@nylorun/runtime 0.29.0-beta → 0.31.0-beta

package/dist/vault/service.js

@@ -83,7 +83,7 @@ import { canonical } from "../store/canonical.js";
 import { decryptSecret, encryptSecret, VaultCryptoError } from "./crypto.js";
 import { VaultError } from "./error.js";
 import { credentialNeeds } from "./coverage.js";
-import { checkCredentialHeaders } from "./headers.js";
+import { checkCredentialHeaders, modelHeaderError } from "./headers.js";
 import { hostModelCatalog, inputsOfHostModel } from "../model/catalog.js";
 import { inputsError } from "../model/capabilities.js";
 import { readAddedInputs } from "../tenant/model-setting.js";
@@ -247,7 +247,8 @@ export class VaultService {
             ({ payload, binding } = environmentCredential(name, body));
         else {
             const url = normalizeVaultUrl(body.url);
-            payload = payloadOf(body);
+            // A workload credential holds no value: the bearer is the Runtime's workload token (#496).
+            payload = body.type === "workload" ? {} : payloadOf(body);
             binding = bindingOf(url, payload, body);
         }
         const kek = this.kek();
@@ -466,6 +467,8 @@ export class VaultService {
             url,
             headers,
             ...(binding.via === undefined ? {} : { via: binding.via }),
+            ...(binding.toolPrefix === undefined ? {} : { toolPrefix: binding.toolPrefix }),
+            ...(row.type === "workload" ? { workload: true } : {}),
             ...(binding.identity === undefined ? {} : { identity: binding.identity }),
         };
     }
@@ -541,15 +544,20 @@ export class VaultService {
         const kek = this.kek();
         return this.store.tx((t) => this.replay(t, `host-model:${body.idempotencyKey}`, body, async () => {
             this.validateHostModel(body);
+            if (body.auth.type === "workload" && body.provider !== "custom")
+                throw new VaultError(400, "The workload token authenticates a custom provider only.");
             await this.ensureHostVault(t);
             const credentialId = hostModelCredentialId(body.provider);
             await this.deleteHostProviderRows(t, body.provider);
+            // The workload token is read on every call and never stored (#496).
             const payload = body.auth.type === "api_key"
                 ? {
                     apiKey: body.auth.key,
                     ...(body.auth.env ? { env: body.auth.env } : {}),
                 }
-                : { oauth: body.auth };
+                : body.auth.type === "oauth"
+                    ? { oauth: body.auth }
+                    : {};
             await this.insertHostCredential(t, kek, {
                 id: credentialId,
                 provider: body.provider,
@@ -673,6 +681,7 @@ export class VaultService {
             }
             if (!["http:", "https:"].includes(url.protocol))
                 throw new VaultError(400, "Base URL must be an HTTP(S) URL.");
+            checkModelHeaders(body.settings);
             return;
         }
         if (body.baseUrl)
@@ -800,8 +809,9 @@ function conflictOf(type, binding, others) {
                 });
         }
     }
-    else if (type === "bearer" || type === "headers") {
-        const existing = others.find((row) => (row.type === "bearer" || row.type === "headers") && credentialBinding(row).url === binding.url);
+    else if (type === "bearer" || type === "headers" || type === "workload") {
+        const existing = others.find((row) => (row.type === "bearer" || row.type === "headers" || row.type === "workload") &&
+            credentialBinding(row).url === binding.url);
         if (existing)
             throw new VaultError(409, `${existing.name} is already bound to ${binding.url}`, {
                 code: "credential_conflict",
@@ -828,6 +838,7 @@ function secretViewOf(row) {
                 : { url: binding.url },
         ...(binding.headerNames === undefined ? {} : { headerNames: binding.headerNames }),
         ...(binding.via === undefined ? {} : { via: binding.via }),
+        ...(binding.toolPrefix === undefined ? {} : { toolPrefix: binding.toolPrefix }),
         ...(binding.identity === undefined ? {} : { identity: binding.identity }),
         createdAt: row.createdAt,
         ...(row.rotatedAt ? { rotatedAt: row.rotatedAt } : {}),
@@ -909,6 +920,23 @@ export function readHostPayload(kek, row, binding) {
         plaintext.fill(0);
     }
 }
+/**
+ * A custom endpoint's `headers` and `callHeaders` (#493): no name the model's auth or the
+ * transport sets, and each name once across both maps, whatever its case.
+ */
+function checkModelHeaders(settings) {
+    const names = [...Object.keys(settings?.headers ?? {}), ...Object.keys(settings?.callHeaders ?? {})];
+    const seen = new Set();
+    for (const name of names) {
+        const refused = modelHeaderError(name);
+        if (refused)
+            throw new VaultError(400, refused);
+        const lower = name.toLowerCase();
+        if (seen.has(lower))
+            throw new VaultError(400, `The model header ${lower} is set twice`);
+        seen.add(lower);
+    }
+}
 /** The sealed part of a tool credential: a token, or a header map with lower-cased names. */
 function payloadOf(auth) {
     if (auth.type === "bearer")
@@ -924,12 +952,16 @@ function bindingOf(url, payload, routing) {
     return {
         url,
         ...(routing.via ? { via: routing.via } : {}),
+        ...(routing.via && routing.toolPrefix ? { toolPrefix: routing.toolPrefix } : {}),
         ...(routing.identity ? { identity: { header: routing.identity.header.toLowerCase() } } : {}),
         ...(payload.headers ? { headerNames: sent } : {}),
     };
 }
 /** The headers a credential sends, or undefined when its payload holds none. */
 function sendHeaders(row, payload) {
+    // Its bearer is the Runtime's workload token, which `sessionCredentials` adds.
+    if (row.type === "workload")
+        return {};
     if (row.type === "headers")
         return payload.headers && Object.keys(payload.headers).length > 0
             ? { ...payload.headers }
@@ -999,7 +1031,12 @@ function rebind(name, slot, row, payload, binding) {
             return undefined;
         const sealed = payloadOf(auth);
         const routing = slot;
-        return { type, payload: sealed, binding: bindingOf(normalizeVaultUrl(routing.url), sealed, routing) };
+        // The gateway's tool prefix is the vault's, not the slot's: it stays while the slot keeps `via`.
+        return {
+            type,
+            payload: sealed,
+            binding: bindingOf(normalizeVaultUrl(routing.url), sealed, { ...routing, toolPrefix: binding.toolPrefix ?? null }),
+        };
     }
     catch (error) {
         if (error instanceof VaultError)

package/dist/vault/sources.js

@@ -8,6 +8,7 @@
  * and Tool Gate). The session comes from its row, never from the harness.
  */
 import { isSubject } from "@nylorun/core/contracts";
+import { workloadOriginRefused, workloadToken, WorkloadTokenUnavailable } from "./workload-token.js";
 /**
  * The credential of one request made for `session`: the answer of its Environment's vault
  * (`VaultService.authorize`). A credential with an identity header (R2b C2)
@@ -16,11 +17,12 @@ import { isSubject } from "@nylorun/core/contracts";
  * person (the reserved `installation`) sends none (Q3).
  */
 export async function sessionCredentials(vault, session, request) {
-    const result = await vault.authorize({
+    const authorized = await vault.authorize({
         sessionId: session.id,
         ...(session.environmentId === undefined ? {} : { environmentId: session.environmentId }),
         url: request.url,
     });
+    const result = authorized.status === "authorized" && authorized.workload ? await withWorkloadToken(authorized) : authorized;
     if (result.status !== "authorized" || !result.identity || !isSubject(session.ownerUserId))
         return result;
     return {
@@ -28,3 +30,22 @@ export async function sessionCredentials(vault, session, request) {
         headers: { ...result.headers, [result.identity.header]: session.ownerUserId },
     };
 }
+/**
+ * A `workload` credential's request with the Runtime's workload token as its bearer, read now
+ * (#496), or refused: when `via`'s origin is not one the operator lists, or the token cannot be
+ * read. Never sent without it.
+ */
+async function withWorkloadToken(result) {
+    const refused = (reason) => ({ status: "refused", url: result.url, credentialIds: [], reason });
+    const origin = result.via === undefined ? "a workload credential needs via" : workloadOriginRefused(result.via);
+    if (origin !== undefined)
+        return refused(origin);
+    try {
+        return { ...result, headers: { ...result.headers, authorization: `Bearer ${await workloadToken()}` } };
+    }
+    catch (error) {
+        if (error instanceof WorkloadTokenUnavailable)
+            return refused(error.message);
+        throw error;
+    }
+}

package/dist/vault/workload-token.d.ts

@@ -0,0 +1,16 @@
+export interface WorkloadTokenSettings {
+    /** The token's file (`NYLORUN_WORKLOAD_TOKEN_FILE`). */
+    readonly file?: string;
+    /** The origins a `workload` credential's `via` may name (`NYLORUN_WORKLOAD_TOKEN_ORIGINS`). */
+    readonly origins?: readonly string[];
+}
+/** Why the workload token could not be used: the message names the setting, never the token. */
+export declare class WorkloadTokenUnavailable extends Error {
+    constructor(message: string);
+}
+/** Sets where this process reads the workload token and where it may send it (at startup). */
+export declare function useWorkloadToken(next: WorkloadTokenSettings): void;
+/** The workload token, read from its file now. */
+export declare function workloadToken(): Promise<string>;
+/** Why the workload token may not go to `via`, or undefined when its origin is listed. */
+export declare function workloadOriginRefused(via: string): string | undefined;

package/dist/vault/workload-token.js

@@ -0,0 +1,58 @@
+/**
+ * The Runtime's workload token (#496): a short-lived token a platform gives each installation and
+ * rotates through a file, so a gateway trusts the workload instead of a stored key. The file
+ * (`NYLORUN_WORKLOAD_TOKEN_FILE`) is read on every use and nothing of it is kept, so a rotation
+ * applies to the next request with no restart. A missing, unreadable or empty file fails the
+ * request, never sends it unauthenticated.
+ *
+ * Only the gate side reads it: the model call and the MCP and HTTP tool requests a `workload`
+ * credential makes. It never reaches a sandbox (`NYLORUN_*` is not passed to one), the model, an
+ * event or a log, and requests scrub it like any credential value. An Agent's writer chooses a
+ * credential's `via`, so the token goes only to the origins the operator lists
+ * (`NYLORUN_WORKLOAD_TOKEN_ORIGINS`), checked on every use; the model's `baseUrl` is the
+ * operator's own.
+ */
+import { readFile } from "node:fs/promises";
+/** Why the workload token could not be used: the message names the setting, never the token. */
+export class WorkloadTokenUnavailable extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "WorkloadTokenUnavailable";
+    }
+}
+let settings = {};
+/** Sets where this process reads the workload token and where it may send it (at startup). */
+export function useWorkloadToken(next) {
+    settings = { ...next };
+}
+/** The workload token, read from its file now. */
+export async function workloadToken() {
+    const file = settings.file;
+    if (file === undefined)
+        throw new WorkloadTokenUnavailable("The Runtime has no workload token: set NYLORUN_WORKLOAD_TOKEN_FILE");
+    let text;
+    try {
+        text = await readFile(file, "utf8");
+    }
+    catch (error) {
+        const code = error.code ?? "unreadable";
+        throw new WorkloadTokenUnavailable(`The workload token file ${file} (NYLORUN_WORKLOAD_TOKEN_FILE) cannot be read: ${code}`);
+    }
+    const token = text.trim();
+    if (token.length === 0)
+        throw new WorkloadTokenUnavailable(`The workload token file ${file} (NYLORUN_WORKLOAD_TOKEN_FILE) is empty`);
+    return token;
+}
+/** Why the workload token may not go to `via`, or undefined when its origin is listed. */
+export function workloadOriginRefused(via) {
+    let origin;
+    try {
+        origin = new URL(via).origin;
+    }
+    catch {
+        return `${via} is not a URL`;
+    }
+    return (settings.origins ?? []).includes(origin)
+        ? undefined
+        : `The workload token may not go to ${origin}: list it in NYLORUN_WORKLOAD_TOKEN_ORIGINS`;
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.29.0-beta";
+export declare const RUNTIME_VERSION = "0.31.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.29.0-beta";
+export const RUNTIME_VERSION = "0.31.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.29.0-beta",
+  "version": "0.31.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.5",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.25.0-beta",
-    "@nylorun/harness": "0.29.1-beta",
+    "@nylorun/core": "0.27.0-beta",
+    "@nylorun/harness": "0.29.3-beta",
     "@restatedev/restate-sdk": "1.17.3",
     "@restatedev/restate-sdk-clients": "1.17.3",
     "@s2-dev/streamstore": "0.28.0",