@nylorun/runtime 0.27.0-beta → 0.28.0-beta

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 0.28.0-beta
+
+### Minor Changes
+
+- 22c61ce: Protocol 16, Agents from one manifest (track T2), a fresh start. An agent manifest (v8) is one versioned document at `/v1/agent-manifests/{name}` with a `harness` section (what runs inside the loop, including the harness's id) and a `runtime` section (what an environment manifest said). The Runtime checks the two against each other when it is saved (`422 manifest_inconsistent` with `details.gaps`), in place of `requires` at session open. Agent definitions and environment manifests are gone.
+
+  Environments are Agents: `/v1/agents/{id}` and its sub-routes, made from a saved manifest only (`manifest: "name"` tracks it, `"name@n"` pins a version; either resolves once, into `resolvedVersion`), with a derived `state` (`working`, `sleeping`, `input_required`, `failing`, `paused`) and `attention`. Every session runs on one Agent (`PUT /v1/sessions/{id} { agent, ownerUserId }`) and pins its manifest version. No session is special (D71). Error codes, events (`agent.*`), scopes (`agents:write`, `agent-manifests:write`) and identity-file grants (`agents`) say Agent; model budget scope `agent` is `manifest`. Harness API 5: `turn.start.agent` replaces `turn.start.environment`, with `definition` and `loop`. Migration 0032 closes older sessions (`protocol_16`) and drops Environments with their disks and vaults.
+
+  The SDK has `client.agentManifests`, `client.agents` and `composeManifest(dir)` for three-file authoring; the CLI has `nylorun apply`, `nylorun agent-manifests`, `nylorun agents` and `nylorun migrate v8`; Studio has an Agents screen, an Agent page and an Agent manifests screen. See MIGRATION.md.
+
+- 1ded443: Track T3, Agents that evolve: an Agent moves between versions of its manifest in place, with its id, disk, vault and sessions. `PUT /v1/agents/{id}` with another version moves it (`?dryRun=true` answers the plan, `AgentMovePlan`), and saving a manifest moves every Agent that tracks it. A harness-only change applies at once; a runtime change a pod applies only when it starts (image, resources, network, setup, files) leaves the Agent outdated (`targetVersion`, `waitingFor: "start"`) until its pod's next start, on the same volume; a version that adds a required secret waits for its value (`waitingFor: "secrets"`, state `input_required`). Its manifest's name, kind, harness and storage are fixed: `409 agent_fixed_field` replaces `409 agent_upgrade_unavailable`. Only secrets that fill a slot of the running version are used; others stay in the vault, dormant. New events `agent.outdated` and `agent.version_changed`, `GET /v1/agents?outdated=true`, and the save plan's `moves` and `agents_move` warning. Migration 0033 adds the Agent's target and failed versions and its start check.
+- 76dcd11: Track T3, the next start and its check: a pod Agent's start on a new version is checked until the new pod's harness joins (`startCheck` on the Agent). A failed setup, a failed pod, or a start slower than the Host's `tenant.upgradeStartMs` (10 minutes) takes the Agent back to the version it ran, its definition and not its disk, records `agent.start_failed`, and names the version `failedVersion` (state `failing`), which a tracking Agent does not move to again. A new version's setup runs on the same volume when its commands or files changed (`setupHash` in the setup plan and the volume's marker). While a pod waits to start on a new version it idles at most `tenant.upgradeIdleMs` (1 minute). `POST /v1/agents/{id}/restart` applies a pending version now; `retry: true` tries the failed version again.
+- 4fa160d: Agent memory, storage and API (track T5, D72). An agent manifest's `harness.memory` (`access`: `read_write` or `read_only`; `instructions`, at most 4,096 characters) turns on the Agent's memory: Markdown files under `/memories` it keeps across sessions, wakes and upgrades. The Runtime keeps them in Postgres (`memories`, `memory_versions`, migration 0036) with a version per change and who made it. `GET /v1/agents/{id}/memories` lists them (`pathPrefix`), `GET`, `PUT` (whole content, with an optional `contentSha256` precondition: `409 memory_conflict`) and `DELETE /v1/agents/{id}/memories/{path}` read, write and delete one (or a folder), and `GET /v1/agents/{id}/memory_versions` and `.../memory_versions/{versionId}` page the versions. A fork copies the memories (the fork plan adds `memories`); a delete removes them. `@nylorun/core` adds `memoryPathOf`, `memoryDescriptionOf` and the memory contracts; new Runtime limits `memoryBytes` (100 KB) and `memoriesPerAgent` (10,000); new error code `memory_conflict`. The SDK adds `client.agents.memories`; the CLI adds `nylorun agents memories ls|cat|put|rm|versions`. The model's `memory` tool arrives in the next steps of T5.
+- 9fed948: The `memory` tool's calls (track T5, D72). A new effect target, `{kind: "runtime", operation: "memory"}` (additive on Harness API 5), carries Anthropic's memory tool input (`command`: `view`, `create`, `str_replace`, `insert`, `delete`, `rename`, and its parameters); core serves it in the intent's own transaction, so a replayed turn applies a write once. A malformed call fails with text for the model and changes nothing; a write from a `read_only` agent or a sub-agent is `memory.forbidden`. Each write is a memory version naming the turn's manifest version, session, turn and the trigger run that started the turn, with a new session event `memory.updated` and Agent event `agent.memory_updated`. `turn.start.memory` (`TurnMemorySchema`) carries the Agent's memory access, instructions and the index a harness pins, newest first, within the new Runtime limits `memoryIndexLines` (200) and `memoryIndexBytes` (25 KiB).
+- ffeb3bb: `schedule_wake` (track T4, D77). An agent manifest's `runtime.selfWake: true` offers the agent `schedule_wake`: `{in | at, note}` books its session's next turn, replacing the booking before, and `{cancel: true}` removes it. The Runtime serves the call in its own transaction (a new effect target, `{kind: "runtime", operation: "schedule_wake"}`, additive on Harness API 5; `turn.start.agent.selfWake` tells a harness to offer it), so a replayed turn books once. The booking fires as a trigger run of kind `wake`, its note the turn's message with `cause.kind: "self"`. New session events `wake.booked` and `wake.cancelled`, tool call kind `runtime`, and Runtime limits `wakeMaxAheadMs` and `wakeNoteChars`.
+- 9e60e40: Protocol 17, a queue per session (track T4, D76). A message sent while the session's turn runs or waits is queued (`{status: "queued", queuedMessageId, position}`, `message.queued`) and starts the next turn when this one ends, with every queued message, each its own user message (`queue.taken`); a cancel ends the turn, not the queue. `delivery: "reject"` keeps the refusal, now `409 session_busy`, and a protocol 16 client's messages default to it, so the Host serves protocol 16 and 17. The queue holds at most the Runtime limit `sessionQueuedMessages` (`429 queue_full`), and session reads count `queuedMessages`. Our engine takes `{kind: "messages", messages}` as a turn's input. The SDK's `input` and `inputParts` take `delivery`, and the CLI's `sessions send` takes `--reject-if-busy`. See MIGRATION.md.
+- f85483d: Triggers (track T4, D74). An agent manifest's `runtime.triggers` declares `schedule` (cron with an IANA `timezone`) and `at` triggers, each with the session its runs go to (a session id, opened on the first run, or `new` for a session per run) and its prompt. They start active with a new Agent, fire on a durable timer per trigger with Postgres as the truth (one late fire after downtime, never a backfill, a fixed jitter per trigger), and each fire is a run (`started`, `queued`, `skipped` or `failed`, with a reason) at `GET /v1/agents/{id}/runs`. A schedule adds at most one queued message to a busy session. `GET /v1/agents/{id}/triggers` and `POST .../triggers/{triggerId}/pause`, `/resume` and `/run` (with an `Idempotency-Key`); Agent reads add `nextWakeAt`, and the Agent's stream adds `agent.run`, `agent.trigger_paused` and `agent.trigger_resumed`. New Runtime limits: `triggersPerAgent`, `triggerMinIntervalMs` and `triggerRunRetentionMs` (with floors), `triggerRunsPerHour`, `triggerJitterPercent`, `triggerJitterMaxMs`, `triggerPromptChars`; Host tuning `triggers.lateGraceMs` and `triggers.intervalCheckFires`. The SDK's `client.agents` adds `triggers`, `pauseTrigger`, `resumeTrigger`, `runTrigger` and `runs`; the CLI adds `nylorun agents triggers` and `nylorun agents runs`.
+- 3a575d7: Track T3, versions per turn: a turn's first segment takes the manifest version its session's Agent runs then, so a session moves with its Agent between turns and keeps one version through every segment, approval and rollover of a turn. A turn whose message named a variant, and a flow's sessions, keep the version they pinned; a changed loop manifest drops the session's MCP snapshot. The turn span names the version (`nylorun.manifest.version`). Our engine takes a new version's output schema at the next turn.
+- ae54de7: Webhook triggers (track T4, D75). A `webhook: "standard-webhooks"` trigger has an endpoint, `POST /v1/webhooks/{endpointId}`, an anonymous, unversioned route that takes any body up to the new Runtime limit `webhookBodyBytes` and verifies Standard Webhooks (`webhook-id`, `webhook-timestamp` within the Host's `triggers.webhookToleranceMs`, `webhook-signature`) in the keys service, which alone opens the trigger's sealed secret; anything else is `401` and writes nothing. A delivery runs the trigger once per `webhook-id` (`202 {runId, status}`); a paused trigger answers a signed one `409 trigger_paused`. `POST /v1/agents/{id}/triggers/{triggerId}/secret` makes or replaces the `whsec_` secret, shown once (`agent.trigger_secret_rotated`); trigger reads show `webhookUrl` and `secretSet`. The payload reaches the model under the trigger's prompt in a labelled `<trigger-payload>` block. The SDK adds `agents.rotateWebhookSecret`, and the CLI `nylorun agents triggers new-secret`.
+
+### Patch Changes
+
+- bf942ed: Our engine offers the `memory` tool (track T5, D72). An agent whose version sets `harness.memory` gets one `memory` tool with Anthropic's memory tool schema (`view`, `create`, `str_replace`, `insert`, `delete`, `rename`; `view` only for a `read_only` agent and an agent used as a tool), our memory rules followed by the agent's `instructions`, and its memory index pinned after the instructions as user-role context: kept for the session so the prompt prefix stays cacheable (`ExecutionState.pinned`), and re-pinned after a compaction. Each command's parameters are checked before a call is sent (`checkMemoryCall` in `@nylorun/core/contracts`, which the Runtime also uses), and a call named `memory.<command>` or `memory/<command>` runs as `memory` with that command (`memoryAliasOf`). `ModelRequest.pinned` carries the pinned text; `memoryTool` and `memoryIndexBlock` are exported for your own harness.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [218b078]
+- Updated dependencies [22c61ce]
+- Updated dependencies [1ded443]
+- Updated dependencies [76dcd11]
+- Updated dependencies [bf942ed]
+- Updated dependencies [4fa160d]
+- Updated dependencies [9fed948]
+- Updated dependencies [ffeb3bb]
+- Updated dependencies [9e60e40]
+- Updated dependencies [f85483d]
+- Updated dependencies [3a575d7]
+- Updated dependencies [ae54de7]
+- Updated dependencies
+  - @nylorun/core@0.24.0-beta
+  - @nylorun/harness@0.29.0-beta
+
 ## 0.27.0-beta
 
 ### Minor Changes

package/dist/api/a2a/card.d.ts

@@ -1,6 +1,6 @@
 /**
- * The Agent Card of one agent, from its manifest: name, description and one skill, never its
- * instructions, tools or MCP servers. The Runtime does not know where callers reach it, so
+ * The Agent Card of one Agent, from its manifest version: its id as the name, the manifest's
+ * description and one skill, never its instructions, tools or MCP servers. The Runtime does not know where callers reach it, so
  * `supportedInterfaces` is empty: whoever publishes the card (the gateway in v1) adds its own
  * URL, provider and security schemes.
  */
@@ -10,7 +10,8 @@ export interface CardDefinition {
         name?: unknown;
         description?: unknown;
     };
-    readonly implementationVersion: string;
+    /** The manifest version the Agent runs, as `name@version`. */
+    readonly version: string;
 }
 import type { ModelInput } from "@nylorun/core/contracts";
 /**

package/dist/api/a2a/card.js

@@ -1,6 +1,6 @@
 /**
- * The Agent Card of one agent, from its manifest: name, description and one skill, never its
- * instructions, tools or MCP servers. The Runtime does not know where callers reach it, so
+ * The Agent Card of one Agent, from its manifest version: its id as the name, the manifest's
+ * description and one skill, never its instructions, tools or MCP servers. The Runtime does not know where callers reach it, so
  * `supportedInterfaces` is empty: whoever publishes the card (the gateway in v1) adds its own
  * URL, provider and security schemes.
  */
@@ -39,7 +39,7 @@ export function agentCard(agentId, definition, inputModes = MODES) {
         name,
         description,
         supportedInterfaces: [],
-        version: definition.implementationVersion,
+        version: definition.version,
         capabilities: { streaming: false, pushNotifications: false, extendedAgentCard: false },
         defaultInputModes: [...inputModes],
         defaultOutputModes: MODES,

package/dist/api/a2a/routes.js

@@ -25,7 +25,8 @@ import { SETTLED_EVENTS, buildTask, contextSessionId, newContextId, parseTaskId,
 import { currentModelDescriptor } from "../../model/descriptor.js";
 import { accessOf } from "../../tenant/auth.js";
 import { command } from "../../tenant/commands.js";
-import { loadSession, } from "../../tenant/context.js";
+import { loadSession, reachesAgent, } from "../../tenant/context.js";
+import { agentGrantsOf, liveEnvironment } from "../../tenant/agents.js";
 import { HttpError, fail } from "../../tenant/http.js";
 import { observeSession, readHistory } from "../../tenant/session-streams.js";
 import { putSession } from "../../tenant/sessions.js";
@@ -105,12 +106,22 @@ async function operation(caller, request, signal) {
             return a2aFail("methodNotFound", `Method ${request.method} not found`);
     }
 }
-/** The agent's definition, or a `404` when it is missing or the caller may not use it. */
+/**
+ * What the card of Agent `agentId` says (the manifest version it runs), or a `404` when it is
+ * missing or the caller may not use it. Every caller's session runs on that Agent, with its disk
+ * and vault (D66, D70): an app that serves several audiences makes an Agent for each.
+ */
 async function definitionFor(ctx, agentId, access) {
-    if (access?.agents !== undefined && !access.agents.has(agentId))
+    if (!reachesAgent(access, agentId))
         return fail(404, "Agent not found");
-    const definition = await ctx.store.tx((t) => t.get("definitions", agentId));
-    return definition ?? fail(404, "Agent not found");
+    return ctx.store.tx(async (t) => {
+        const agent = (await liveEnvironment(t, agentId)) ?? fail(404, "Agent not found");
+        const version = await t.agentManifest(agent.manifestName, agent.manifestVersion);
+        return {
+            manifest: { id: agentId, ...(version?.body.description === undefined ? {} : { description: version.body.description }) },
+            version: `${agent.manifestName}@${agent.manifestVersion}`,
+        };
+    });
 }
 const taskNotFound = (taskId) => a2aFail("taskNotFound", "Task not found", { taskId });
 /** The caller's session for a context, or undefined when it does not exist yet. */
@@ -166,9 +177,9 @@ async function openContext(caller, sessionId) {
         return existing;
     return putSession(caller.ctx, sessionId, {
         requestId: randomUUID(),
-        agentId: caller.agentId,
+        agent: caller.agentId,
         ownerUserId: caller.access.owner,
-    }, caller.access);
+    }, caller.access, agentGrantsOf(caller.scope) === undefined ? {} : { agentGrants: agentGrantsOf(caller.scope) });
 }
 async function sendMessage(caller, params, signal) {
     const send = parseSendParams(params);

package/dist/api/ag-ui/routes.js

@@ -36,7 +36,7 @@ import { fail, HttpError } from "../../tenant/http.js";
 import { observeSession, readHistory, StreamClosed, streamHolderOf, } from "../../tenant/session-streams.js";
 import { putSession, sessionView } from "../../tenant/sessions.js";
 import { mayUseAgent } from "../../tenant/auth.js";
-import { environmentGrantsOf } from "../../tenant/environments.js";
+import { agentGrantsOf } from "../../tenant/agents.js";
 import { hostTuning } from "../../tuning.js";
 const TERMINAL = new Set([
     "turn.completed",
@@ -111,10 +111,7 @@ function sessionOptions(input, scope) {
         ?.nylorun?.session;
     if (raw === undefined)
         return {};
-    const parsed = PutSessionRequestSchema.pick({
-        info: true,
-        environment: true,
-    })
+    const parsed = PutSessionRequestSchema.pick({ info: true })
         .strict()
         .safeParse(raw);
     if (!parsed.success)
@@ -282,12 +279,12 @@ trace) {
     const id = sessionIdFor(caller.subject, agentId, input.threadId);
     await putSession(ctx, id, {
         requestId: randomUUID(),
-        agentId,
+        agent: agentId,
         ownerUserId: caller.subject,
         ...sessionOptions(input, scope),
     }, caller.access, {
         createOnly: true,
-        ...(environmentGrantsOf(scope) === undefined ? {} : { environmentGrants: environmentGrantsOf(scope) }),
+        ...(agentGrantsOf(scope) === undefined ? {} : { agentGrants: agentGrantsOf(scope) }),
     });
     const translator = new RunTranslator(input.threadId, input.runId);
     let cursor;