(mcpIdleMs, 60_000)));
+    const sweep = setInterval(() => void mcp.sweep(), Math.max(tuning.mcpSweepMinMs, Math.min(mcpIdleMs, tuning.mcpSweepMaxMs)));
     sweep.unref();
-    const prune = setInterval(() => void toolCalls.prune(), 60 * 60_000);
+    const prune = setInterval(() => void toolCalls.prune(), tuning.toolCrossingPruneMs);
     prune.unref();
     // Run tokens verify against the Tenant's public keys and session rows (F5): the same
     // database the ledger and `tool_crossings` use.
@@ -81,7 +82,6 @@ export async function startGates(options) {
         modelGate: createModelCallHandler({
             vaults,
             logger,
-            ...(options.settings ? { settings: options.settings } : {}),
             ...(blobs ? { blobs } : {}),
         }),
         ready: async () => {
@@ -91,14 +91,15 @@ export async function startGates(options) {
             if (!database)
                 return true;
             try {
-                await probeDatabase(database, AbortSignal.timeout(2000));
+                await probeDatabase(database, AbortSignal.timeout(tuning.probeTimeoutMs));
                 return true;
             }
             catch {
                 return false;
             }
         },
-        ...(options.maxBodyBytes !== undefined ? { maxBodyBytes: options.maxBodyBytes } : {}),
+        // The Tenant's Runtime limits, read from its database for each call.
+        limits: async () => (await vaults.open()).store.tx((t) => readRuntimeLimits(t)),
         mcp,
         http: gateHttpTools(vaults, options.delivery ?? {}, logger),
         toolCalls,
@@ -122,7 +123,9 @@ export async function startGates(options) {
         res.once("close", () => inFlight.delete(res));
         void listener(req, res);
     });
-    server.requestTimeout = GATES_REQUEST_TIMEOUT_MS;
+    // Above the gate's 600 s provider request timeout and the loop's client timeout
+    // (`gates.clientTimeoutMs`): the tuning refuses one at or below the other.
+    server.requestTimeout = tuning.requestTimeoutMs;
     await bindListener(server, gates.listen.port, gates.listen.host, (error) => logger.error("listener_error", { error: error.message }));
     const port = server.address().port;
     allowedHosts = [
@@ -137,9 +140,9 @@ export async function startGates(options) {
             closing ??= (async () => {
                 const closed = new Promise((resolve) => server.close(() => resolve()));
                 server.closeIdleConnections();
-                const deadline = Date.now() + (options.drainMs ?? 10_000);
+                const deadline = Date.now() + (options.drainMs ?? tuning.drainMs);
                 while (inFlight.size > 0 && Date.now() < deadline)
-                    await new Promise((resolve) => setTimeout(resolve, 50));
+                    await new Promise((resolve) => setTimeout(resolve, tuning.drainPollMs));
                 // Closing a running call's connection aborts an unkeyed one; keyed calls stop here.
                 server.closeAllConnections();
                 inflight.close();

package/dist/host/http.d.ts

@@ -52,5 +52,3 @@ export declare function redactRoutePath(pathname: string): string;
 export declare function adminKeyMatches(presented: string | undefined, adminKey: string): boolean;
 /** A request header's first value. */
 export declare function headerValue(incoming: IncomingMessage, name: string): string | undefined;
-/** A JSON request body, capped at `limit` bytes (413); `undefined` when there is none. */
-export declare function readJsonBody(request: Request, limit?: number): Promise<unknown>;

package/dist/host/http.js

@@ -164,30 +164,3 @@ export function headerValue(incoming, name) {
         return raw[0];
     return raw;
 }
-/** A JSON request body, capped at `limit` bytes (413); `undefined` when there is none. */
-export async function readJsonBody(request, limit = 1024 * 1024) {
-    if (request.body === null)
-        return undefined;
-    const chunks = [];
-    let size = 0;
-    const reader = request.body.getReader();
-    for (;;) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        size += value.byteLength;
-        if (size > limit) {
-            await reader.cancel();
-            throw Object.assign(new Error("Request too large"), { status: 413 });
-        }
-        chunks.push(value);
-    }
-    if (size === 0)
-        return undefined;
-    try {
-        return JSON.parse(Buffer.concat(chunks).toString("utf8"));
-    }
-    catch {
-        throw Object.assign(new Error("Invalid JSON"), { status: 400 });
-    }
-}

package/dist/host/main.js

@@ -44,6 +44,7 @@ import { createPostgresSessionStore } from "../store/postgres/store.js";
 import { createTraceProjector, TRACE_SLOT } from "../traces/projector.js";
 import { createOtlpPoster } from "../traces/otlp.js";
 import { traceKey } from "../traces/key.js";
+import { readRuntimeLimits } from "../tenant/runtime-limits.js";
 import { configForFactory } from "./config-for.js";
 import { createHost } from "./create-host.js";
 import { createHostExecution } from "./execution.js";
@@ -63,6 +64,7 @@ import { runHarness } from "../harness/main.js";
 import { startHarnessListener } from "../harness-api/ws-server.js";
 import { httpSandboxesClient } from "../sandbox/pods/client.js";
 import { retry } from "../retry.js";
+import { hostTuning, useHostTuning } from "../tuning.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
     try {
@@ -129,7 +131,8 @@ function objectStore(config) {
  */
 async function ensureBucket(store, bucket, logger) {
     try {
-        await retry(() => store.ensureBucket(), { minMs: 1000, maxMs: 5000, attempts: 10 });
+        const { bucketRetry, bucketAttempts } = hostTuning().objectStore;
+        await retry(() => store.ensureBucket(), { ...bucketRetry, attempts: bucketAttempts });
         logger.info("object_store_ready", { bucket });
     }
     catch (error) {
@@ -191,7 +194,7 @@ async function runGates(stack) {
     }
     catch (error) {
         await Promise.all(servers.map((server) => server.close()));
-        await database.end({ timeout: 5 });
+        await database.end({ timeout: hostTuning().postgres.closeTimeoutSeconds });
         if (error instanceof HostListenError) {
             logger.error("listen_failed", { message: error.message, exitCode: error.exitCode });
             process.exitCode = error.exitCode;
@@ -206,12 +209,15 @@ async function runGates(stack) {
                 return;
             stopping = true;
             void Promise.all(servers.map((server) => server.close()))
-                .then(() => database.end({ timeout: 5 }))
+                .then(() => database.end({ timeout: hostTuning().postgres.closeTimeoutSeconds }))
                 .finally(() => process.exit(0));
         });
 }
 export async function main() {
     const stack = parseStackConfig(process.env, process.argv.slice(2));
+    // Read once, before any service starts: each reads the parts it uses where it uses them.
+    if (stack.tuning)
+        useHostTuning(stack.tuning.values, stack.tuning.overrides);
     if (stack.services.has("gates") || stack.services.has("keys") || stack.services.has("egress"))
         return runGates(stack);
     if (stack.services.has("harness"))
@@ -332,6 +338,7 @@ export async function main() {
                 log: (message, fields) => logger.warn(message, fields),
             }),
             key: () => traceKey(store),
+            contentBytes: async () => (await store.tx((t) => readRuntimeLimits(t))).traceContentBytes,
             turnMessage: createPostgresTurnMessages(database),
             content: new Set(stack.traces.content),
             log,

package/dist/host/operate.js

@@ -33,6 +33,7 @@ import { operatorKeys } from "../tenant/operator-keys.js";
 import { deleteHarnessToken, listHarnessTokens, putHarnessToken } from "../tenant/harness-tokens.js";
 import { RUNTIME_VERSION } from "../version.js";
 import { DEFAULT_CONTAINER_LISTEN_PORT } from "./stack-config.js";
+import { parseHostTuning } from "../tuning.js";
 export const EXIT_REFUSED = 1;
 export const EXIT_TENANT = 2;
 export const EXIT_USAGE = 64;
@@ -51,6 +52,14 @@ class Exit extends Error {
         this.code = code;
     }
 }
+/**
+ * The Host tuning this container runs with (`NYLORUN_TUNING`, as the Host reads it): how long
+ * the command waits for the Host's `/ready` (`host.operateReadyTimeoutMs`) and for its pool to
+ * close (`postgres.closeTimeoutSeconds`).
+ */
+function tuningOf(io) {
+    return parseHostTuning(io.env.NYLORUN_TUNING).tuning;
+}
 /** Runs one command; resolves to the exit code. */
 export async function runOperate(argv, io) {
     try {
@@ -70,7 +79,7 @@ export async function runOperate(argv, io) {
             return await command(operatorKeys(store), io, store);
         }
         finally {
-            await sql.end({ timeout: 5 });
+            await sql.end({ timeout: tuningOf(io).postgres.closeTimeoutSeconds });
         }
     }
     catch (error) {
@@ -242,13 +251,13 @@ async function tenantStatus(io) {
         return unavailable(envelope ?? null, `The database cannot be read: ${error instanceof Error ? error.message : String(error)}`);
     }
     finally {
-        await sql.end({ timeout: 5 });
+        await sql.end({ timeout: tuningOf(io).postgres.closeTimeoutSeconds });
     }
     const port = io.env.NYLORUN_LISTEN_PORT ?? String(DEFAULT_CONTAINER_LISTEN_PORT);
     const ready = `http://127.0.0.1:${port}/ready`;
     let answer;
     try {
-        const response = await (io.fetch ?? fetch)(ready, { signal: AbortSignal.timeout(5000) });
+        const response = await (io.fetch ?? fetch)(ready, { signal: AbortSignal.timeout(tuningOf(io).host.operateReadyTimeoutMs) });
         answer = (await response.json());
     }
     catch {

package/dist/host/stack-config.d.ts

@@ -41,10 +41,13 @@
  * `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`, with `OTEL_EXPORTER_OTLP_HEADERS`), what they say of
  * their source (`OTEL_SERVICE_NAME`, `OTEL_RESOURCE_ATTRIBUTES`) and which content they carry
  * (`NYLORUN_TRACE_CONTENT`, or all of it with `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`).
+ * So is the Host tuning (`NYLORUN_TUNING`, `tuning.ts`), for every service: its timings,
+ * retries and internal sizes.
  */
 import { type TraceResource } from "../traces/otlp.js";
 import { type TraceContentKind } from "../traces/map.js";
 import { type BlockedAddress } from "../sandbox/pods/network-gate.js";
+import { type HostTuning } from "../tuning.js";
 /** A Runtime service this release has. */
 export type RuntimeService = "core" | "loop" | "gates" | "keys" | "egress" | "harness";
 export type RuntimeServices = ReadonlySet<RuntimeService>;
@@ -249,6 +252,14 @@ export interface StackConfig {
      * present only with an endpoint (Q5): without one there is no replication slot and no cost.
      */
     traces?: TraceConfig;
+    /**
+     * Present when `NYLORUN_TUNING` is set: the Host tuning (`tuning.ts`) over its defaults,
+     * and the overrides as written, which core hands a pod sandbox's engine. Every service reads it.
+     */
+    tuning?: {
+        values: HostTuning;
+        overrides: Record<string, unknown>;
+    };
 }
 /** Traces (R7.2), from the standard `OTEL_*` variables and `NYLORUN_TRACE_CONTENT`. */
 export interface TraceConfig {

package/dist/host/stack-config.js

@@ -41,11 +41,14 @@
  * `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`, with `OTEL_EXPORTER_OTLP_HEADERS`), what they say of
  * their source (`OTEL_SERVICE_NAME`, `OTEL_RESOURCE_ATTRIBUTES`) and which content they carry
  * (`NYLORUN_TRACE_CONTENT`, or all of it with `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`).
+ * So is the Host tuning (`NYLORUN_TUNING`, `tuning.ts`), for every service: its timings,
+ * retries and internal sizes.
  */
 import { DEFAULT_SERVICE_NAME } from "../traces/otlp.js";
 import { TRACE_CONTENT_KINDS } from "../traces/map.js";
 import { isTenantId } from "@nylorun/core/compatibility";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
+import { HostTuningError, parseHostTuning } from "../tuning.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
 /**
  * Services that may share a process (D12): they hold the same secrets and parse the same
@@ -254,8 +257,9 @@ function parseIdentityKeys(env) {
 /** Parse the stack configuration; throws `StackConfigError` naming the variable. */
 export function parseStackConfig(env, argv) {
     const { services, deprecatedRole } = parseServices(argv);
+    const tuning = parseTuning(env);
     if (services.has("harness"))
-        return { services, harness: parseHarnessService(env), endpoints: {} };
+        return { services, harness: parseHarnessService(env), endpoints: {}, ...(tuning ? { tuning } : {}) };
     // The image sets NYLORUN_LISTEN_*: only the API's processes read them.
     const servesApi = services.has("core") || services.has("loop");
     const listen = servesApi ? parseListen(env) : undefined;
@@ -345,8 +349,24 @@ export function parseStackConfig(env, argv) {
         ...(tenant ? { tenant } : {}),
         ...(objectStore ? { objectStore } : {}),
         ...(traces ? { traces } : {}),
+        ...(tuning ? { tuning } : {}),
     };
 }
+/** `StackConfig.tuning` from `NYLORUN_TUNING`, or undefined when it is unset. */
+function parseTuning(env) {
+    const raw = read(env, "NYLORUN_TUNING");
+    if (raw === undefined)
+        return undefined;
+    try {
+        const { tuning, overrides } = parseHostTuning(raw);
+        return { values: tuning, overrides: overrides ?? {} };
+    }
+    catch (error) {
+        if (error instanceof HostTuningError)
+            throw new StackConfigError(error.message);
+        throw error;
+    }
+}
 /**
  * `StackConfig.traces` (R7.2). The OTLP endpoint is the collector's base URL, to which
  * `/v1/traces` is added; `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` is the full URL and wins. Headers

package/dist/index.d.ts

@@ -5,7 +5,6 @@ export { createTrustedIssuers, type TrustedIssuers, type TrustedIssuersOptions,
 export type { TenantConfig, TenantHandle, TenantPaths, Logger, OpenTenantRuntime, } from "./tenant/types.js";
 export { scriptedModel, gatewayModel, type ModelProvider } from "./core/provider.js";
 export type { RuntimeAgent } from "./contracts.js";
-export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
 export type { RuntimeModelAdapter } from "./contracts.js";
 export { baselineEnvironment, hostProcessEnvironment, } from "./host/environment.js";
 export type { HostProcessPathInputs } from "./host/environment.js";

package/dist/index.js

@@ -3,5 +3,4 @@ export { startEphemeralRuntime, } from "./tenant/ephemeral.js";
 export { parseIdentityFile, IdentityFileError, } from "./tenant/identity-file.js";
 export { createTrustedIssuers, } from "./tenant/issuers.js";
 export { scriptedModel, gatewayModel } from "./core/provider.js";
-export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
 export { baselineEnvironment, hostProcessEnvironment, } from "./host/environment.js";

package/dist/infra/index.js

@@ -2,6 +2,7 @@ import { createDatabase } from "./database.js";
 import { createExecution, executionKind } from "./execution.js";
 import { createReadiness, infraProbes } from "./readiness.js";
 import { createStreams, streamsKind } from "./streams.js";
+import { hostTuning } from "../tuning.js";
 export { createDatabase, probeDatabase } from "./database.js";
 export { createExecution, probeExecution, WORKER_LISTEN } from "./execution.js";
 export { createReadiness, infraProbes } from "./readiness.js";
@@ -30,7 +31,7 @@ export function createInfra(config, options = {}) {
         ...(streams ? { streams } : {}),
         ...(readiness ? { readiness } : {}),
         async close() {
-            await Promise.allSettled([database?.end({ timeout: 5 }), streams?.close()]);
+            await Promise.allSettled([database?.end({ timeout: hostTuning().postgres.closeTimeoutSeconds }), streams?.close()]);
         },
     };
 }

package/dist/infra/readiness.d.ts

@@ -21,8 +21,6 @@ export interface ReadinessReport {
     errors: Record<string, string>;
 }
 export type Readiness = () => Promise<ReadinessReport>;
-/** Default bound on one readiness pass. Compose probes `/ready` every 2 s with a 5 s timeout. */
-export declare const READINESS_TIMEOUT_MS = 2000;
 export declare function createReadiness(probes: Readonly<Record<string, Probe>>, options?: {
     timeoutMs?: number;
 }): Readiness;

package/dist/infra/readiness.js

@@ -1,9 +1,10 @@
 import { probeDatabase } from "./database.js";
 import { probeExecution } from "./execution.js";
-/** Default bound on one readiness pass. Compose probes `/ready` every 2 s with a 5 s timeout. */
-export const READINESS_TIMEOUT_MS = 2000;
+import { hostTuning } from "../tuning.js";
 export function createReadiness(probes, options = {}) {
-    const timeoutMs = options.timeoutMs ?? READINESS_TIMEOUT_MS;
+    // The bound on one pass: `host.readinessTimeoutMs` (Host tuning). Compose probes `/ready` every
+    // 2 s with a 5 s timeout.
+    const timeoutMs = options.timeoutMs ?? hostTuning().host.readinessTimeoutMs;
     return async () => {
         const entries = Object.entries(probes);
         const results = await Promise.all(entries.map(async ([name, probe]) => [name, await runProbe(probe, timeoutMs)]));

package/dist/keys/client.d.ts

@@ -4,6 +4,7 @@ export interface HttpKeysOptions {
     readonly url: string;
     /** `NYLORUN_GATES_TOKEN`. */
     readonly token: string;
+    /** Default `keys.timeoutMs` (Host tuning): signing and vault writes are short. */
     readonly timeoutMs?: number;
 }
 export declare function httpKeys(options: HttpKeysOptions): Keys;

package/dist/keys/client.js

@@ -10,12 +10,11 @@ import { HttpError } from "../tenant/http.js";
 import { VaultError } from "../vault/error.js";
 import { KEYS_PATH } from "./contract.js";
 import { KEYS_OPERATIONS } from "./keys.js";
-/** Signing and vault writes are short; anything slower is a gateway in trouble. */
-const KEYS_TIMEOUT_MS = 30_000;
+import { hostTuning } from "../tuning.js";
 export function httpKeys(options) {
     const where = new URL(options.url).origin;
     function call(operation, args) {
-        const timeoutMs = options.timeoutMs ?? KEYS_TIMEOUT_MS;
+        const timeoutMs = options.timeoutMs ?? hostTuning().keys.timeoutMs;
         const url = new URL(`${KEYS_PATH}/${operation}`, options.url);
         const send = url.protocol === "https:" ? httpsRequest : httpRequest;
         const payload = Buffer.from(JSON.stringify({ args }), "utf8");