@nylorun/runtime 0.26.0-beta → 0.28.0-beta

package/dist/execution/memory.js

@@ -1,4 +1,5 @@
-import { DEFAULT_STOP_GRACE_MS, WAKE_REASONS, sessionKey, settleWithin, } from "./types.js";
+import { WAKE_REASONS, sessionKey, settleWithin, } from "./types.js";
+import { hostTuning } from "../tuning.js";
 /**
  * In-process `DurableExecution`. Not durable: wakes, timers and sweeps live in
  * memory. It keeps the seam's ordering guarantees within one process, which is
@@ -21,11 +22,12 @@ export class MemoryExecution {
     stopGraceMs;
     onError;
     constructor(options = {}) {
-        this.sweepIntervalMs = options.sweepIntervalMs ?? 5000;
-        this.retryDelayMs = options.retryDelayMs ?? 50;
-        this.maxAttempts = options.maxAttempts ?? 5;
-        this.dedupeRetentionMs = options.dedupeRetentionMs ?? 24 * 60 * 60_000;
-        this.stopGraceMs = options.stopGraceMs ?? DEFAULT_STOP_GRACE_MS;
+        const tuning = hostTuning();
+        this.sweepIntervalMs = options.sweepIntervalMs ?? tuning.sweep.intervalMs;
+        this.retryDelayMs = options.retryDelayMs ?? tuning.execution.memoryRetryMs;
+        this.maxAttempts = options.maxAttempts ?? tuning.execution.memoryAttempts;
+        this.dedupeRetentionMs = options.dedupeRetentionMs ?? tuning.execution.dedupeRetentionMs;
+        this.stopGraceMs = options.stopGraceMs ?? tuning.execution.stopGraceMs;
         this.onError =
             options.onError ??
                 ((error) => queueMicrotask(() => {

package/dist/execution/types.d.ts

@@ -137,7 +137,7 @@ export interface DurableExecution {
     start(handlers: WorkerHandlers): Promise<void>;
     /**
      * Stops delivering, aborts running advances' signals and waits for them, up to the
-     * implementation's stop grace (`DEFAULT_STOP_GRACE_MS`). Handlers still running then are
+     * implementation's stop grace (Host tuning `execution.stopGraceMs`). Handlers still running then are
      * abandoned: their sessions' leases lapse and the next advance takes over (§11.4).
      */
     stop(): Promise<void>;
@@ -178,11 +178,6 @@ export declare function parseSessionKey(key: string): {
     tenantId: string;
     sessionId: string;
 };
-/**
- * Default time `DurableExecution.stop` waits for running handlers after aborting them: the
- * advance grace period (`DEFAULT_ADVANCE_GRACE_MS` in `tenant/worker.ts`).
- */
-export declare const DEFAULT_STOP_GRACE_MS = 30000;
 /**
  * Waits until `inflight` is empty (it shrinks as its promises settle and may grow meanwhile),
  * for at most `graceMs`. Resolves to how many were still running when the grace ran out.

package/dist/execution/types.js

@@ -62,11 +62,6 @@ export function parseSessionKey(key) {
         throw new Error(`Invalid session key: ${key}`);
     return { tenantId: key.slice(0, at), sessionId: key.slice(at + 1) };
 }
-/**
- * Default time `DurableExecution.stop` waits for running handlers after aborting them: the
- * advance grace period (`DEFAULT_ADVANCE_GRACE_MS` in `tenant/worker.ts`).
- */
-export const DEFAULT_STOP_GRACE_MS = 30_000;
 /**
  * Waits until `inflight` is empty (it shrinks as its promises settle and may grow meanwhile),
  * for at most `graceMs`. Resolves to how many were still running when the grace ran out.

package/dist/gates/contract.d.ts

@@ -6,7 +6,8 @@
  * - Headers: `Authorization: Bearer <run token>` (F5, `tenant/run-token.ts`), `Idempotency-Key:
  *   <effect id>`, and optionally `Nylorun-Tenant: <tenant id>`, which must then be the token's
  *   Tenant. Core's credential (`NYLORUN_GATES_TOKEN`) is refused: only a run calls the model.
- * - Body: `ModelCallBody`, at most `MAX_MODEL_CALL_BYTES`. It names no session, turn or agent:
+ * - Body: `ModelCallBody`, at most the Tenant's Runtime limit `modelCallBytes` (`PUT
+ *   /v1/tenant/limits`, default 32 MiB). It names no session, turn or agent:
  *   the gate takes them from the token, and refuses a body that names them.
  * - `200 {outcome}` once the call has finished, whether the outcome is a candidate or a
  *   failure; nothing is sent while it runs. `401 gate_unauthorized` for a missing, malformed,
@@ -23,7 +24,7 @@
  * need not be live: a user cancel makes it stale, and still stops its call.
  */
 import type { ModelGateOutcome } from "./model-gate.js";
-export { MAX_MODEL_CALL_BYTES, MODEL_CALLS_PATH, ModelCallBodySchema, type GateErrorBody, type ModelCallBody, } from "@nylorun/core/harness-api";
+export { MODEL_CALLS_PATH, ModelCallBodySchema, type GateErrorBody, type ModelCallBody, } from "@nylorun/core/harness-api";
 /** Header naming the Tenant a call is for: optional, and checked against the gate's Tenant. */
 export declare const TENANT_HEADER = "nylorun-tenant";
 export interface ModelCallResponse {

package/dist/gates/contract.js

@@ -1,3 +1,3 @@
-export { MAX_MODEL_CALL_BYTES, MODEL_CALLS_PATH, ModelCallBodySchema, } from "@nylorun/core/harness-api";
+export { MODEL_CALLS_PATH, ModelCallBodySchema, } from "@nylorun/core/harness-api";
 /** Header naming the Tenant a call is for: optional, and checked against the gate's Tenant. */
 export const TENANT_HEADER = "nylorun-tenant";

package/dist/gates/egress-credentials.js

@@ -6,18 +6,19 @@
  * (keys holds its key; the pod trusts its certificate, `harness/pod.ts`), and reads HTTP/1.1
  * requests. For each request it reads the vault (one Postgres query, no cache, so a rotation
  * applies to the next request), sets the credential's header (replacing any of that name, such
- * as the `nylorun-managed` sentinel the CLI sent), and forwards it over TLS to the address the
+ * as the `nylorun_managed` sentinel the CLI sent), and forwards it over TLS to the address the
  * gate already checked, verifying the host's certificate by name against the public roots.
  *
  * Nothing here knows a tool: the header name and its format are the credential's. A release the
  * vault refuses (two secrets for one host, an unreadable value) answers 502 and is logged, never
  * as an event; a value never is. Upgrades (WebSocket) and HTTP/2 are not served on this path.
- * Each connection keeps a tally for its `environment.egress` event (R7.3, D67): how many requests it
+ * Each connection keeps a tally for its `agent.egress` event (R7.3, D67): how many requests it
  * read and which credentials it set, by id.
  */
 import { createServer } from "node:http";
 import { Agent, request } from "node:https";
 import { createSecureContext, TLSSocket } from "node:tls";
+import { hostTuning } from "../tuning.js";
 /** The answer to a CONNECT the gate serves; a tunnel's byte counts leave it out. */
 export const CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
 /** Headers that describe one hop and are never forwarded. */
@@ -62,7 +63,7 @@ export function credentialTerminator(options) {
         });
     });
     http.keepAliveTimeout = options.idleMs;
-    http.headersTimeout = 60_000;
+    http.headersTimeout = hostTuning().egress.credentialsHeadersTimeoutMs;
     // Uploads may be long; the client socket's idle timeout still applies.
     http.requestTimeout = 0;
     http.on("upgrade", (req, socket) => {
@@ -131,7 +132,7 @@ export function credentialTerminator(options) {
             };
             const agent = new Agent({
                 keepAlive: true,
-                maxSockets: 8,
+                maxSockets: hostTuning().egress.credentialsMaxSockets,
                 lookup,
                 ...(credentials.upstreamCa ? { ca: credentials.upstreamCa } : {}),
             });

package/dist/gates/egress.d.ts

@@ -1,6 +1,6 @@
 import { type Server } from "node:http";
 import { type Socket } from "node:net";
-import type { EgressRunningTurn, EnvironmentEventPayload } from "@nylorun/core/contracts";
+import type { EgressRunningTurn, AgentEventPayload } from "@nylorun/core/contracts";
 import type { EgressTokenVerdict } from "../sandbox/egress-token.js";
 import type { SessionStore } from "../store/types.js";
 import type { Logger } from "../tenant/types.js";
@@ -16,9 +16,13 @@ export interface EgressSandboxes {
         readonly allow: readonly string[];
     } | undefined>;
 }
-/** One connection's record (R7.3, D67): `environment.egress`'s payload. */
-export type EgressConnection = EnvironmentEventPayload<"environment.egress">;
-/** How many running turns one connection names, at most. */
+/** One connection's record (R7.3, D67): `agent.egress`'s payload. */
+export type EgressConnection = AgentEventPayload<"agent.egress">;
+/**
+ * How many running turns one connection names, at most: fixed by the `agent.egress` event
+ * contract (`runningTurns` holds at most 16 in `/core/contracts`), which every reader
+ * validates against, so not a setting here.
+ */
 export declare const EGRESS_RUNNING_TURNS_MAX = 16;
 /** Where egress-gate records connections (R7.3, D67). */
 export interface EgressRecord {
@@ -29,14 +33,6 @@ export interface EgressRecord {
 }
 /** Ports a tunnel may open. */
 export declare const EGRESS_PORTS: readonly number[];
-/** Tunnels one sandbox may hold open at once. */
-export declare const EGRESS_MAX_PER_SANDBOX = 64;
-/** A tunnel with no traffic either way for this long is closed. */
-export declare const EGRESS_IDLE_MS: number;
-/** How long a sandbox's epoch and allowlist are reused before they are read again. */
-export declare const EGRESS_CACHE_MS = 5000;
-/** How long the gate waits for the upstream connection. */
-export declare const EGRESS_CONNECT_TIMEOUT_MS = 10000;
 export interface StartEgressGateOptions {
     readonly listen: {
         readonly host: string;
@@ -46,9 +42,13 @@ export interface StartEgressGateOptions {
     /** Verifies a presented egress token (`verifyEgressToken` over the Tenant's keys). */
     verify(raw: string): Promise<EgressTokenVerdict>;
     readonly sandboxes: EgressSandboxes;
+    /** A tunnel with no traffic either way for this long is closed. Default `egress.idleMs`. */
     readonly idleMs?: number;
+    /** Tunnels one sandbox may hold open at once. Default `egress.maxTunnelsPerSandbox`. */
     readonly maxPerSandbox?: number;
+    /** How long a sandbox's epoch and allowlist are reused. Default `egress.cacheMs`. */
     readonly cacheMs?: number;
+    /** How long the gate waits for the upstream connection. Default `egress.connectTimeoutMs`. */
     readonly connectTimeoutMs?: number;
     /** Tests replace name resolution. */
     readonly lookup?: (host: string) => Promise<readonly {
@@ -90,7 +90,7 @@ export declare function storeEgressSandboxes(store: SessionStore): EgressSandbox
 /**
  * `EgressRecord` over the Tenant's record (R7.3, D67). The running turns are the sessions on the
  * Environment whose body has an `activeTurnId`, in id order, at most `EGRESS_RUNNING_TURNS_MAX`.
- * The write is `environment.egress` on the Environment's stream, under its row's lock; a deleted
+ * The write is `agent.egress` on the Environment's stream, under its row's lock; a deleted
  * Environment gets nothing.
  */
 export declare function storeEgressRecord(store: SessionStore): EgressRecord;

package/dist/gates/egress.js

@@ -25,7 +25,7 @@
  * never is. Tunnels close after `idleMs` without traffic in either direction.
  *
  * Every connection to a named host on a live token is recorded once (R7.3, D67), when it closes
- * or at once when the gate refuses it, as `environment.egress` on the Environment's own stream:
+ * or at once when the gate refuses it, as `agent.egress` on the Environment's own stream:
  * the connection is the Environment's, since its token names the pod and turns run in parallel
  * (D66). `runningTurns` lists the turns active on the Environment as it opened, as context and
  * never as an owner: one read, started as the name resolves and never waited for, so a turn that
@@ -41,19 +41,16 @@ import { BlockList, connect, isIP } from "node:net";
 import { isSandboxHostPattern } from "@nylorun/core/define";
 import { isPrivateAddress } from "../tenant/outbound.js";
 import { bindListener } from "../host/http.js";
+import { hostTuning } from "../tuning.js";
 import { CONNECT_ESTABLISHED, credentialTerminator, } from "./egress-credentials.js";
-/** How many running turns one connection names, at most. */
+/**
+ * How many running turns one connection names, at most: fixed by the `agent.egress` event
+ * contract (`runningTurns` holds at most 16 in `/core/contracts`), which every reader
+ * validates against, so not a setting here.
+ */
 export const EGRESS_RUNNING_TURNS_MAX = 16;
 /** Ports a tunnel may open. */
 export const EGRESS_PORTS = [443, 80];
-/** Tunnels one sandbox may hold open at once. */
-export const EGRESS_MAX_PER_SANDBOX = 64;
-/** A tunnel with no traffic either way for this long is closed. */
-export const EGRESS_IDLE_MS = 5 * 60_000;
-/** How long a sandbox's epoch and allowlist are reused before they are read again. */
-export const EGRESS_CACHE_MS = 5_000;
-/** How long the gate waits for the upstream connection. */
-export const EGRESS_CONNECT_TIMEOUT_MS = 10_000;
 /** Ranges beyond `isPrivateAddress`'s that a tunnel never reaches. */
 const RESERVED = new BlockList();
 for (const [network, prefix] of [
@@ -159,7 +156,7 @@ function connectionRecord(sink, logger, client, at) {
         const allowed = fields.outcome === "allowed";
         const durationMs = Math.max(0, Date.now() - at.startedAt.getTime());
         const connection = (turns) => ({
-            environmentId: at.environmentId,
+            agentId: at.environmentId,
             host: at.host,
             port: at.port,
             ...fields,
@@ -194,10 +191,11 @@ function connectionRecord(sink, logger, client, at) {
 }
 export async function startEgressGate(options) {
     const { logger, sandboxes } = options;
-    const idleMs = options.idleMs ?? EGRESS_IDLE_MS;
-    const maxPerSandbox = options.maxPerSandbox ?? EGRESS_MAX_PER_SANDBOX;
-    const cacheMs = options.cacheMs ?? EGRESS_CACHE_MS;
-    const connectTimeoutMs = options.connectTimeoutMs ?? EGRESS_CONNECT_TIMEOUT_MS;
+    const tuning = hostTuning().egress;
+    const idleMs = options.idleMs ?? tuning.idleMs;
+    const maxPerSandbox = options.maxPerSandbox ?? tuning.maxTunnelsPerSandbox;
+    const cacheMs = options.cacheMs ?? tuning.cacheMs;
+    const connectTimeoutMs = options.connectTimeoutMs ?? tuning.connectTimeoutMs;
     const blocked = options.blocked ?? isEgressBlocked;
     const lookup = options.lookup ?? ((host) => dnsLookup(host, { all: true, verbatim: true }));
     const dial = options.dial ?? ((address, port) => connect({ host: address, port }));
@@ -209,7 +207,7 @@ export async function startEgressGate(options) {
             return cached.value;
         const value = await sandboxes.live(sandboxId);
         cache.set(sandboxId, { at: Date.now(), value });
-        if (cache.size > 4096)
+        if (cache.size > tuning.cacheEntries)
             cache.delete(cache.keys().next().value);
         return value;
     }
@@ -355,8 +353,8 @@ export async function startEgressGate(options) {
         res.writeHead(405, { allow: "CONNECT", "content-type": "text/plain; charset=utf-8", connection: "close" });
         res.end("egress-gate: only CONNECT is served; set HTTPS_PROXY and HTTP_PROXY to this address\n");
     });
-    server.headersTimeout = 10_000;
-    server.requestTimeout = 15_000;
+    server.headersTimeout = tuning.headersTimeoutMs;
+    server.requestTimeout = tuning.requestTimeoutMs;
     server.on("connect", (req, client, head) => {
         // A client socket: idle from the request on, through the tunnel's life.
         client.on("error", () => { });
@@ -416,7 +414,7 @@ export function storeEgressSandboxes(store) {
 /**
  * `EgressRecord` over the Tenant's record (R7.3, D67). The running turns are the sessions on the
  * Environment whose body has an `activeTurnId`, in id order, at most `EGRESS_RUNNING_TURNS_MAX`.
- * The write is `environment.egress` on the Environment's stream, under its row's lock; a deleted
+ * The write is `agent.egress` on the Environment's stream, under its row's lock; a deleted
  * Environment gets nothing.
  */
 export function storeEgressRecord(store) {
@@ -431,9 +429,9 @@ export function storeEgressRecord(store) {
         },
         async write(connection) {
             await store.tx(async (t) => {
-                if (!(await t.environment(connection.environmentId, { lock: true })))
+                if (!(await t.environment(connection.agentId, { lock: true })))
                     return;
-                await t.environmentEvent(connection.environmentId, "environment.egress", connection);
+                await t.agentEvent(connection.agentId, "agent.egress", connection);
             });
         },
     };

package/dist/gates/fixture-model.js

@@ -1,9 +1,13 @@
+import { FILES_MESSAGE_HEADER } from "@nylorun/harness";
 export const FIXTURE_PROVIDER = "fixture";
 const MARKER = /^fixture:(\w+)(?:\s+([\s\S]*))?$/;
 /** The fixture model's answer to `call`. */
 export async function fixtureAnswer(call, signal) {
-    const last = call.prompt.at(-1);
-    const users = call.prompt.filter((item) => item.kind === "message" && item.role === "user");
+    // Our harness ends a turn that has files with a user message listing them; the script is in
+    // the message before it, and a tool result before it is still the last thing that happened.
+    const prompt = call.prompt.filter((item) => !isFilesMessage(item));
+    const last = prompt.at(-1);
+    const users = prompt.filter((item) => item.kind === "message" && item.role === "user");
     const marker = MARKER.exec(textOf(users.at(-1)?.content ?? []).trim());
     if (marker)
         return scripted(call, marker[1], marker[2]?.trim() ?? "", last, signal);
@@ -74,6 +78,13 @@ function candidate(call, output) {
 }
 /** About four characters a token, at least one. */
 const tokens = (text) => Math.max(1, Math.ceil(text.length / 4));
+/** The user message our harness adds for the turn's files (`FILES_MESSAGE_HEADER`). */
+function isFilesMessage(item) {
+    if (item.kind !== "message" || item.role !== "user")
+        return false;
+    const first = item.content[0];
+    return first?.type === "text" && first.text === FILES_MESSAGE_HEADER;
+}
 function textOf(content, json = false) {
     return content
         .map((part) => (part.type === "text" ? (part.text ?? "") : json ? JSON.stringify(part) : ""))

package/dist/gates/handler.d.ts

@@ -1,12 +1,10 @@
 import type { Logger } from "../tenant/types.js";
 import type { BlobStore } from "../blob/index.js";
-import type { ModelCallSettings, ModelGate, ModelGateRequest } from "./model-gate.js";
+import type { ModelGate, ModelGateRequest } from "./model-gate.js";
 import { type TenantVaults } from "./tenant-vaults.js";
 export interface ModelCallHandlerOptions {
     readonly vaults: TenantVaults;
     readonly logger: Logger;
-    /** Retries and timeouts; `piModel`'s defaults when absent. */
-    readonly settings?: ModelCallSettings;
     /** The Object store, for the files a prompt names (protocol 6). */
     readonly blobs?: BlobStore;
 }

package/dist/gates/handler.js

@@ -6,11 +6,11 @@
  * the Tenant's ledger. Logs one line per call, never the prompt, the output or a credential.
  */
 import { classifyThrown } from "../model/classify.js";
-import { callFiles, inProcessModelGate, serve } from "./in-process.js";
+import { callFiles, inProcessModelGate, modelCallSettings, serve } from "./in-process.js";
 import { createMeter } from "./meter.js";
 import { GateRefusal } from "./tenant-vaults.js";
 export function createModelCallHandler(options) {
-    const { vaults, logger, settings, blobs } = options;
+    const { vaults, logger, blobs } = options;
     const meter = createMeter({ logger });
     return {
         async call(named, signal) {
@@ -25,7 +25,8 @@ export function createModelCallHandler(options) {
                     root: vault.root,
                     readHostModel: () => vault.readHostModel(),
                     writeHostCredential: (credential) => vault.writeHostCredential(credential),
-                    ...(settings ? { settings } : {}),
+                    // The Tenant's Runtime limits `model*`, read for this call.
+                    settings: await modelCallSettings(vault.store),
                     ...(blobs ? { files: callFiles(vault.store, blobs) } : {}),
                 });
                 outcome = await meter.call(vault.store, call, () => serve(vault.store, gate, call, signal));

package/dist/gates/http-client.d.ts

@@ -1,13 +1,14 @@
 import type { ModelGate } from "./model-gate.js";
 import type { RunTokens } from "../tenant/run-grants.js";
-/** Above the gate's 600 s provider request timeout. */
-export declare const GATE_CLIENT_TIMEOUT_MS = 630000;
 export interface HttpModelGateOptions {
     /** The gates service, e.g. `http://gateway:4100` (`NYLORUN_GATES_URL`). */
     readonly url: string;
     /** The run token of each session an advance of this process owns: a call's credential. */
     readonly runTokens: RunTokens;
-    /** How long the connection may stay silent. Default `GATE_CLIENT_TIMEOUT_MS`. */
+    /**
+     * How long the connection may stay silent. Default `gates.clientTimeoutMs` (Host tuning, 630 s),
+     * above the gate's 600 s provider request timeout.
+     */
     readonly timeoutMs?: number;
 }
 export declare function httpModelGate(options: HttpModelGateOptions): ModelGate;

package/dist/gates/http-client.js

@@ -19,14 +19,11 @@ import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { failure } from "../model/classify.js";
 import { MODEL_CALLS_PATH, TENANT_HEADER, } from "./contract.js";
-/** How long a cancel may take; the call it stops ends with the provider timeout anyway. */
-const CANCEL_TIMEOUT_MS = 2_000;
-/** Above the gate's 600 s provider request timeout. */
-export const GATE_CLIENT_TIMEOUT_MS = 630_000;
+import { hostTuning } from "../tuning.js";
 export function httpModelGate(options) {
     const endpoint = new URL(MODEL_CALLS_PATH, options.url);
     const send = endpoint.protocol === "https:" ? httpsRequest : httpRequest;
-    const timeoutMs = options.timeoutMs ?? GATE_CLIENT_TIMEOUT_MS;
+    const timeoutMs = options.timeoutMs ?? hostTuning().gates.clientTimeoutMs;
     const where = new URL(options.url).origin;
     return {
         recovers: true,
@@ -44,7 +41,8 @@ export function httpModelGate(options) {
                         [TENANT_HEADER]: request.tenantId,
                         "content-length": 0,
                     },
-                    timeout: CANCEL_TIMEOUT_MS,
+                    // A cancel is short; the call it stops ends with the provider timeout anyway.
+                    timeout: hostTuning().gates.shortTimeoutMs,
                 }, (response) => {
                     response.resume();
                     response.on("end", resolve);
@@ -107,7 +105,7 @@ export function httpModelGate(options) {
                     responded = true;
                     readBody(response).then((text) => settle(answer(response.statusCode ?? 0, text)), (error) => lost(error));
                 });
-                outgoing.on("socket", (socket) => socket.setKeepAlive(true, 30_000));
+                outgoing.on("socket", (socket) => socket.setKeepAlive(true, hostTuning().gates.keepAliveMs));
                 outgoing.on("finish", () => {
                     sent = true;
                 });

package/dist/gates/http-tool.d.ts

@@ -1,12 +1,11 @@
 import { type HttpToolTarget, type JsonObject, type ToolManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
+import type { RuntimeLimits } from "@nylorun/core/contracts";
 import { type OutboundPolicy } from "../tenant/outbound.js";
 import type { Logger } from "../tenant/types.js";
 import type { AuthorizeResult } from "../vault/service.js";
 import type { McpCredentialRequest } from "../vault/sources.js";
 import type { TenantVaults } from "./tenant-vaults.js";
-/** How much of a failed answer's body the model sees. */
-export declare const HTTP_ERROR_BODY_CHARS = 2000;
 /** What an HTTP request came to, as a tool outcome. */
 export type HttpOutcome = {
     readonly kind: "completed";
@@ -49,17 +48,29 @@ export interface HttpToolCall {
      */
     readonly traceparent?: string;
 }
-/** What `runHttpTool` reads of the Tenant: the session's pinned manifest and its credentials. */
+/**
+ * What `runHttpTool` reads of the Tenant: the session's pinned manifest, its credentials, and its
+ * Runtime limits (`toolAnswerBytes`, `httpToolTimeoutMs`, `errorExcerptChars`), read for each call.
+ */
 export interface HttpToolTenant {
     session(sessionId: string): Promise<{
         readonly manifest: unknown;
     } | undefined>;
     authorize(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
+    limits(): Promise<HttpToolLimits>;
 }
+/** The Runtime limits an HTTP tool call keeps to. */
+export type HttpToolLimits = Pick<RuntimeLimits, "toolAnswerBytes" | "httpToolTimeoutMs" | "errorExcerptChars">;
 /** The HTTP tool `toolName` of the agent `agentId` (the root when absent). */
 export declare function declaredHttpTool(manifest: unknown, agentId: string | undefined, toolName: string | undefined): (ToolManifest & {
     readonly http: HttpToolTarget;
 }) | undefined;
+/**
+ * Why `manifest` cannot be deployed: each HTTP tool of it, or of an agent it uses as a tool, whose
+ * `timeoutMs` is longer than the Tenant's Runtime limit `httpToolTimeoutMs`. A call also waits at
+ * most the limit in force then (`callHttpTarget`).
+ */
+export declare function httpToolTimeoutIssues(manifest: unknown, limitMs: number): string[];
 /** The HTTP stage or HTTP verifier at stage key `stage` of a flow session's `manifest`. */
 export declare function declaredFlowHttp(manifest: unknown, stage: string | undefined): import("@nylorun/core/define").FlowHttpTarget | undefined;
 /**
@@ -67,7 +78,10 @@ export declare function declaredFlowHttp(manifest: unknown, stage: string | unde
  * flow's HTTP stages or HTTP verifiers (a flow `tool` effect, named by its stage key).
  */
 export declare function isHttpToolCall(manifest: unknown, request: HostEffect): boolean;
-/** The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, or its flow stage. */
+/**
+ * The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, by the declared name
+ * its target names, or its flow stage.
+ */
 export declare function httpToolRefOf(request: HostEffect): HttpToolRef;
 /**
  * Sends `input` to `target` and reads the answer. Never throws: everything that can happen to
@@ -77,6 +91,12 @@ export declare function callHttpTarget(target: HttpToolTarget, input: unknown, o
     readonly headers: Readonly<Record<string, string>>;
     readonly policy: OutboundPolicy;
     readonly signal: AbortSignal;
+    /**
+     * The Tenant's Runtime limits: the largest answer read (`toolAnswerBytes`; past it,
+     * `http.too-large`), the longest the tool may wait (`httpToolTimeoutMs`, which its own
+     * `timeoutMs` may not pass) and how much of an error answer is quoted (`errorExcerptChars`).
+     */
+    readonly limits: HttpToolLimits;
     /** Checked against the answer; a mismatch is `tool.invalid-output`. */
     readonly outputSchema?: JsonObject;
 }): Promise<HttpOutcome>;

package/dist/gates/http-tool.js

@@ -16,12 +16,11 @@
  * `Nylorun-Agent-Id` is the flow agent's.
  */
 import { AGENT_ID_HEADER, SESSION_ID_HEADER, TURN_ID_HEADER, } from "@nylorun/core/compatibility";
-import { HTTP_TOOL_DEFAULT_TIMEOUT_MS, delegateManifest, flowHttpTarget, httpPathParameters, httpToolRequest, isWorkflowManifest, schemaFromJSON, } from "@nylorun/core/define";
+import { HTTP_TOOL_DEFAULT_TIMEOUT_MS, delegateManifest, delegatesOf, flowHttpTarget, httpPathParameters, httpToolRequest, isWorkflowManifest, schemaFromJSON, } from "@nylorun/core/define";
 import { scrubValues } from "../redact.js";
-import { MAX_RESPONSE_BYTES, send } from "../tenant/outbound.js";
+import { send } from "../tenant/outbound.js";
 import { credentialSecrets } from "../vault/headers.js";
-/** How much of a failed answer's body the model sees. */
-export const HTTP_ERROR_BODY_CHARS = 2_000;
+import { readRuntimeLimits } from "../tenant/runtime-limits.js";
 /** The HTTP tool `toolName` of the agent `agentId` (the root when absent). */
 export function declaredHttpTool(manifest, agentId, toolName) {
     const root = manifest;
@@ -31,6 +30,24 @@ export function declaredHttpTool(manifest, agentId, toolName) {
     const tool = agent?.tools?.find((item) => item.name === toolName);
     return tool?.http ? tool : undefined;
 }
+/**
+ * Why `manifest` cannot be deployed: each HTTP tool of it, or of an agent it uses as a tool, whose
+ * `timeoutMs` is longer than the Tenant's Runtime limit `httpToolTimeoutMs`. A call also waits at
+ * most the limit in force then (`callHttpTarget`).
+ */
+export function httpToolTimeoutIssues(manifest, limitMs) {
+    const root = manifest;
+    if (!root || typeof root !== "object" || isWorkflowManifest(root))
+        return [];
+    return [root, ...delegatesOf(root).map((delegate) => delegate.manifest)].flatMap((agent) => (agent.tools ?? []).flatMap((tool) => {
+        const asked = tool.http?.timeoutMs;
+        return asked !== undefined && asked > limitMs
+            ? [
+                `HTTP tool '${tool.name}' of agent '${agent.id}' asks for timeoutMs ${asked}; the Runtime limit httpToolTimeoutMs allows at most ${limitMs} (PUT /v1/tenant/limits).`,
+            ]
+            : [];
+    }));
+}
 /** The HTTP stage or HTTP verifier at stage key `stage` of a flow session's `manifest`. */
 export function declaredFlowHttp(manifest, stage) {
     return stage !== undefined && isWorkflowManifest(manifest)
@@ -44,18 +61,24 @@ export function declaredFlowHttp(manifest, stage) {
 export function isHttpToolCall(manifest, request) {
     if (request.kind !== "tool")
         return false;
-    if (request.toolName === undefined)
+    // An agent's call names what runs it (protocol 15): an `http` call names its declared tool.
+    if (request.target?.kind === "http")
+        return declaredHttpTool(manifest, request.agent?.id, request.target.tool) !== undefined;
+    if (request.target === undefined && request.toolName === undefined)
         return declaredFlowHttp(manifest, request.key) !== undefined;
-    return declaredHttpTool(manifest, request.agent?.id, request.toolName) !== undefined;
+    return false;
 }
-/** The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, or its flow stage. */
+/**
+ * The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, by the declared name
+ * its target names, or its flow stage.
+ */
 export function httpToolRefOf(request) {
-    if (request.toolName === undefined)
+    if (request.target?.kind !== "http")
         return { sessionId: request.sessionId, stage: request.key };
     return {
         sessionId: request.sessionId,
         ...(request.agent ? { agentId: request.agent.id } : {}),
-        toolName: request.toolName,
+        toolName: request.target.tool,
     };
 }
 /**
@@ -66,12 +89,14 @@ export async function callHttpTarget(target, input, options) {
     const request = httpToolRequest(target, input);
     if ("issue" in request)
         return failed("tool.invalid-input", request.issue);
-    const timeoutMs = target.timeoutMs ?? HTTP_TOOL_DEFAULT_TIMEOUT_MS;
+    const { limits } = options;
+    const timeoutMs = Math.min(target.timeoutMs ?? HTTP_TOOL_DEFAULT_TIMEOUT_MS, limits.httpToolTimeoutMs);
     const timeout = AbortSignal.timeout(timeoutMs);
     const result = await send(request.url, request.body, { ...options.headers }, {
         policy: options.policy,
         method: request.method,
         signal: AbortSignal.any([options.signal, timeout]),
+        maxResponseBytes: limits.toolAnswerBytes,
     });
     if (options.signal.aborted)
         throw options.signal.reason;
@@ -85,14 +110,15 @@ export async function callHttpTarget(target, input, options) {
         case "lost":
             return failed("http.lost", `The connection was lost after the request was sent, so the call may have run: ${result.message}`);
         case "too_large":
-            return failed("http.too-large", `The answer (HTTP ${result.status}) is larger than ${MAX_RESPONSE_BYTES} bytes`);
+            return failed("http.too-large", `The answer (HTTP ${result.status}) is larger than ${limits.toolAnswerBytes} bytes (the Runtime limit toolAnswerBytes)`);
     }
     // The service answered, so the outcome is known; never retried, and its body is not shown (R2b C1).
     if (result.status === 401)
         return failed("credential_rejected", "The service answered HTTP 401: it rejected the credential, or needs one");
     const text = result.body.toString("utf8");
     if (result.status < 200 || result.status > 299) {
-        const body = text.length > HTTP_ERROR_BODY_CHARS ? `${text.slice(0, HTTP_ERROR_BODY_CHARS)}…` : text;
+        const chars = limits.errorExcerptChars;
+        const body = text.length > chars ? `${text.slice(0, chars)}…` : text;
         return failed("http.status", `The service answered HTTP ${result.status}${body ? `: ${body}` : ""}`);
     }
     const type = String(result.headers["content-type"] ?? "");
@@ -193,6 +219,7 @@ export async function runHttpTool(tenant, call, options) {
             },
             policy: options.policy,
             signal: options.signal,
+            limits: await tenant.limits(),
             ...(declared.outputSchema === undefined ? {} : { outputSchema: declared.outputSchema }),
         });
         // Nothing the service echoes of the credential reaches the model, an event or the gate's
@@ -202,7 +229,7 @@ export async function runHttpTool(tenant, call, options) {
             return outcome;
         return {
             ...outcome,
-            message: `The service answered HTTP 401: it rejected the credential '${http.credential}' from the session's Environment`,
+            message: `The service answered HTTP 401: it rejected the credential '${http.credential}' from the session's Agent`,
             server: http.credential,
         };
     }
@@ -213,6 +240,7 @@ export function gateHttpTools(vaults, policy, logger) {
         call: (tenantId, call, signal) => runHttpTool({
             session: async (sessionId) => (await vaults.open(tenantId)).session(sessionId),
             authorize: async (sessionId, request) => (await vaults.open(tenantId)).authorizeMcp(sessionId, request),
+            limits: async () => (await vaults.open(tenantId)).store.tx((t) => readRuntimeLimits(t)),
         }, call, { policy, signal, logger }),
     };
 }

package/dist/gates/in-process.d.ts

@@ -37,10 +37,11 @@ export declare function tenantModelGate(options: {
     readonly kek: () => Buffer;
     readonly root: string;
     readonly logger: Logger;
-    readonly settings?: ModelCallSettings;
     /** The Tenant's Object store, for the files a prompt names. */
     readonly blobs?: BlobStore;
 }): ModelGate;
+/** The Tenant's model call settings: its Runtime limits `model*`, read now. */
+export declare function modelCallSettings(store: SessionStore): Promise<Required<ModelCallSettings>>;
 /**
  * Serves one call: from the fixture model while the Tenant's `model.fixture` setting is on (R4.3),
  * else from `gate`. Read per call, so a seed applies to the next call.