@nylorun/runtime 0.29.0-beta → 0.31.0-beta

package/dist/gates/egress-credentials.js

@@ -19,26 +19,15 @@ import { createServer } from "node:http";
 import { Agent, request } from "node:https";
 import { createSecureContext, TLSSocket } from "node:tls";
 import { hostTuning } from "../tuning.js";
+import { HOP_BY_HOP_HEADERS } from "../vault/headers.js";
 /** The answer to a CONNECT the gate serves; a tunnel's byte counts leave it out. */
 export const CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
-/** Headers that describe one hop and are never forwarded. */
-const HOP_BY_HOP = new Set([
-    "connection",
-    "keep-alive",
-    "proxy-authenticate",
-    "proxy-authorization",
-    "proxy-connection",
-    "te",
-    "trailer",
-    "transfer-encoding",
-    "upgrade",
-]);
 /** `rawHeaders` without hop-by-hop headers and `drop`, as lowercase names to values. */
 function forwardable(raw, drop) {
     const headers = {};
     for (let i = 0; i + 1 < raw.length; i += 2) {
         const name = raw[i].toLowerCase();
-        if (HOP_BY_HOP.has(name) || name === drop)
+        if (HOP_BY_HOP_HEADERS.has(name) || name === drop)
             continue;
         (headers[name] ??= []).push(raw[i + 1]);
     }

package/dist/gates/handler.js

@@ -6,7 +6,7 @@
  * the Tenant's ledger. Logs one line per call, never the prompt, the output or a credential.
  */
 import { classifyThrown } from "../model/classify.js";
-import { callFiles, inProcessModelGate, modelCallSettings, serve } from "./in-process.js";
+import { callCaller, callFiles, inProcessModelGate, modelCallSettings, serve } from "./in-process.js";
 import { createMeter } from "./meter.js";
 import { GateRefusal } from "./tenant-vaults.js";
 export function createModelCallHandler(options) {
@@ -28,6 +28,7 @@ export function createModelCallHandler(options) {
                     // The Tenant's Runtime limits `model*`, read for this call.
                     settings: await modelCallSettings(vault.store),
                     ...(blobs ? { files: callFiles(vault.store, blobs) } : {}),
+                    caller: callCaller(vault.store),
                 });
                 outcome = await meter.call(vault.store, call, () => serve(vault.store, gate, call, signal));
             }

package/dist/gates/in-process.d.ts

@@ -11,6 +11,7 @@ import type { HostModelSecret } from "../vault/service.js";
 import type { ModelGate, ModelGateRequest } from "./model-gate.js";
 import { type FileResolver } from "../artifacts/files.js";
 import type { BlobStore } from "../blob/index.js";
+import type { ModelCaller } from "../model/call-headers.js";
 export interface InProcessModelGateOptions {
     /** The Tenant's home: `piModel` redacts secrets it finds there from failure messages. */
     readonly root?: string;
@@ -20,6 +21,8 @@ export interface InProcessModelGateOptions {
     readonly settings?: ModelCallSettings;
     /** Reads the files a call's prompt names (protocol 6): artifacts, for model-gate. */
     readonly files?: (request: ModelGateRequest) => FileResolver;
+    /** Reads who makes a call, for a custom endpoint's per-call headers (#493). */
+    readonly caller?: (request: ModelGateRequest) => Promise<ModelCaller | undefined>;
 }
 /**
  * The files a call names, from the Tenant's artifacts, limited to the call's session: in
@@ -27,6 +30,12 @@ export interface InProcessModelGateOptions {
  * gate's route puts on the request (F5). A request without a session reads no file at all.
  */
 export declare function callFiles(store: SessionStore, blobs: BlobStore): (request: Pick<ModelGateRequest, "sessionId">) => FileResolver;
+/**
+ * Who makes a call, from the Tenant's store: the Agent its session runs on, with its labels, and
+ * the session's owner when it is a person. The session is the loop's own in process, and the run
+ * token's over HTTP; the request's `agentId` names the manifest's agent, not the Agent.
+ */
+export declare function callCaller(store: SessionStore): (request: Pick<ModelGateRequest, "sessionId">) => Promise<ModelCaller | undefined>;
 /**
  * The in-process gate of an open Tenant: reads its host model from its own vault and records
  * each call in its usage ledger. Only a Runtime without the gates service (embedding, the

package/dist/gates/in-process.js

@@ -5,6 +5,7 @@ import { createMeter } from "./meter.js";
 import { artifactFiles } from "../artifacts/files.js";
 import { usesFixtureModel } from "../tenant/model-setting.js";
 import { fixtureAnswer } from "./fixture-model.js";
+import { isSubject } from "@nylorun/core/contracts";
 /**
  * The files a call names, from the Tenant's artifacts, limited to the call's session: in
  * process, the loop's own request; over HTTP, the session of the run token's claims, which the
@@ -13,6 +14,24 @@ import { fixtureAnswer } from "./fixture-model.js";
 export function callFiles(store, blobs) {
     return (request) => artifactFiles({ store, blobs, sessionId: request.sessionId });
 }
+/**
+ * Who makes a call, from the Tenant's store: the Agent its session runs on, with its labels, and
+ * the session's owner when it is a person. The session is the loop's own in process, and the run
+ * token's over HTTP; the request's `agentId` names the manifest's agent, not the Agent.
+ */
+export function callCaller(store) {
+    return (request) => store.tx(async (t) => {
+        const session = await t.get("sessions", request.sessionId);
+        const agent = session && (await t.environment(session.agentId));
+        if (!session || !agent)
+            return undefined;
+        return {
+            agentId: agent.id,
+            labels: agent.labels,
+            ...(isSubject(session.ownerUserId) ? { owner: session.ownerUserId } : {}),
+        };
+    });
+}
 /**
  * The in-process gate of an open Tenant: reads its host model from its own vault and records
  * each call in its usage ledger. Only a Runtime without the gates service (embedding, the
@@ -30,6 +49,7 @@ export function tenantModelGate(options) {
                 writeHostCredential: (credential) => vault.updateHostCredential(credential),
                 settings: await modelCallSettings(options.store),
                 ...(options.blobs ? { files: callFiles(options.store, options.blobs) } : {}),
+                caller: callCaller(options.store),
             });
             return serve(options.store, gate, request, signal);
         }),
@@ -58,6 +78,7 @@ export function inProcessModelGate(options) {
                 writeHostCredential: options.writeHostCredential,
                 ...(options.settings ? { settings: options.settings } : {}),
                 ...(options.files ? { files: options.files(request) } : {}),
+                ...(options.caller ? { caller: () => options.caller(request) } : {}),
             });
             return adapter(request.call, {
                 // The Runtime never journals the provider request (harness `durable.ts`), and

package/dist/host/http.js

@@ -1,6 +1,7 @@
 import { createHash, timingSafeEqual } from "node:crypto";
 import { jsonResponse } from "../api/http/respond.js";
 import { HOST_PROTOCOL, } from "@nylorun/core/compatibility";
+import { AGENT_FOLDER_MEDIA_TYPE } from "@nylorun/core/contracts";
 export const OPAQUE_NOT_FOUND = {
     status: "rejected",
     code: "not_found",
@@ -113,7 +114,8 @@ export function isJsonContentType(value) {
     if (value === undefined)
         return false;
     const media = value.split(";")[0].trim().toLowerCase();
-    return media === "application/json";
+    // An agent folder by hash (track T6) is JSON too.
+    return media === "application/json" || media === AGENT_FOLDER_MEDIA_TYPE;
 }
 /** True when the request carries a body (Content-Length > 0 or chunked). */
 export function requestHasBody(request) {

package/dist/host/main.js

@@ -65,6 +65,7 @@ import { startHarnessListener } from "../harness-api/ws-server.js";
 import { httpSandboxesClient } from "../sandbox/pods/client.js";
 import { retry } from "../retry.js";
 import { hostTuning, useHostTuning } from "../tuning.js";
+import { useWorkloadToken } from "../vault/workload-token.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
     try {
@@ -218,6 +219,7 @@ export async function main() {
     // Read once, before any service starts: each reads the parts it uses where it uses them.
     if (stack.tuning)
         useHostTuning(stack.tuning.values, stack.tuning.overrides);
+    useWorkloadToken(stack.workloadToken ?? {});
     if (stack.services.has("gates") || stack.services.has("keys") || stack.services.has("egress"))
         return runGates(stack);
     if (stack.services.has("harness"))

package/dist/host/stack-config.d.ts

@@ -178,6 +178,16 @@ export interface HarnessServiceConfig {
 export interface StackConfig {
     /** The Runtime services this process runs. */
     services: RuntimeServices;
+    /**
+     * `NYLORUN_WORKLOAD_TOKEN_FILE`, the file of the Runtime's workload token, which a platform
+     * rotates and the Runtime reads at each use, and `NYLORUN_WORKLOAD_TOKEN_ORIGINS`, the
+     * comma-separated origins a `workload` credential's `via` may send it to (#496,
+     * `vault/workload-token.ts`). Absent: no workload token.
+     */
+    workloadToken?: {
+        file?: string;
+        origins?: string[];
+    };
     /** Present when the process runs gates. */
     gates?: GatesConfig;
     /** Present when the process runs egress. */

package/dist/host/stack-config.js

@@ -47,6 +47,7 @@
 import { DEFAULT_SERVICE_NAME } from "../traces/otlp.js";
 import { TRACE_CONTENT_KINDS } from "../traces/map.js";
 import { isTenantId } from "@nylorun/core/compatibility";
+import { LOOPBACK_HOSTS } from "@nylorun/core/contracts";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 import { HostTuningError, parseHostTuning } from "../tuning.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
@@ -325,6 +326,7 @@ export function parseStackConfig(env, argv) {
         throw new StackConfigError("NYLORUN_HARNESS_LISTEN_PORT must differ from NYLORUN_LISTEN_PORT");
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
+    const workloadToken = parseWorkloadToken(env);
     const objectStore = parseObjectStore(env);
     const traces = services.has("core") ? parseTraces(env) : undefined;
     const removedResolverVariables = Object.keys(env)
@@ -347,6 +349,7 @@ export function parseStackConfig(env, argv) {
         ...(sandboxes ? { sandboxes } : {}),
         ...(delivery ? { delivery } : {}),
         ...(tenant ? { tenant } : {}),
+        ...(workloadToken ? { workloadToken } : {}),
         ...(objectStore ? { objectStore } : {}),
         ...(traces ? { traces } : {}),
         ...(tuning ? { tuning } : {}),
@@ -454,6 +457,39 @@ function parseTenant(env) {
         ...(managementKeyFile ? { managementKeyFile } : {}),
     };
 }
+/**
+ * `StackConfig.workloadToken` (#496): the Runtime's workload token, which the gates read for a
+ * custom model and for `workload` credentials, and the in-process Tenant does without them.
+ */
+function parseWorkloadToken(env) {
+    const file = read(env, "NYLORUN_WORKLOAD_TOKEN_FILE");
+    const origins = parseOrigins(read(env, "NYLORUN_WORKLOAD_TOKEN_ORIGINS"));
+    if (file === undefined && origins === undefined)
+        return undefined;
+    return { ...(file ? { file } : {}), ...(origins ? { origins } : {}) };
+}
+/** `NYLORUN_WORKLOAD_TOKEN_ORIGINS`: each an `https` origin (`http` only to a loopback host). */
+function parseOrigins(raw) {
+    if (raw === undefined)
+        return undefined;
+    return raw
+        .split(",")
+        .map((item) => item.trim())
+        .filter((item) => item !== "")
+        .map((item) => {
+        let url;
+        try {
+            url = new URL(item);
+        }
+        catch {
+            throw new StackConfigError(`NYLORUN_WORKLOAD_TOKEN_ORIGINS: ${item} is not a URL`);
+        }
+        const loopback = url.protocol === "http:" && LOOPBACK_HOSTS.test(url.hostname);
+        if ((url.protocol !== "https:" && !loopback) || url.origin !== item.replace(/\/$/, ""))
+            throw new StackConfigError(`NYLORUN_WORKLOAD_TOKEN_ORIGINS: ${item} must be an https origin, such as https://gateway.example.com`);
+        return url.origin;
+    });
+}
 const GATES_TOKEN = /^[0-9a-f]{64,}$/i;
 /** `NYLORUN_HARNESS`: `in-process` (the default when unset) or `remote`. */
 function parseHarnessMode(env) {