@nylorun/runtime 0.26.0-beta → 0.28.0-beta

package/dist/tenant/limits.js

@@ -0,0 +1,172 @@
+/**
+ * What artifacts, skills and disk versions may hold: the Tenant's limits (`artifacts.config`,
+ * `skills.config` here, and the Runtime limits `diskVersion*` of `limits.config`), and an
+ * Environment's, which its manifest sets (`limits`). A limit the manifest leaves out is the
+ * Tenant's as it is when the limit is checked, and none is ever above the Tenant's: a manifest
+ * asking for more is refused when the Environment is made, and a Tenant that lowers a limit
+ * later lowers it for every Environment.
+ *
+ * Also the shape a manifest and an Environment's labels must fit, which the Tenant's Runtime
+ * limits set (`manifestShapeIssues`, `labelIssues`), checked when they are put rather than by
+ * their schemas (B15).
+ */
+import { SKILL_TOTAL_BYTES_DEFAULT, TenantSkillsConfigSchema, } from "@nylorun/core/contracts";
+import { parseSandboxDuration } from "@nylorun/core/define";
+import { readArtifactLimits } from "../artifacts/config.js";
+import { readRuntimeLimits } from "./runtime-limits.js";
+export const SKILLS_CONFIG_SETTING = "skills.config";
+/** The skill limits in force: the Tenant's, with the default for what it leaves unset. */
+export function effectiveSkillLimits(config) {
+    return { totalBytes: config.limits?.totalBytes ?? SKILL_TOTAL_BYTES_DEFAULT };
+}
+export async function readSkillsConfig(t) {
+    const raw = await t.getSetting(SKILLS_CONFIG_SETTING);
+    if (raw === undefined)
+        return {};
+    const parsed = TenantSkillsConfigSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : {};
+}
+export async function readSkillLimits(t) {
+    return effectiveSkillLimits(await readSkillsConfig(t));
+}
+export async function writeSkillsConfig(t, config) {
+    await t.putSetting(SKILLS_CONFIG_SETTING, JSON.stringify(TenantSkillsConfigSchema.parse(config)));
+}
+/** The Tenant's artifact, skill and disk version limits. */
+export async function readTenantLimits(t) {
+    const runtime = await readRuntimeLimits(t);
+    return {
+        artifacts: await readArtifactLimits(t),
+        skills: await readSkillLimits(t),
+        disk: { versionBytes: runtime.diskVersionBytes, versionEntries: runtime.diskVersionEntries },
+    };
+}
+/** The limits in force for an Environment whose manifest sets `set`: each within the Tenant's. */
+export function limitsInForce(tenant, set) {
+    const within = (asked, ceiling) => Math.min(asked ?? ceiling, ceiling);
+    return {
+        artifacts: {
+            fileBytes: within(set?.artifacts?.fileBytes, tenant.artifacts.fileBytes),
+            totalBytes: within(set?.artifacts?.totalBytes, tenant.artifacts.totalBytes),
+        },
+        skills: { totalBytes: within(set?.skills?.totalBytes, tenant.skills.totalBytes) },
+        disk: {
+            versionBytes: within(set?.disk?.versionBytes, tenant.disk.versionBytes),
+            versionEntries: within(set?.disk?.versionEntries, tenant.disk.versionEntries),
+        },
+    };
+}
+/** Why a manifest's `limits` cannot be made: each limit above the Tenant's. */
+export function limitIssues(set, tenant) {
+    const issues = [];
+    const check = (path, asked, ceiling, unit = "bytes") => {
+        if (asked !== undefined && asked > ceiling)
+            issues.push(`limits.${path} asks for ${asked} ${unit}; this Tenant allows at most ${ceiling}.`);
+    };
+    check("artifacts.fileBytes", set?.artifacts?.fileBytes, tenant.artifacts.fileBytes);
+    check("artifacts.totalBytes", set?.artifacts?.totalBytes, tenant.artifacts.totalBytes);
+    check("skills.totalBytes", set?.skills?.totalBytes, tenant.skills.totalBytes);
+    check("disk.versionBytes", set?.disk?.versionBytes, tenant.disk.versionBytes);
+    check("disk.versionEntries", set?.disk?.versionEntries, tenant.disk.versionEntries, "entries");
+    return issues;
+}
+/**
+ * Why `labels` cannot be set: more than the Tenant's Runtime limit `count` names
+ * (`environmentLabels` or `artifactLabels`), or a key or a value longer than `labelKeyChars` or
+ * `labelValueChars`.
+ */
+export function labelIssues(labels, limits, count = "environmentLabels") {
+    if (labels === undefined)
+        return [];
+    const issues = [];
+    const keys = Object.keys(labels);
+    if (keys.length > limits[count])
+        issues.push(`labels has ${keys.length}; the Runtime limit ${count} allows at most ${limits[count]} (PUT /v1/tenant/limits).`);
+    for (const key of keys) {
+        if (key.length > limits.labelKeyChars)
+            issues.push(`Label key ${JSON.stringify(key.slice(0, limits.labelKeyChars))}… has ${key.length} characters; the Runtime limit labelKeyChars allows at most ${limits.labelKeyChars} (PUT /v1/tenant/limits).`);
+        const value = labels[key];
+        if (value.length > limits.labelValueChars)
+            issues.push(`Label ${JSON.stringify(key)}'s value has ${value.length} characters; the Runtime limit labelValueChars allows at most ${limits.labelValueChars} (PUT /v1/tenant/limits).`);
+    }
+    return issues;
+}
+/** `"{what} has {n} characters; the Runtime limit {name} allows at most {limit} …"`, when over. */
+function longer(what, text, name, limits) {
+    return text !== undefined && text.length > limits[name]
+        ? [`${what} has ${text.length} characters; the Runtime limit ${name} allows at most ${limits[name]} (PUT /v1/tenant/limits).`]
+        : [];
+}
+/** `"{what} has {n}; the Runtime limit {name} allows at most {limit} …"`, when over. */
+function more(what, count, name, limits) {
+    return count > limits[name]
+        ? [`${what} has ${count}; the Runtime limit ${name} allows at most ${limits[name]} (PUT /v1/tenant/limits).`]
+        : [];
+}
+/**
+ * Why a secret write does not fit the Tenant's Runtime limits: an `environment_secret`'s or an
+ * `environment_variable`'s value past `secretValueChars`, or more hosts than `secretHosts`.
+ */
+export function secretRequestIssues(request, limits) {
+    const valued = request.type === "environment_secret" || request.type === "environment_variable";
+    return [
+        ...(valued && typeof request.value === "string" ? longer("value", request.value, "secretValueChars", limits) : []),
+        ...more("allowedHosts", request.allowedHosts?.length ?? 0, "secretHosts", limits),
+    ];
+}
+/**
+ * Why a tool policy does not fit the Tenant's Runtime limits: more rules than `toolRules`, a
+ * selector or a `when` path past `toolRuleFieldChars`, a `reason` or a `matches` past
+ * `toolRuleTextChars`.
+ */
+export function toolPolicyIssues(rules, limits) {
+    const issues = more("rules", rules.length, "toolRules", limits);
+    rules.forEach((rule, index) => {
+        const at = `rules[${index}]`;
+        issues.push(...longer(`${at}.tool`, rule.tool, "toolRuleFieldChars", limits), ...longer(`${at}.server`, rule.server, "toolRuleFieldChars", limits), ...longer(`${at}.agent`, rule.agent, "toolRuleFieldChars", limits), ...longer(`${at}.reason`, rule.reason, "toolRuleTextChars", limits));
+        for (const [path, condition] of Object.entries(rule.when ?? {}))
+            issues.push(...longer(`${at}.when path ${JSON.stringify(path.slice(0, limits.toolRuleFieldChars))}`, path, "toolRuleFieldChars", limits), ...longer(`${at}.when[${JSON.stringify(path)}].matches`, condition.matches, "toolRuleTextChars", limits));
+    });
+    return issues;
+}
+/** Why a set of model budgets does not fit: more than the Tenant's Runtime limit `modelBudgets`. */
+export function budgetIssues(budgets, limits) {
+    return more("budgets", budgets.length, "modelBudgets", limits);
+}
+/**
+ * Why an agent's `requires` does not fit: more secrets than an Environment's manifest may declare
+ * slots for (the Runtime limit `environmentSecretSlots`).
+ */
+/**
+ * Why a manifest (inline, or saved) does not fit the Tenant's Runtime limits: its description,
+ * its setup commands, their lengths and timeouts, its input file entries and the files of each,
+ * and its secret slots, their descriptions and hosts.
+ */
+export function manifestShapeIssues(manifest, limits) {
+    const issues = [];
+    const over = (what, count, name) => {
+        if (count > limits[name])
+            issues.push(`${what} has ${count}; the Runtime limit ${name} allows at most ${limits[name]} (PUT /v1/tenant/limits).`);
+    };
+    over("setup", manifest.setup?.length ?? 0, "environmentSetupCommands");
+    over("files", manifest.files?.length ?? 0, "environmentFiles");
+    over("secrets", Object.keys(manifest.secrets ?? {}).length, "environmentSecretSlots");
+    issues.push(...longer("description", manifest.description, "manifestDescriptionChars", limits));
+    for (const [name, slot] of Object.entries(manifest.secrets ?? {})) {
+        issues.push(...longer(`secrets.${name}.description`, slot.description, "secretDescriptionChars", limits));
+        if ("allowedHosts" in slot && Array.isArray(slot.allowedHosts))
+            issues.push(...more(`secrets.${name}.allowedHosts`, slot.allowedHosts.length, "secretHosts", limits));
+    }
+    manifest.setup?.forEach((command, index) => {
+        if (command.command.length > limits.setupCommandChars)
+            issues.push(`setup[${index}].command has ${command.command.length} characters; the Runtime limit setupCommandChars allows at most ${limits.setupCommandChars} (PUT /v1/tenant/limits).`);
+        const ms = command.timeout === undefined ? undefined : parseSandboxDuration(command.timeout);
+        if (ms !== undefined && ms > limits.setupCommandMs)
+            issues.push(`setup[${index}].timeout asks for ${ms} ms; the Runtime limit setupCommandMs allows at most ${limits.setupCommandMs} (PUT /v1/tenant/limits).`);
+    });
+    manifest.files?.forEach((file, index) => {
+        if ("files" in file)
+            over(`files[${index}].files`, Object.keys(file.files).length, "environmentFilesPerEntry");
+    });
+    return issues;
+}

package/dist/tenant/memories.d.ts

@@ -0,0 +1,38 @@
+/**
+ * An Agent's memories over the Runtime API (track T5, D72), shaped like Anthropic's memory stores:
+ * list and read them, write one whole (create or replace, with an optional `content_sha256`
+ * precondition), delete one or a folder, and read the versions every change leaves. Writes go
+ * through the memory service (`memory/service.ts`), as a model's do, so the same paths, limits
+ * and versions hold; the actor is the caller (`human:<subject>`, else `application`).
+ */
+import { type Memory, type MemoryList, type MemoryVersionDetail, type MemoryVersionPage, type PutMemoryRequest } from "@nylorun/core/contracts";
+import type { AuthScope, TenantContext } from "./context.js";
+/** Who an API write names: the person a request acts for, else the application. */
+export declare function memoryActorOf(scope: AuthScope): string;
+/** `GET /v1/agents/{id}/memories`: the Agent's memories by path, under `pathPrefix` when given. */
+export declare function listMemories(ctx: TenantContext, agentId: string, options: {
+    pathPrefix?: string;
+    cursor?: string;
+    limit: number;
+}): Promise<MemoryList>;
+/** `GET /v1/agents/{id}/memories/{path}`: one memory with its content. */
+export declare function readMemory(ctx: TenantContext, agentId: string, rawPath: string): Promise<Memory>;
+/**
+ * `PUT /v1/agents/{id}/memories/{path}`: writes the memory whole, as the tool's `create` does. With
+ * `contentSha256` the write applies only while the memory still has that content (`""`: only while
+ * no memory has the path); otherwise `409 memory_conflict` with the current memory.
+ */
+export declare function putMemoryContent(ctx: TenantContext, agentId: string, rawPath: string, body: PutMemoryRequest, scope: AuthScope): Promise<Memory>;
+/** `DELETE /v1/agents/{id}/memories/{path}`: deletes a memory, or every memory in a folder. */
+export declare function deleteMemoryPath(ctx: TenantContext, agentId: string, rawPath: string, scope: AuthScope): Promise<{
+    path: string;
+    deleted: number;
+}>;
+/** `GET /v1/agents/{id}/memory_versions`: versions, newest first; `path` keeps one path's. */
+export declare function listMemoryVersions(ctx: TenantContext, agentId: string, options: {
+    path?: string;
+    cursor?: string;
+    limit: number;
+}): Promise<MemoryVersionPage>;
+/** `GET /v1/agents/{id}/memory_versions/{versionId}`: one version with the content it left. */
+export declare function readMemoryVersion(ctx: TenantContext, agentId: string, versionId: string): Promise<MemoryVersionDetail>;

package/dist/tenant/memories.js

@@ -0,0 +1,119 @@
+/**
+ * An Agent's memories over the Runtime API (track T5, D72), shaped like Anthropic's memory stores:
+ * list and read them, write one whole (create or replace, with an optional `content_sha256`
+ * precondition), delete one or a folder, and read the versions every change leaves. Writes go
+ * through the memory service (`memory/service.ts`), as a model's do, so the same paths, limits
+ * and versions hold; the actor is the caller (`human:<subject>`, else `application`).
+ */
+import { memoryPathOf, } from "@nylorun/core/contracts";
+import { applyMemoryCommand, memorySummaryOf, memoryVersionDetailOf, memoryVersionOf, } from "../memory/service.js";
+import { liveEnvironment } from "./agents.js";
+import { fail } from "./http.js";
+import { readRuntimeLimits } from "./runtime-limits.js";
+/** Who an API write names: the person a request acts for, else the application. */
+export function memoryActorOf(scope) {
+    return scope.kind === "token" || scope.kind === "subject" ? `human:${scope.subject}` : "application";
+}
+async function agentOf(t, agentId) {
+    if (!(await liveEnvironment(t, agentId)))
+        fail(404, `Agent ${agentId} not found`, { code: "not_found" });
+}
+/** A path from a route: relative to `/memories` (as the route's segment), or absolute. */
+function routePath(raw, kind) {
+    const trimmed = raw.replace(/^\/+/, "");
+    const parsed = memoryPathOf(trimmed.startsWith("memories/") || trimmed === "memories" ? trimmed : `memories/${trimmed}`, kind);
+    return "error" in parsed ? fail(400, parsed.error, { code: "invalid_request" }) : parsed.path;
+}
+/** The HTTP answer to a refused write. */
+function refusal(result) {
+    switch (result.code) {
+        case "memory.not_found":
+            return fail(404, result.text, { code: "not_found" });
+        case "memory.limit":
+            return fail(409, result.text, { code: "limit_exceeded", details: { limit: "memoriesPerAgent" } });
+        case "memory.too_large":
+            return fail(413, result.text, { code: "limit_exceeded", details: { limit: "memoryBytes" } });
+        case "memory.exists":
+            return fail(409, result.text, { code: "memory_conflict" });
+        default:
+            return fail(400, result.text, { code: "invalid_request" });
+    }
+}
+/** `GET /v1/agents/{id}/memories`: the Agent's memories by path, under `pathPrefix` when given. */
+export async function listMemories(ctx, agentId, options) {
+    const folder = options.pathPrefix === undefined ? undefined : routePath(options.pathPrefix, "any");
+    return ctx.store.tx(async (t) => {
+        await agentOf(t, agentId);
+        const rows = await t.memories(agentId, {
+            ...(folder === undefined ? {} : { folder }),
+            ...(options.cursor === undefined ? {} : { after: options.cursor }),
+            limit: options.limit + 1,
+        });
+        const page = rows.slice(0, options.limit);
+        return { memories: page.map(memorySummaryOf), nextCursor: rows.length > options.limit ? page.at(-1).path : null };
+    });
+}
+/** `GET /v1/agents/{id}/memories/{path}`: one memory with its content. */
+export async function readMemory(ctx, agentId, rawPath) {
+    const path = routePath(rawPath, "file");
+    return ctx.store.tx(async (t) => {
+        await agentOf(t, agentId);
+        const row = (await t.memory(agentId, path)) ?? fail(404, `The path ${path} does not exist`, { code: "not_found" });
+        return { ...memorySummaryOf(row), content: row.content };
+    });
+}
+/**
+ * `PUT /v1/agents/{id}/memories/{path}`: writes the memory whole, as the tool's `create` does. With
+ * `contentSha256` the write applies only while the memory still has that content (`""`: only while
+ * no memory has the path); otherwise `409 memory_conflict` with the current memory.
+ */
+export async function putMemoryContent(ctx, agentId, rawPath, body, scope) {
+    const path = routePath(rawPath, "file");
+    return ctx.store.tx(async (t) => {
+        await agentOf(t, agentId);
+        const current = await t.memory(agentId, path, { lock: true });
+        if (body.contentSha256 !== undefined && body.contentSha256 !== (current?.contentSha256 ?? ""))
+            fail(409, `${path} has changed since that content_sha256: read it again and write on top of what it holds now.`, {
+                code: "memory_conflict",
+                details: { current: current ? { ...memorySummaryOf(current), content: current.content } : null },
+            });
+        const result = await applyMemoryCommand(t, agentId, { command: "create", path, fileText: body.content }, { actor: memoryActorOf(scope) }, await readRuntimeLimits(t));
+        if (!result.ok)
+            refusal(result);
+        const row = (await t.memory(agentId, path));
+        return { ...memorySummaryOf(row), content: row.content };
+    });
+}
+/** `DELETE /v1/agents/{id}/memories/{path}`: deletes a memory, or every memory in a folder. */
+export async function deleteMemoryPath(ctx, agentId, rawPath, scope) {
+    const path = routePath(rawPath, "any");
+    return ctx.store.tx(async (t) => {
+        await agentOf(t, agentId);
+        const result = await applyMemoryCommand(t, agentId, { command: "delete", path }, { actor: memoryActorOf(scope) }, await readRuntimeLimits(t));
+        if (!result.ok)
+            refusal(result);
+        return { path, deleted: result.changes.length };
+    });
+}
+/** `GET /v1/agents/{id}/memory_versions`: versions, newest first; `path` keeps one path's. */
+export async function listMemoryVersions(ctx, agentId, options) {
+    const path = options.path === undefined ? undefined : routePath(options.path, "file");
+    return ctx.store.tx(async (t) => {
+        await agentOf(t, agentId);
+        const rows = await t.memoryVersions(agentId, {
+            ...(path === undefined ? {} : { path }),
+            ...(options.cursor === undefined ? {} : { before: options.cursor }),
+            limit: options.limit + 1,
+        });
+        const page = rows.slice(0, options.limit);
+        return { versions: page.map(memoryVersionOf), nextCursor: rows.length > options.limit ? page.at(-1).id : null };
+    });
+}
+/** `GET /v1/agents/{id}/memory_versions/{versionId}`: one version with the content it left. */
+export async function readMemoryVersion(ctx, agentId, versionId) {
+    return ctx.store.tx(async (t) => {
+        await agentOf(t, agentId);
+        const row = (await t.memoryVersion(agentId, versionId)) ?? fail(404, `Memory version ${versionId} not found`, { code: "not_found" });
+        return memoryVersionDetailOf(row);
+    });
+}

package/dist/tenant/module.d.ts

@@ -3,7 +3,10 @@ export interface CreateTenantModuleOptions {
     /** Opens the Host's Tenant (`store-pg.ts`). */
     open: TenantOpener;
     logger: Logger;
-    /** Bound on opening the Tenant; a slower open fails with `open-timeout`. */
+    /**
+     * Bound on opening the Tenant; a slower open fails with `open-timeout`. Default the Host
+     * tuning's `tenant.openTimeoutMs` (30 s).
+     */
     openTimeoutMs?: number;
     /**
      * Runs once the Tenant is open, at start or on a later retry: the Host starts what needs the

package/dist/tenant/module.js

@@ -1,10 +1,7 @@
 import { openError, TenantOpenError } from "./cause.js";
 import { TimeoutError, withTimeout } from "./pool.js";
+import { hostTuning } from "../tuning.js";
 import { TenantUnavailableError, } from "./types.js";
-const OPEN_TIMEOUT_MS = 30_000;
-/** Retries of an open that failed outside the Tenant: from 1 s, doubling, at most 30 s apart. */
-const RETRY_FIRST_MS = 1_000;
-const RETRY_MAX_MS = 30_000;
 /**
  * Deep Tenant module (§8): the Host's one Tenant over an injected opener (tenancy.md §5).
  *
@@ -15,11 +12,15 @@ const RETRY_MAX_MS = 30_000;
  * with backoff, and by the next request, which gets 503 meanwhile.
  */
 export function createTenantModule(options) {
-    const { logger, openTimeoutMs = OPEN_TIMEOUT_MS } = options;
+    const tuning = hostTuning().tenant;
+    const { logger, openTimeoutMs = tuning.openTimeoutMs } = options;
+    // Retries of an open that failed outside the Tenant: from `openRetry.minMs`, doubling, at most
+    // `openRetry.maxMs` apart.
+    const { minMs: firstRetryMs, maxMs: maxRetryMs } = tuning.openRetry;
     let state = { kind: "idle" };
     let opening;
     let retry;
-    let nextDelayMs = RETRY_FIRST_MS;
+    let nextDelayMs = firstRetryMs;
     const current = () => state;
     async function openOnce() {
         let handle;
@@ -64,7 +65,7 @@ export function createTenantModule(options) {
             return;
         }
         state = { kind: "open", handle };
-        nextDelayMs = RETRY_FIRST_MS;
+        nextDelayMs = firstRetryMs;
         logger.info("tenant opened", { tenantId: handle.envelope.id });
         try {
             await options.onOpen?.(handle);
@@ -92,7 +93,7 @@ export function createTenantModule(options) {
         if (retry)
             return;
         const delayMs = nextDelayMs;
-        nextDelayMs = Math.min(delayMs * 2, RETRY_MAX_MS);
+        nextDelayMs = Math.min(delayMs * 2, maxRetryMs);
         retry = setTimeout(() => {
             retry = undefined;
             void load();

package/dist/tenant/outbound.d.ts

@@ -30,8 +30,6 @@ export type OutboundResult = {
     code: string;
     message: string;
 };
-/** The largest answer read from an endpoint. */
-export declare const MAX_RESPONSE_BYTES: number;
 /** True when `address` is private, loopback, link-local or unspecified (IPv4-mapped included). */
 export declare function isPrivateAddress(address: string): boolean;
 /** Why the Host refuses `url`, or `undefined` when it may be called. */
@@ -44,7 +42,8 @@ export declare function refusal(url: URL, policy: OutboundPolicy): string | unde
 export declare function send(target: string, body: string | undefined, headers: Record<string, string>, options: {
     policy: OutboundPolicy;
     signal: AbortSignal;
-    maxResponseBytes?: number;
+    /** The largest answer read: the Tenant's Runtime limit `toolAnswerBytes` for an HTTP tool. */
+    maxResponseBytes: number;
     method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
 }): Promise<OutboundResult>;
 /**
@@ -71,23 +70,21 @@ export declare class OutboundFailed extends Error {
      */
     sent?: boolean);
 }
-/** The largest answer `guardedFetch` reads. */
-export declare const MAX_FETCH_RESPONSE_BYTES: number;
-/** How long a `guardedFetch` request may take without a signal of its own. */
-export declare const FETCH_TIMEOUT_MS = 30000;
 /**
  * A `fetch` under the Host's address policy (F9 C2): the literal-IP and DNS checks of `post`
  * on the address actually connected to, `localhost` rewritten for the local stack, no
- * redirects (`redirect: "error"`; a 3xx answer rejects), a bounded answer and a 30 s timeout
- * unless the caller passes a signal. A refused URL or address rejects with `OutboundRefused`,
- * any other failure with `OutboundFailed`.
+ * redirects (`redirect: "error"`; a 3xx answer rejects), an answer of at most `maxResponseBytes`
+ * and a `timeoutMs` timeout unless the caller passes a signal, both the caller's (a Tenant's
+ * Runtime limits). A refused URL or address rejects with `OutboundRefused`, any other failure
+ * with `OutboundFailed`.
  *
  * `stream`: the Response resolves once the headers arrive and its body streams, unbounded and
  * with no timeout but the caller's signal: remote MCP servers, whose answers and event streams
  * stay open (`mcp/connect.ts`).
  */
-export declare function guardedFetch(policy: OutboundPolicy, options?: {
-    maxResponseBytes?: number;
-    timeoutMs?: number;
-    stream?: boolean;
+export declare function guardedFetch(policy: OutboundPolicy, options: {
+    maxResponseBytes: number;
+    timeoutMs: number;
+} | {
+    stream: true;
 }): typeof fetch;

package/dist/tenant/outbound.js

@@ -13,8 +13,6 @@ import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { BlockList, isIP } from "node:net";
 import { Readable } from "node:stream";
-/** The largest answer read from an endpoint. */
-export const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 const PRIVATE = new BlockList();
 for (const [network, prefix] of [
     ["0.0.0.0", 8],
@@ -82,7 +80,7 @@ function guardedLookup(policy) {
  */
 export async function send(target, body, headers, options) {
     const { policy, signal } = options;
-    const limit = options.maxResponseBytes ?? MAX_RESPONSE_BYTES;
+    const limit = options.maxResponseBytes;
     const url = new URL(target);
     const refused = refusal(url, policy);
     if (refused)
@@ -168,25 +166,22 @@ export class OutboundFailed extends Error {
         this.name = "OutboundFailed";
     }
 }
-/** The largest answer `guardedFetch` reads. */
-export const MAX_FETCH_RESPONSE_BYTES = 1024 * 1024;
-/** How long a `guardedFetch` request may take without a signal of its own. */
-export const FETCH_TIMEOUT_MS = 30_000;
 /**
  * A `fetch` under the Host's address policy (F9 C2): the literal-IP and DNS checks of `post`
  * on the address actually connected to, `localhost` rewritten for the local stack, no
- * redirects (`redirect: "error"`; a 3xx answer rejects), a bounded answer and a 30 s timeout
- * unless the caller passes a signal. A refused URL or address rejects with `OutboundRefused`,
- * any other failure with `OutboundFailed`.
+ * redirects (`redirect: "error"`; a 3xx answer rejects), an answer of at most `maxResponseBytes`
+ * and a `timeoutMs` timeout unless the caller passes a signal, both the caller's (a Tenant's
+ * Runtime limits). A refused URL or address rejects with `OutboundRefused`, any other failure
+ * with `OutboundFailed`.
  *
  * `stream`: the Response resolves once the headers arrive and its body streams, unbounded and
  * with no timeout but the caller's signal: remote MCP servers, whose answers and event streams
  * stay open (`mcp/connect.ts`).
  */
-export function guardedFetch(policy, options = {}) {
-    const limit = options.maxResponseBytes ?? MAX_FETCH_RESPONSE_BYTES;
-    const timeoutMs = options.timeoutMs ?? FETCH_TIMEOUT_MS;
-    const stream = options.stream === true;
+export function guardedFetch(policy, options) {
+    const stream = "stream" in options;
+    const limit = "stream" in options ? Infinity : options.maxResponseBytes;
+    const timeoutMs = "stream" in options ? undefined : options.timeoutMs;
     const lookup = guardedLookup(policy);
     const guarded = async (input, init = {}) => {
         const request = input instanceof Request ? input : undefined;
@@ -217,7 +212,7 @@ export function guardedFetch(policy, options = {}) {
         }
         const originalHost = url.host;
         dockerHost(url, policy);
-        const signal = init.signal ?? request?.signal ?? (stream ? undefined : AbortSignal.timeout(timeoutMs));
+        const signal = init.signal ?? request?.signal ?? (timeoutMs === undefined ? undefined : AbortSignal.timeout(timeoutMs));
         const outgoing = { host: originalHost };
         for (const [name, value] of headers)
             outgoing[name] = value;

package/dist/tenant/reset.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
-import { detachAllSessions } from "./environments.js";
+import { detachAllSessions } from "./agents.js";
 import { contentKey } from "../artifacts/folders.js";
 /**
  * Rename `dir` to a sibling, delete the sibling, recreate an empty `dir`.
@@ -38,7 +38,7 @@ function replaceDirectory(dir) {
  */
 export async function resetTenant(ctx, scope) {
     const clearSessions = scope === "sessions" || scope === "all";
-    const clearSandboxes = scope === "environments" || scope === "all";
+    const clearSandboxes = scope === "agents" || scope === "all";
     const clearAll = scope === "all";
     if (clearSandboxes) {
         await ctx.sandbox.removeAll();

package/dist/tenant/run-grants.d.ts

@@ -23,6 +23,12 @@ export interface RunGrants extends RunTokens {
 }
 export declare function createRunGrants(): RunGrants;
 type GrantContext = Pick<TenantContext, "keys" | "config" | "runGrants">;
+/** The root agent a session's run token names: its loop manifest's id (the agent manifest's name). */
+export declare function rootAgentOf(session: {
+    readonly manifest: {
+        readonly id: string;
+    };
+}): string;
 /** What a run token names of the session: its root agent and the turn the advance runs. */
 export interface RunOf {
     readonly agentId: string;

package/dist/tenant/run-grants.js

@@ -1,4 +1,5 @@
-import { mintRunToken, RUN_TOKEN_RENEW_SECONDS } from "./run-token.js";
+import { mintRunToken } from "./run-token.js";
+import { hostTuning } from "../tuning.js";
 export function createRunGrants() {
     const grants = new Map();
     return {
@@ -17,6 +18,10 @@ export function createRunGrants() {
         },
     };
 }
+/** The root agent a session's run token names: its loop manifest's id (the agent manifest's name). */
+export function rootAgentOf(session) {
+    return session.manifest.id;
+}
 /**
  * Mints and registers the run token of the advance that just took `lease`. Nothing when the
  * gates run in this process, or the session has no active turn (it makes no gate call).
@@ -50,7 +55,7 @@ export async function renewRunGrant(ctx, lease, run, active = () => true) {
     const held = ctx.runGrants.get(lease.sessionId);
     if (held && held.claims.epoch !== lease.epoch)
         return;
-    if (held && held.claims.expiresAt - Date.now() > RUN_TOKEN_RENEW_SECONDS * 1000)
+    if (held && held.claims.expiresAt - Date.now() > hostTuning().keys.runTokenRenewSeconds * 1000)
         return;
     const grant = await mintRunToken(ctx, lease, held ? { agentId: held.claims.agentId, activeTurnId: held.claims.turnId } : run);
     if (active())

package/dist/tenant/run-token.d.ts

@@ -4,10 +4,6 @@ import type { SessionStore } from "../store/types.js";
 import type { Lease } from "./context.js";
 export declare const RUN_TOKEN_TYP = "nylorun-run+jwt";
 export declare const RUN_TOKEN_AUD = "nylorun-gates";
-/** How long a run token lives. */
-export declare const RUN_TOKEN_TTL_SECONDS: number;
-/** The lease heartbeat re-mints a token with less than this left. */
-export declare const RUN_TOKEN_RENEW_SECONDS: number;
 /** What a verified run token says: one lease of one session's turn. */
 export interface RunClaims {
     readonly tenantId: string;

package/dist/tenant/run-token.js

@@ -6,7 +6,7 @@
  *
  * Signed by the keys service with the Tenant's current signing key, like capability links,
  * and told apart from them by `typ` and `aud`. Internal: not in `openapi.json`. A token lives
- * `RUN_TOKEN_TTL_SECONDS`, no longer than `TOKEN_TTL_MAX_SECONDS`, so a key rotation never
+ * `keys.runTokenTtlSeconds` (Host tuning), no longer than `keys.tokenTtlMaxSeconds`, so a key rotation never
  * revokes a live one (`signing-keys.ts`).
  *
  * ```text
@@ -18,15 +18,10 @@
 import { randomUUID } from "node:crypto";
 import { errors, importJWK, jwtVerify } from "jose";
 import { tenantTokenIssuer } from "@nylorun/core/contracts";
-import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "./jwt.js";
+import { clockToleranceSeconds, tokenKeyId } from "./jwt.js";
+import { hostTuning } from "../tuning.js";
 export const RUN_TOKEN_TYP = "nylorun-run+jwt";
 export const RUN_TOKEN_AUD = "nylorun-gates";
-/** How long a run token lives. */
-export const RUN_TOKEN_TTL_SECONDS = 15 * 60;
-/** The lease heartbeat re-mints a token with less than this left. */
-export const RUN_TOKEN_RENEW_SECONDS = 5 * 60;
-/** Allowed spread between `iat` and `exp` beyond the lifetime. */
-const LIFETIME_SLACK_SECONDS = 60;
 /**
  * Mints the run token of `lease` over `session`'s active turn. Throws when the session has
  * no active turn: there is no run to name.
@@ -37,7 +32,7 @@ export async function mintRunToken(signer, lease, session) {
         throw new Error(`Session ${lease.sessionId} has no active turn to mint a run token for`);
     const tenantId = signer.config.tenantId;
     const iat = Math.floor(Date.now() / 1000);
-    const exp = iat + RUN_TOKEN_TTL_SECONDS;
+    const exp = iat + hostTuning().keys.runTokenTtlSeconds;
     // Signed by the keys service (F4.2): this process never holds the private key.
     const { token } = await signer.keys.sign({
         typ: RUN_TOKEN_TYP,
@@ -92,7 +87,7 @@ export async function verifyRunToken(store, tenantId, raw, cache = new Map()) {
             issuer: tenantTokenIssuer(tenantId),
             audience: RUN_TOKEN_AUD,
             typ: RUN_TOKEN_TYP,
-            clockTolerance: CLOCK_TOLERANCE_SECONDS,
+            clockTolerance: clockToleranceSeconds(),
             requiredClaims: ["sub", "iat", "exp", "jti"],
         });
         payload = verified.payload;
@@ -112,7 +107,7 @@ export async function verifyRunToken(store, tenantId, raw, cache = new Map()) {
         typeof epc !== "number" ||
         !Number.isSafeInteger(epc) ||
         epc < 1 ||
-        exp - iat > RUN_TOKEN_TTL_SECONDS + LIFETIME_SLACK_SECONDS)
+        exp - iat > hostTuning().keys.runTokenTtlSeconds + hostTuning().keys.tokenLifetimeSlackSeconds)
         return refused("claims");
     return {
         ok: true,