@nylorun/runtime 0.25.0-beta → 0.27.0-beta

package/dist/sandbox/pods/network-gate.js

@@ -4,12 +4,11 @@
  * (`10.96.0.1:443`) for 0.5 to 5 s after it started (8a). So before the engine joins, or runs
  * anything, it connects to addresses the policy must block (the API server's service address,
  * `KUBERNETES_SERVICE_HOST:KUBERNETES_SERVICE_PORT`, which the kubelet always sets) until each
- * fails `CONFIRMATIONS` times in a row (refused, unreachable or timed out). A connection that
+ * fails `harness.networkConfirmations` times in a row (Host tuning) (refused, unreachable or timed out). A connection that
  * succeeds starts the count again. Past `timeoutMs` the engine exits, and the pod restarts it.
  */
 import { connect } from "node:net";
-/** Consecutive failed connections that prove an address blocked. */
-export const CONFIRMATIONS = 3;
+import { hostTuning } from "../../tuning.js";
 /** The addresses a pod's NetworkPolicy must block: the API server's service address. */
 export function blockedAddresses(env) {
     const override = env.NYLORUN_SANDBOX_BLOCKED_PROBE;
@@ -45,19 +44,20 @@ export function opens(address, timeoutMs) {
 }
 /** Resolves once every address is blocked; rejects past the timeout. */
 export async function awaitNetworkPolicy(options) {
+    const tuning = hostTuning().harness;
     const started = Date.now();
-    const deadline = started + (options.timeoutMs ?? 120_000);
-    const needed = options.confirmations ?? CONFIRMATIONS;
+    const deadline = started + (options.timeoutMs ?? tuning.networkPolicyTimeoutMs);
+    const needed = options.confirmations ?? tuning.networkConfirmations;
     for (const address of options.addresses) {
         let failures = 0;
         let opened = 0;
         while (failures < needed) {
             if (Date.now() > deadline)
                 throw new Error(`The pod's NetworkPolicy is not in force: ${address.host}:${address.port} still answered ${opened} time(s)`);
-            if (await opens(address, options.attemptMs ?? 1_000)) {
+            if (await opens(address, options.attemptMs ?? tuning.networkProbeMs)) {
                 failures = 0;
                 opened += 1;
-                await new Promise((resolve) => setTimeout(resolve, options.pauseMs ?? 250));
+                await new Promise((resolve) => setTimeout(resolve, options.pauseMs ?? tuning.networkPauseMs));
             }
             else
                 failures += 1;

package/dist/sandbox/pods/reconcile.js

@@ -15,12 +15,14 @@
  * infrastructure errors throw; Restate retries those.
  */
 import { randomBytes } from "node:crypto";
+import { DEFAULT_SANDBOX_IMAGE } from "../policy.js";
 import { effectiveSandboxConfig, readSandboxConfig } from "../tenant-config.js";
 import { podSandboxSpecOf } from "../resolve.js";
 import { sha256Hex } from "../join.js";
 import { recoverLostVolume } from "../../artifacts/disk.js";
 import { decide } from "./lifecycle.js";
 import { podLifecycleConfig, podSpecOf } from "./spec.js";
+import { hostTuning } from "../../tuning.js";
 export async function reconcileSandbox(ctx, sandboxId, trigger) {
     const pods = ctx.pods;
     if (!pods || ctx.closed)
@@ -52,6 +54,7 @@ export async function reconcileSandbox(ctx, sandboxId, trigger) {
     const lifecycle = podLifecycleConfig(config, row.recipe);
     const decision = decide({
         row,
+        image: row.applied.image ?? DEFAULT_SANDBOX_IMAGE,
         config: lifecycle,
         status: await status(row.pod.k8sName),
         ...(row.pod.retiring ? { retiring: await status(row.pod.retiring) } : {}),
@@ -116,7 +119,7 @@ export async function reconcileSandbox(ctx, sandboxId, trigger) {
                 message: error instanceof Error ? error.message : String(error),
             });
             // Nothing of the decision is written: the next reconcile decides again.
-            return { retryAfterMs: decision.retryAfterMs ?? 5_000 };
+            return { retryAfterMs: decision.retryAfterMs ?? hostTuning().pods.reconcileRetryMs };
         }
     }
     const written = await ctx.store.tx(async (t) => {

package/dist/sandbox/pods/spec.js

@@ -5,7 +5,8 @@
  */
 import { parseSandboxDuration, parseSandboxSize } from "@nylorun/core/define";
 import { DEFAULT_HARNESS } from "@nylorun/core/contracts";
-import { memoryMiBOf } from "../policy.js";
+import { idleMsOf, memoryMiBOf } from "../policy.js";
+import { podTuningEnv } from "../../tuning.js";
 import { opIdOf } from "./lifecycle.js";
 /** The pod's grace period to stop when the Tenant sets none (D34). */
 export const DEFAULT_STOP_GRACE_SECONDS = 10;
@@ -19,13 +20,13 @@ export const POD_HARNESS_ROOT = "/harness";
  */
 export function podLifecycleConfig(config, recipe) {
     const stopGrace = config.lifecycle?.stopGrace;
-    const tenantIdle = parseSandboxDuration(config.limits?.idle ?? "15m") ?? 15 * 60_000;
+    const tenantIdle = idleMsOf({ ...(config.limits?.idle === undefined ? {} : { idle: config.limits.idle }) });
     const own = recipe?.lifecycle.idle === undefined ? undefined : parseSandboxDuration(recipe.lifecycle.idle);
+    const graceMs = stopGrace === undefined ? undefined : parseSandboxDuration(stopGrace);
     return {
         idleMs: own === undefined ? tenantIdle : Math.min(own, tenantIdle),
-        stopGraceSeconds: stopGrace === undefined
-            ? DEFAULT_STOP_GRACE_SECONDS
-            : Math.max(1, Math.min(30, Math.round((parseSandboxDuration(stopGrace) ?? 10_000) / 1000))),
+        // Kubernetes counts the grace in whole seconds, at least one.
+        stopGraceSeconds: graceMs === undefined ? DEFAULT_STOP_GRACE_SECONDS : Math.max(1, Math.round(graceMs / 1000)),
     };
 }
 /** The volume's size in GiB. */
@@ -53,6 +54,8 @@ export function podSpecOf(input) {
         env: {
             NYLORUN_SANDBOX_ID: input.environmentId,
             NYLORUN_HARNESS_ROOT: POD_HARNESS_ROOT,
+            // The `harness` and `engine` tuning the operator set: the pod's engine runs with them.
+            ...podTuningEnv(),
         },
         ...(input.joinToken ? { joinToken: input.joinToken } : {}),
     };

package/dist/sandbox/policy.d.ts

@@ -4,10 +4,16 @@ import type { ResolvedNetwork } from "./types.js";
 export declare const DEFAULT_SANDBOX_IMAGE = "python:3.13-slim";
 export declare const DEFAULT_SANDBOX_CPUS = 2;
 export declare const DEFAULT_SANDBOX_MEMORY_MIB = 1024;
-export declare const DEFAULT_SANDBOX_IDLE_MS: number;
+/** The default of the Tenant's Environment setting `limits.idle` (`environments.config`, D36). */
+export declare const DEFAULT_SANDBOX_IDLE = "15m";
 /** Package registries and code hosts. Concrete names so every backend can express them. */
 export declare const DEV_PRESET_HOSTS: readonly string[];
 export declare function resolveNetwork(manifest: SandboxManifest | undefined): ResolvedNetwork;
+/**
+ * How long the sandbox may sit idle: its spec's `idle`, which `sandboxSpecOf` sets from the
+ * Environment's `lifecycle.idle` within the Tenant's `limits.idle`; else that setting's default
+ * (`DEFAULT_SANDBOX_IDLE`, D36).
+ */
 export declare function idleMsOf(manifest: SandboxManifest | undefined): number;
 export declare function memoryMiBOf(manifest: SandboxManifest | undefined): number;
 export declare function describeNetwork(network: ResolvedNetwork): string;

package/dist/sandbox/policy.js

@@ -1,9 +1,11 @@
 import { parseSandboxDuration, parseSandboxSize, } from "@nylorun/core/define";
+import { hostTuning } from "../tuning.js";
 /** Docker Official Image: Debian with bash, coreutils and Python 3; small first pull. */
 export const DEFAULT_SANDBOX_IMAGE = "python:3.13-slim";
 export const DEFAULT_SANDBOX_CPUS = 2;
 export const DEFAULT_SANDBOX_MEMORY_MIB = 1024;
-export const DEFAULT_SANDBOX_IDLE_MS = 15 * 60_000;
+/** The default of the Tenant's Environment setting `limits.idle` (`environments.config`, D36). */
+export const DEFAULT_SANDBOX_IDLE = "15m";
 /** Package registries and code hosts. Concrete names so every backend can express them. */
 export const DEV_PRESET_HOSTS = Object.freeze([
     // npm and yarn
@@ -50,14 +52,19 @@ export function resolveNetwork(manifest) {
         suffixes: Object.freeze([...suffixes].sort()),
     });
 }
+/**
+ * How long the sandbox may sit idle: its spec's `idle`, which `sandboxSpecOf` sets from the
+ * Environment's `lifecycle.idle` within the Tenant's `limits.idle`; else that setting's default
+ * (`DEFAULT_SANDBOX_IDLE`, D36).
+ */
 export function idleMsOf(manifest) {
-    return (manifest?.idle && parseSandboxDuration(manifest.idle)) || DEFAULT_SANDBOX_IDLE_MS;
+    return parseSandboxDuration(manifest?.idle ?? DEFAULT_SANDBOX_IDLE) ?? parseSandboxDuration(DEFAULT_SANDBOX_IDLE);
 }
 export function memoryMiBOf(manifest) {
     const bytes = manifest?.resources?.memory
         ? parseSandboxSize(manifest.resources.memory)
         : undefined;
-    return bytes ? Math.max(128, Math.ceil(bytes / 1024 ** 2)) : DEFAULT_SANDBOX_MEMORY_MIB;
+    return bytes ? Math.max(hostTuning().pods.memoryFloorMiB, Math.ceil(bytes / 1024 ** 2)) : DEFAULT_SANDBOX_MEMORY_MIB;
 }
 export function describeNetwork(network) {
     const extra = network.preset === "dev"

package/dist/sandbox/resolve.d.ts

@@ -1,10 +1,10 @@
 /**
  * Resolves an Environment's recipe (`PUT /v1/environments/{id}`) against its Tenant's limits,
- * and the sandbox spec a recipe gives a session's pinned manifest (its `runtime` block) and the pod. Pure: the
+ * and the sandbox spec a recipe gives a session (`Session.sandbox`) and the pod. Pure: the
  * caller supplies the configuration. Every problem is reported, not only the first, so one
  * response lists all of them.
  */
-import type { EnvironmentFile, EnvironmentKind, EnvironmentLifecycle, EnvironmentRecipe, EnvironmentSecretSlots, EnvironmentSetupCommand } from "@nylorun/core/contracts";
+import type { EnvironmentFile, EnvironmentKind, EnvironmentLifecycle, EnvironmentLimits, EnvironmentRecipe, EnvironmentSecretSlots, EnvironmentSetupCommand } from "@nylorun/core/contracts";
 import { type SandboxManifest } from "@nylorun/core/define";
 import type { PodSandboxSpec } from "./pods/spec.js";
 import { type EffectiveSandboxConfig } from "./tenant-config.js";
@@ -25,6 +25,11 @@ export interface RecipeRequest {
     readonly files?: readonly EnvironmentFile[];
     /** The secret slots (D64): passed through for every kind. */
     readonly secrets?: EnvironmentSecretSlots;
+    /**
+     * Artifact and skill limits: passed through for every kind, as set. The caller checks them
+     * against the Tenant's (`tenant/limits.ts`), which this module does not read.
+     */
+    readonly limits?: EnvironmentLimits;
 }
 export type RecipeResolution = {
     readonly kind: "recipe";
@@ -36,7 +41,7 @@ export type RecipeResolution = {
 /** The recipe `request` asks for an Environment of `kind`, or every reason it cannot have it. */
 export declare function resolveRecipe(kind: EnvironmentKind, request: RecipeRequest, config: EffectiveSandboxConfig): RecipeResolution;
 /**
- * The sandbox spec of a recipe: what a session's `runtime` block pins and the virtual
+ * The sandbox spec of a recipe: what a session pins when it opens and the virtual
  * workspace runs. Idle is the Environment's `lifecycle.idle`, else the Tenant's.
  */
 export declare function sandboxSpecOf(recipe: EnvironmentRecipe, tenantIdle: string): SandboxManifest;

package/dist/sandbox/resolve.js

@@ -20,7 +20,10 @@ export function resolveRecipe(kind, request, config) {
                 errors.push(`${field} is for an Environment with a sandbox: kind none has none.`);
         if (errors.length > 0)
             return { kind: "error", errors };
-        return { kind: "recipe", recipe: { harness, lifecycle: { ...lifecycle }, ...slotsOf(request) } };
+        return {
+            kind: "recipe",
+            recipe: { harness, lifecycle: { ...lifecycle }, ...limitsOf(request), ...slotsOf(request) },
+        };
     }
     if (request.image !== undefined && !pod)
         errors.push("image is for kind pod: a virtual Environment runs no images.");
@@ -57,10 +60,17 @@ export function resolveRecipe(kind, request, config) {
             lifecycle: { ...lifecycle },
             ...(pod && request.setup?.length ? { setup: request.setup.map((command) => ({ ...command })) } : {}),
             ...(pod && request.files?.length ? { files: request.files.map((file) => ({ ...file })) } : {}),
+            ...limitsOf(request),
             ...slotsOf(request),
         },
     };
 }
+/** The request's limits, when it sets any. */
+function limitsOf(request) {
+    return request.limits !== undefined && Object.keys(request.limits).length > 0
+        ? { limits: structuredClone(request.limits) }
+        : {};
+}
 /** The request's secret slots, when it declares any. */
 function slotsOf(request) {
     return request.secrets !== undefined && Object.keys(request.secrets).length > 0
@@ -68,7 +78,7 @@ function slotsOf(request) {
         : {};
 }
 /**
- * The sandbox spec of a recipe: what a session's `runtime` block pins and the virtual
+ * The sandbox spec of a recipe: what a session pins when it opens and the virtual
  * workspace runs. Idle is the Environment's `lifecycle.idle`, else the Tenant's.
  */
 export function sandboxSpecOf(recipe, tenantIdle) {

package/dist/sandbox/setup.d.ts

@@ -34,7 +34,9 @@ export declare function parseSetupReport(value: unknown): SetupReport | undefine
 /**
  * Records a failed setup on Environment `id` held at host epoch `epoch` (the reporting engine's):
  * the pod is `failed` with a reason that starts `setup:`, and `environment.failed` says which
- * command failed and how. A report from an older host, or a success, changes nothing.
+ * command failed and how, with the end of its output (the Tenant's `setupOutputChars`; the reason
+ * quotes `setupReasonChars` of it and `setupCommandExcerptChars` of the command). A report
+ * from an older host, or a success, changes nothing.
  */
 export declare function recordSetup(ctx: TenantContext, id: string, epoch: number, report: SetupReport): Promise<void>;
 /**

package/dist/sandbox/setup.js

@@ -1,24 +1,43 @@
+/**
+ * Setup and input files (R2d step 2, Host feature `environment-setup`): what a pod Environment's
+ * engine runs and copies when its disk is made or reset, before it takes any turn. The plan is
+ * the applied recipe's `setup` and `files`, handed to the engine with its host token (the join
+ * answer, and `GET host/setup` while it waits to retry, or, on a fork onto other setup, for its
+ * disk version to be written: Q17); the engine keeps a marker on the volume
+ * (`/harness/setup.json`), so a resume never runs it again and a reset (a new volume) does.
+ *
+ * Input files come only through the routes here, indexed into the applied recipe's `files`:
+ * a pod reads the artifact versions and the definition files by hash (Q6) its own recipe names,
+ * and nothing else of the Object store.
+ *
+ * A failed command fails the pod (`observed: failed`, a reason that starts `setup:`, and
+ * `environment.failed` with the command, its exit code and the end of its output): the turn that
+ * waits for it fails with that reason (`podUnusable`, `tenant/advance.ts`), the failure stays
+ * until a turn start asks the pod to run again (`wantRunning`), and the engine, polling, runs the
+ * setup again then.
+ */
+import { ENVIRONMENT_SETUP_TIMEOUT_DEFAULT, } from "@nylorun/core/contracts";
 import { parseSandboxDuration } from "@nylorun/core/define";
 import { contentKey, readManifest } from "../artifacts/folders.js";
-import { contentTypeFor } from "../artifacts/media-types.js";
+import { contentTypeFor } from "@nylorun/core/contracts";
 import { definitionFileKey } from "../tenant/definition-files.js";
 import { SETUP_FAILED } from "./pods/lifecycle.js";
+import { readRuntimeLimits } from "../tenant/runtime-limits.js";
 export { SETUP_FAILED };
-/** The most of a failed command's output kept in its event and reason. */
-const OUTPUT_TAIL = 4 * 1024;
-/** A command's timeout when the recipe gives none. */
-const DEFAULT_TIMEOUT_MS = 10 * 60_000;
 /** The setup of `recipe`, or undefined when it has neither commands nor files. */
 export async function setupPlanOf(ctx, t, environment) {
     const recipe = environment.applied;
     if (!recipe.setup?.length && !recipe.files?.length)
         return undefined;
+    // A command's own timeout, else the default, within the Tenant's `setupCommandMs` as it is now.
+    const { setupCommandMs } = await readRuntimeLimits(t);
+    const timeoutOf = (timeout) => Math.min(parseSandboxDuration(timeout ?? ENVIRONMENT_SETUP_TIMEOUT_DEFAULT), setupCommandMs);
     return {
         recipeVersion: environment.appliedVersion,
         commands: (recipe.setup ?? []).map((command) => ({
             command: command.command,
             cwd: command.cwd ?? "/workspace",
-            timeoutMs: (command.timeout && parseSandboxDuration(command.timeout)) || DEFAULT_TIMEOUT_MS,
+            timeoutMs: timeoutOf(command.timeout),
         })),
         files: (recipe.files ?? []).map((file, index) => ({ index, path: file.path })),
         environment: await ctx.vault.environmentVariables(t, environment.id),
@@ -32,7 +51,7 @@ export function parseSetupReport(value) {
         return undefined;
     const index = typeof report.index === "number" && Number.isInteger(report.index) ? report.index : undefined;
     const exitCode = typeof report.exitCode === "number" && Number.isInteger(report.exitCode) ? report.exitCode : undefined;
-    const output = typeof report.output === "string" ? report.output.slice(-OUTPUT_TAIL) : undefined;
+    const output = typeof report.output === "string" ? report.output : undefined;
     return {
         status: report.status,
         ...(index === undefined ? {} : { index }),
@@ -43,7 +62,9 @@ export function parseSetupReport(value) {
 /**
  * Records a failed setup on Environment `id` held at host epoch `epoch` (the reporting engine's):
  * the pod is `failed` with a reason that starts `setup:`, and `environment.failed` says which
- * command failed and how. A report from an older host, or a success, changes nothing.
+ * command failed and how, with the end of its output (the Tenant's `setupOutputChars`; the reason
+ * quotes `setupReasonChars` of it and `setupCommandExcerptChars` of the command). A report
+ * from an older host, or a success, changes nothing.
  */
 export async function recordSetup(ctx, id, epoch, report) {
     await ctx.store.tx(async (t) => {
@@ -57,9 +78,11 @@ export async function recordSetup(ctx, id, epoch, report) {
                 await t.updateEnvironment(id, { diskSeed: null }, new Date().toISOString());
             return;
         }
+        const { setupOutputChars, setupReasonChars, setupCommandExcerptChars } = await readRuntimeLimits(t);
+        const output = (report.output ?? "").slice(-setupOutputChars);
         const command = report.index === undefined ? undefined : environment.applied.setup?.[report.index];
-        const what = command === undefined ? "copying the input files failed" : `command ${report.index + 1} (${command.command.slice(0, 80)}) exited ${report.exitCode ?? "abnormally"}`;
-        const tail = (report.output ?? "").trim().slice(-500);
+        const what = command === undefined ? "copying the input files failed" : `command ${report.index + 1} (${command.command.slice(0, setupCommandExcerptChars)}) exited ${report.exitCode ?? "abnormally"}`;
+        const tail = output.trim().slice(-setupReasonChars);
         const reason = `${SETUP_FAILED} ${what}${tail ? `: ${tail}` : ""}`;
         await t.updateEnvironmentPod(id, { observed: "failed", reason }, new Date().toISOString());
         await t.environmentEvent(id, "environment.failed", {
@@ -67,7 +90,7 @@ export async function recordSetup(ctx, id, epoch, report) {
             setup: {
                 ...(report.index === undefined ? {} : { index: report.index }),
                 ...(report.exitCode === undefined ? {} : { exitCode: report.exitCode }),
-                output: report.output ?? "",
+                output,
             },
         });
     });

package/dist/sandbox/share.d.ts

@@ -1,7 +1,7 @@
 /**
  * A session's sandbox: the one of the Environment it names (protocol 11), whose id keys the
- * workspace, with the spec pinned when the session was opened (`Session.sandbox`). Definitions
- * no longer declare one (Sandboxes v3); `sandboxSpecOf` still reads a pinned manifest's.
+ * workspace, with the spec pinned when the session was opened (`Session.sandbox`, the one place
+ * it is kept since protocol 15). Definitions declare none (Sandboxes v3).
  */
 import { type AgentManifest, type SandboxManifest, type WorkflowManifest } from "@nylorun/core/define";
 export type SessionSandboxRef = {
@@ -13,23 +13,14 @@ export type SessionSandboxRef = {
     /** The Environment's sandbox spec, pinned when the session was opened. */
     readonly sandbox?: SandboxManifest;
 };
-/** The session's sandbox spec: the one pinned at open, else the one its definition declares. */
-export declare function sessionSandboxSpec(session: SessionSandboxRef): SandboxManifest | undefined;
-/** The sandbox spec of a pinned agent manifest (its `runtime` block) or a workflow manifest. */
-export declare function sandboxSpecOf(manifest: AgentManifest | WorkflowManifest | Record<string, unknown> | undefined): SandboxManifest | undefined;
+/** The session's sandbox spec, pinned when it was opened (or inherited from its tree's owner). */
+export declare function sessionSandboxSpec(session: Pick<SessionSandboxRef, "sandbox">): SandboxManifest | undefined;
 /**
  * Where a definition document declares a sandbox: a workflow's `sandbox`, and the agents embedded
  * in a flow agent. Definitions no longer declare one (Sandboxes v3), so registration refuses any
- * of these. An agent manifest cannot: its sandbox is in the `runtime` block, which the schema
- * refuses at registration.
+ * of these. An agent manifest has no field for one.
  */
 export declare function declaredSandboxes(manifest: unknown, into?: string[]): string[];
-/**
- * The agents of a definition document that set `runtime`: the document itself, the agents it
- * uses as tools and those embedded in a flow agent. Only the Runtime writes that block, when it
- * pins a session's manifest, so registration refuses any of these.
- */
-export declare function authoredRuntimeBlocks(manifest: unknown, into?: string[]): string[];
 /**
  * The workspace a session's sandbox tools run in: the session, whose log records the
  * workspace's events, and its Environment, whose id keys the workspace.

package/dist/sandbox/share.js

@@ -1,26 +1,17 @@
 /**
  * A session's sandbox: the one of the Environment it names (protocol 11), whose id keys the
- * workspace, with the spec pinned when the session was opened (`Session.sandbox`). Definitions
- * no longer declare one (Sandboxes v3); `sandboxSpecOf` still reads a pinned manifest's.
+ * workspace, with the spec pinned when the session was opened (`Session.sandbox`, the one place
+ * it is kept since protocol 15). Definitions declare none (Sandboxes v3).
  */
 import {} from "@nylorun/core/define";
-/** The session's sandbox spec: the one pinned at open, else the one its definition declares. */
+/** The session's sandbox spec, pinned when it was opened (or inherited from its tree's owner). */
 export function sessionSandboxSpec(session) {
-    return session.sandbox ?? sandboxSpecOf(session.manifest);
-}
-/** The sandbox spec of a pinned agent manifest (its `runtime` block) or a workflow manifest. */
-export function sandboxSpecOf(manifest) {
-    if (!manifest || typeof manifest !== "object")
-        return undefined;
-    if (manifest.kind === "workflow")
-        return manifest.sandbox;
-    return manifest.runtime?.sandbox;
+    return session.sandbox;
 }
 /**
  * Where a definition document declares a sandbox: a workflow's `sandbox`, and the agents embedded
  * in a flow agent. Definitions no longer declare one (Sandboxes v3), so registration refuses any
- * of these. An agent manifest cannot: its sandbox is in the `runtime` block, which the schema
- * refuses at registration.
+ * of these. An agent manifest has no field for one.
  */
 export function declaredSandboxes(manifest, into = []) {
     if (!manifest || typeof manifest !== "object")
@@ -37,26 +28,6 @@ export function declaredSandboxes(manifest, into = []) {
         declaredSandboxes(tool.agent, into);
     return into;
 }
-/**
- * The agents of a definition document that set `runtime`: the document itself, the agents it
- * uses as tools and those embedded in a flow agent. Only the Runtime writes that block, when it
- * pins a session's manifest, so registration refuses any of these.
- */
-export function authoredRuntimeBlocks(manifest, into = []) {
-    if (!manifest || typeof manifest !== "object")
-        return into;
-    const document = manifest;
-    if (document.kind === "workflow") {
-        for (const agent of Object.values(document.agents ?? {}))
-            authoredRuntimeBlocks(agent, into);
-        return into;
-    }
-    if (document.runtime !== undefined)
-        into.push(`'${document.id}'`);
-    for (const tool of document.tools ?? [])
-        authoredRuntimeBlocks(tool.agent, into);
-    return into;
-}
 /**
  * The workspace a session's sandbox tools run in: the session, whose log records the
  * workspace's events, and its Environment, whose id keys the workspace.

package/dist/sandbox/skills.d.ts

@@ -1,15 +1,9 @@
-import { type AgentManifest } from "@nylorun/core/define";
-import type { SandboxHandle } from "./types.js";
-/** A skill's files, by path in its folder, as `sha256:<hex>`. */
-export type SkillFiles = Readonly<Record<string, string>>;
+import type { SandboxFileBytes, SandboxHandle } from "./types.js";
+/** A folder's files, by path in it, as `sha256:<hex>`. */
+export type FolderFiles = Readonly<Record<string, string>>;
 /**
- * The skill versions of the agent and the agents it uses as tools, by folder
- * (`/skills/<name>@<hash>`): each distinct version once.
+ * Writes one folder's files to `root`, replacing a partial copy a failed mount left, and makes
+ * them read-only. `read` gives a file's bytes by `sha256:<hex>`, whole or as chunks, which are
+ * written as they come.
  */
-export declare function sandboxSkillsOf(manifest: AgentManifest | undefined, into?: Map<string, Readonly<Record<string, string>>>): Map<string, SkillFiles>;
-/**
- * Writes one skill version's files to its folder `root` (`/skills/<name>@<hash>`), replacing a
- * partial copy a failed mount left, and makes them read-only. `read` gives a file's bytes by
- * `sha256:<hex>`.
- */
-export declare function mountSkill(handle: SandboxHandle, root: string, files: SkillFiles, read: (sha256: string) => Promise<Uint8Array>, signal: AbortSignal): Promise<void>;
+export declare function mountFolderFiles(handle: SandboxHandle, root: string, files: FolderFiles, read: (sha256: string) => Promise<SandboxFileBytes>, signal: AbortSignal): Promise<void>;

package/dist/sandbox/skills.js

@@ -1,41 +1,26 @@
 /**
- * A sandbox's skills (track R2 M4, D66): each version of a skill of the session's agent, and of
- * the agents it uses as tools (they share its sandbox), gets its files in its own folder,
- * `/skills/<name>@<hash>/` (`skillFolderOf`), read-only, so the model can read them and run their
- * scripts with bash. A version's folder is written once and never replaced: sessions whose agents
- * carry different versions of one skill share an Environment, and run turns at once, without
- * changing each other's files. The SandboxManager mounts the folders a session needs before the
- * first call that needs them; the bytes come from the Tenant's definition files. Folders live
- * outside the persisted disk, so a stop clears them and the next open mounts what is in use.
+ * Folders a harness mounts in a sandbox (protocol 15): our engine's skill folders,
+ * `/skills/<name>@<hash>/` (`skillFolderOf`, track R2 M4, D66), each one version's files,
+ * read-only, so the model can read them and run their scripts with bash. Our engine decides which
+ * folders and when (before each sandbox call); the SandboxManager writes them once per open
+ * handle (`mountFolder`). A version's folder is written once and never replaced: sessions whose
+ * agents carry different versions of one skill share an Environment, and run turns at once,
+ * without changing each other's files. Folders live outside the persisted disk, so a stop clears
+ * them and the next call mounts them again.
  */
 import { posix } from "node:path";
-import { skillFolderOf } from "@nylorun/core/define";
-import { quote } from "./tools.js";
+import { helperCommandTimeoutMs, quote } from "./tools.js";
+import { hostTuning } from "../tuning.js";
 /**
- * The skill versions of the agent and the agents it uses as tools, by folder
- * (`/skills/<name>@<hash>`): each distinct version once.
+ * Writes one folder's files to `root`, replacing a partial copy a failed mount left, and makes
+ * them read-only. `read` gives a file's bytes by `sha256:<hex>`, whole or as chunks, which are
+ * written as they come.
  */
-export function sandboxSkillsOf(manifest, into = new Map()) {
-    for (const skill of Object.values(manifest?.skills ?? {})) {
-        const folder = skillFolderOf(skill);
-        if (!into.has(folder))
-            into.set(folder, skill.files);
-    }
-    for (const tool of manifest?.tools ?? [])
-        if (tool.agent !== undefined && !("kind" in tool.agent))
-            sandboxSkillsOf(tool.agent, into);
-    return into;
-}
-/**
- * Writes one skill version's files to its folder `root` (`/skills/<name>@<hash>`), replacing a
- * partial copy a failed mount left, and makes them read-only. `read` gives a file's bytes by
- * `sha256:<hex>`.
- */
-export async function mountSkill(handle, root, files, read, signal) {
+export async function mountFolderFiles(handle, root, files, read, signal) {
     const exec = async (command) => {
-        const result = await handle.exec({ command, cwd: "/", timeoutMs: 60_000 }, signal);
+        const result = await handle.exec({ command, cwd: "/", timeoutMs: helperCommandTimeoutMs() }, signal);
         if (result.exitCode !== 0)
-            throw new Error(`${command.slice(0, 120)} failed: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
+            throw new Error(`${command.slice(0, hostTuning().harness.helperCommandExcerptChars)} failed: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     };
     const directories = new Set([root]);
     for (const path of Object.keys(files))

package/dist/sandbox/tenant-config.d.ts

@@ -4,13 +4,14 @@
  * fields take the defaults below.
  */
 import { type PlacementHost, type TenantEnvironmentsConfig } from "@nylorun/core/contracts";
+import { DEFAULT_SANDBOX_IDLE } from "./policy.js";
+export { DEFAULT_SANDBOX_IDLE };
 export declare const ENVIRONMENTS_CONFIG_SETTING = "environments.config";
 /** The Tenant's settings, as stored (`environments.config`). */
 export type TenantSandboxConfig = TenantEnvironmentsConfig;
 /** The most an Environment may ask for when the Tenant sets no maximum. */
 export declare const DEFAULT_MAX_CPUS = 4;
 export declare const DEFAULT_MAX_MEMORY_MIB = 8192;
-export declare const DEFAULT_SANDBOX_IDLE = "15m";
 /** The most Environments a Tenant holds when it sets no limit. */
 export declare const DEFAULT_MAX_ENVIRONMENTS = 100;
 export interface SandboxResourcesLimit {
@@ -47,4 +48,3 @@ export declare function effectiveSandboxConfig(config: TenantSandboxConfig): Eff
 /** The stored configuration, or `{}` when the Tenant has none. */
 export declare function readSandboxConfig(t: SettingsReader): Promise<TenantSandboxConfig>;
 export declare function writeSandboxConfig(t: SettingsWriter, config: TenantSandboxConfig): Promise<void>;
-export {};

package/dist/sandbox/tenant-config.js

@@ -5,17 +5,18 @@
  */
 import { TenantEnvironmentsConfigSchema, } from "@nylorun/core/contracts";
 import { parseSandboxSize } from "@nylorun/core/define";
-import { DEFAULT_SANDBOX_CPUS, DEFAULT_SANDBOX_MEMORY_MIB, DEV_PRESET_HOSTS, } from "./policy.js";
+import { DEFAULT_SANDBOX_CPUS, DEFAULT_SANDBOX_IDLE, DEFAULT_SANDBOX_MEMORY_MIB, DEV_PRESET_HOSTS, } from "./policy.js";
+import { hostTuning } from "../tuning.js";
+export { DEFAULT_SANDBOX_IDLE };
 export const ENVIRONMENTS_CONFIG_SETTING = "environments.config";
 /** The most an Environment may ask for when the Tenant sets no maximum. */
 export const DEFAULT_MAX_CPUS = 4;
 export const DEFAULT_MAX_MEMORY_MIB = 8192;
-export const DEFAULT_SANDBOX_IDLE = "15m";
 /** The most Environments a Tenant holds when it sets no limit. */
 export const DEFAULT_MAX_ENVIRONMENTS = 100;
 export function memoryMiB(value) {
     const bytes = parseSandboxSize(value);
-    return bytes === undefined ? 0 : Math.max(128, Math.ceil(bytes / 1024 ** 2));
+    return bytes === undefined ? 0 : Math.max(hostTuning().pods.memoryFloorMiB, Math.ceil(bytes / 1024 ** 2));
 }
 function resources(value, fallback) {
     return {

package/dist/sandbox/tools.d.ts

@@ -1,5 +1,6 @@
 import type { SandboxToolOutcome } from "@nylorun/core/contracts";
 import { type SandboxToolName } from "@nylorun/core/define";
+import { type SandboxToolLimits } from "@nylorun/harness";
 import type { SandboxHandle } from "./types.js";
 export type { SandboxToolOutcome };
 /** What the Runtime reports about a tool call on the session stream. */
@@ -9,6 +10,11 @@ export interface SandboxToolReport {
     readonly exitCode?: number;
     readonly killed?: boolean;
 }
+/**
+ * How long a command the Runtime runs for itself in a sandbox may take (making a file's folder,
+ * mounting a skill, a tool's own helper command): `harness.helperCommandTimeoutMs`.
+ */
+export declare const helperCommandTimeoutMs: () => number;
 export declare function quote(value: string): string;
 /**
  * An absolute path inside the sandbox. Relative paths are relative to the workspace; on a backend
@@ -20,6 +26,6 @@ export declare function truncateMiddle(value: string, limit?: number): {
     text: string;
     truncated: boolean;
 };
-export declare function runSandboxTool(handle: SandboxHandle, name: SandboxToolName, input: Record<string, any>, signal: AbortSignal, report: (value: SandboxToolReport) => void, 
+export declare function runSandboxTool(handle: SandboxHandle, name: SandboxToolName, input: Record<string, any>, signal: AbortSignal, report: (value: SandboxToolReport) => void, limits?: SandboxToolLimits, 
 /** Variables every command gets (R2c): secret names set to the sentinel, plain values. */
 environment?: Readonly<Record<string, string>>): Promise<SandboxToolOutcome>;