@nylorun/runtime 0.30.0-beta → 0.32.0-beta

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # Changelog
 
+## 0.32.0-beta
+
+### Minor Changes
+
+- b3dad06: Both ends of the agent folder loop (track T7).
+
+  - `nylorun init <path>` names the agent after the path's last segment (`init agents/hello`). `--example` adds `tools/get_order.json`, `mcp.json` (a `Bearer ${ORDERS_MCP_TOKEN}` header) and `triggers/new-order.md`, explained in the folder's README.md, and the result passes `nylorun check`. The first run in a project (the nearest directory with `.git`) writes `.gitattributes` (`* text=auto eol=lf`), ignores `.nylorun/credentials.json` in `.gitignore`, and maps the folder files to their JSON Schemas in `.vscode/settings.json`, merged into an existing file. Its hint names `apply --agent` and `chat`.
+  - `nylorun apply --agent [<id>]` makes the Agent from the manifest after a save (or on an unchanged one), or moves it, as `nylorun agents put` does, and prints what it needs a person for.
+  - `nylorun apply --watch [--save]` checks and plans again on each change to the folders (and the files their `runtime.json` extends); it saves only with `--save`.
+  - A plan's change to the instructions prints their text diff, `-` and `+` lines.
+  - `nylorun chat <agent> [--session <id>] [--message <text>]` opens or reuses a session, sends `--message` or each line of standard input, and prints the reply as it comes.
+  - `nylorun check --json` prints `{ folders: [{ path, ok, manifest?, diagnostics }] }` for CI, with the same exit codes. `check` says "1 file", and `nylorun --version` prints the version.
+  - `packFolder` (`@nylorun/agents`) leaves out what the folder's `.nyloignore` names (gitignore rules), and resolves `extends` in `runtime.json`: the packed file is the merge, the folder's own keys winning, with `.nylorun/origin.json` naming the files it came from; a missing file or a cycle is a `FolderError`. `ignoreMatcher` is exported.
+  - `session.approve(id, approved)` and `session.respond(id, value)` take no options: each makes its own idempotency key.
+  - The Runtime's Agent view names each required secret of the version it runs that has no value, as an attention item (`secret_unset: required secret ORDERS_TOKEN unset`, state `input_required`), until it is set.
+  - The compiler's refusal of an unresolved `extends` says to resolve it before uploading.
+
+- b3dad06: Compare two versions' agent folders, and set what a folder may hold per Tenant (track T7).
+
+  - **`GET /v1/agent-manifests/{name}/source/diff?from=<v>&to=<v>`** answers the files added, removed and changed (by SHA-256) from one version's source to another's, each list sorted by path, and how many stayed the same (`AgentManifestSourceDiff` in `@nylorun/core/contracts`). A version saved as JSON has no source (`404`); a `from` or `to` that is not a version number is `400`. `client.agentManifests.sourceDiff(name, from, to)` in `@nylorun/agents` calls it.
+  - **Folder limits are Tenant settings**: the Runtime limits `folderFiles` (2,000), `folderBytes` (50 MiB) and `folderTextFileBytes` (1 MiB), T6's fixed values, set with `PUT /v1/tenant/limits` like the others. A folder save with more files or bytes is `413 limit_exceeded` (`details.limit` names the limit), and the compiler holds each Markdown or JSON file to `folderTextFileBytes` (`422 folder_invalid`).
+  - `compileAgentFolder({ entries, files, name, limits })` takes the limits as an optional input (`AgentFolderLimits`); each left out is `AGENT_FOLDER_LIMITS`'.
+  - `@nylorun/agents` also exports the types `AgentManifestSource`, `AgentManifestSourceDiff`, `AgentManifestSourceSummary` and `AgentFolderDiagnostic`, and `AGENT_FOLDER_MEDIA_TYPE`.
+
+### Patch Changes
+
+- 498d972: `nylorun check --fix` makes the edits the compiler's diagnostics carry (track T7). A diagnostic one edit fixes has a `fix` (`AgentFolderFix`, in `AgentFolderDiagnostic` and the Runtime API's): `rename_key` for an unknown key with exactly one did-you-mean (in `AGENT.md`, a trigger, a `SKILL.md`, a tool file, `runtime.json`, `mcp.json`, `flow.json` and a JSON Schema's keywords), at its line and column, and none when two keys are as close or the key it would be is already there; `crlf` for a file with CRLF line ends, which is now a `crlf` note (it is read as LF, as before); and `move_skill_secrets` for `secrets` in a root skill's `SKILL.md`, when `AGENT.md` lists none for the skill, or lists them all. Messages, manifests and hashes are unchanged. `applyFolderFixes` in `@nylorun/core/folder` makes them on text: the key token renamed with every other byte kept, LF line ends, and the secrets moved to `AGENT.md`'s `skills` block as `migrate folder` writes it, skipping (with why) a fix whose text is no longer where it was.
+
+  `nylorun check` marks each fixable problem `(fixable with --fix)` and writes nothing. `check --fix` makes the edits in the folder's files, prints each change by file, and checks again until nothing is left to fix; it leaves a file whose bytes changed since it was checked (writing nothing when one changes while it fixes), and a `runtime.json` that `extends` another. `check --json` gives each diagnostic's `fix`, and with `--fix` each folder's `fixed` and `unfixed`.
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [498d972]
+- Updated dependencies [d23304e]
+- Updated dependencies [b3dad06]
+- Updated dependencies [b3dad06]
+- Updated dependencies [b3dad06]
+- Updated dependencies [498d972]
+- Updated dependencies [b3dad06]
+- Updated dependencies
+  - @nylorun/core@0.28.0-beta
+  - @nylorun/harness@0.29.4-beta
+
+## 0.31.0-beta
+
+### Minor Changes
+
+- aaa079f: The Runtime saves agent folders (track T6). `PUT /v1/agent-manifests/{name}` with `Content-Type: application/vnd.nylorun.folder+json` takes a folder by hash (`PutAgentFolderRequestSchema`): the files uploaded first, the Markdown and JSON read back from the definition file store and compiled with `compileAgentFolder`. A folder that does not compile is `422 folder_invalid`, with the compiler's diagnostics by file, line and column in `details.diagnostics`. A save keeps the folder as the version's source: `AgentManifestView.source` summarises it, `GET /v1/agent-manifests/{name}/versions/{v}/source` lists its files and `.../source/files/{path}` returns one. With `?dryRun=true` the plan adds the compiled `manifest`, the `diagnostics` and the `compiler`. A folder whose manifest is unchanged saves no version, and says so (`source_not_saved`). New Host feature `agent-folders`; new error code `folder_invalid`.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [9ba6634]
+- Updated dependencies [aaa079f]
+- Updated dependencies
+  - @nylorun/core@0.27.0-beta
+  - @nylorun/harness@0.29.3-beta
+
 ## 0.30.0-beta
 
 ### Minor Changes

package/dist/api/components.d.ts

@@ -21,6 +21,7 @@ export declare const Rejected: z.ZodObject<{
         credential_rejected: "credential_rejected";
         credential_required: "credential_required";
         definition_files_missing: "definition_files_missing";
+        folder_invalid: "folder_invalid";
         harness_mismatch: "harness_mismatch";
         host_rejected: "host_rejected";
         incompatible_host: "incompatible_host";
@@ -517,6 +518,56 @@ export declare const PutAgentManifestRequest: z.ZodObject<{
     }, z.core.$strict>>;
     requestId: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
+export declare const PutAgentFolderRequest: z.ZodObject<{
+    requestId: z.ZodOptional<z.ZodString>;
+    format: z.ZodLiteral<"nylorun.folder.v2">;
+    entries: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        size: z.ZodNumber;
+        sha256: z.ZodString;
+        contentType: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const AgentManifestSource: z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodNumber;
+    compiler: z.ZodString;
+    files: z.ZodNumber;
+    bytes: z.ZodNumber;
+    entries: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        size: z.ZodNumber;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const AgentManifestSourceDiff: z.ZodObject<{
+    name: z.ZodString;
+    from: z.ZodNumber;
+    to: z.ZodNumber;
+    added: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        size: z.ZodNumber;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+    removed: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        size: z.ZodNumber;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+    changed: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        from: z.ZodObject<{
+            size: z.ZodNumber;
+            sha256: z.ZodString;
+        }, z.core.$strict>;
+        to: z.ZodObject<{
+            size: z.ZodNumber;
+            sha256: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    unchanged: z.ZodNumber;
+}, z.core.$strict>;
 export declare const AgentManifestView: z.ZodObject<{
     name: z.ZodString;
     version: z.ZodNumber;
@@ -622,6 +673,11 @@ export declare const AgentManifestView: z.ZodObject<{
     }, z.core.$strict>;
     createdAt: z.ZodString;
     agents: z.ZodNumber;
+    source: z.ZodOptional<z.ZodObject<{
+        compiler: z.ZodString;
+        files: z.ZodNumber;
+        bytes: z.ZodNumber;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export declare const AgentManifestPlan: z.ZodObject<{
     name: z.ZodString;
@@ -654,6 +710,133 @@ export declare const AgentManifestPlan: z.ZodObject<{
         nextStart: z.ZodNumber;
         secrets: z.ZodNumber;
     }, z.core.$strict>;
+    manifest: z.ZodOptional<z.ZodObject<{
+        manifestSchemaVersion: z.ZodLiteral<8>;
+        name: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+        description: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodType<import("@nylorun/core/define").JsonObject, unknown, z.core.$ZodTypeInternals<import("@nylorun/core/define").JsonObject, unknown>>>;
+        harness: z.ZodUnion<readonly [z.ZodType<import("@nylorun/core/contracts").WorkflowHarnessSection, unknown, z.core.$ZodTypeInternals<import("@nylorun/core/contracts").WorkflowHarnessSection, unknown>>, z.ZodType<import("@nylorun/core/contracts").AgentHarnessSection, unknown, z.core.$ZodTypeInternals<import("@nylorun/core/contracts").AgentHarnessSection, unknown>>]>;
+        runtime: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<{
+                none: "none";
+                pod: "pod";
+                virtual: "virtual";
+            }>;
+            image: z.ZodOptional<z.ZodString>;
+            resources: z.ZodOptional<z.ZodObject<{
+                cpus: z.ZodOptional<z.ZodNumber>;
+                memory: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            storage: z.ZodOptional<z.ZodString>;
+            network: z.ZodOptional<z.ZodObject<{
+                allowedHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            lifecycle: z.ZodOptional<z.ZodObject<{
+                idle: z.ZodOptional<z.ZodString>;
+                deleteAfter: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            setup: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                command: z.ZodString;
+                cwd: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>>;
+            files: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                artifactId: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+                version: z.ZodNumber;
+                path: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                path: z.ZodString;
+                files: z.ZodRecord<z.ZodString, z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>;
+            }, z.core.$strict>]>>>;
+            limits: z.ZodOptional<z.ZodObject<{
+                artifacts: z.ZodOptional<z.ZodObject<{
+                    fileBytes: z.ZodOptional<z.ZodNumber>;
+                    totalBytes: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
+                skills: z.ZodOptional<z.ZodObject<{
+                    totalBytes: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
+                disk: z.ZodOptional<z.ZodObject<{
+                    versionBytes: z.ZodOptional<z.ZodNumber>;
+                    versionEntries: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+            secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                required: z.ZodOptional<z.ZodBoolean>;
+                description: z.ZodOptional<z.ZodString>;
+                type: z.ZodLiteral<"environment_secret">;
+                allowedHosts: z.ZodArray<z.ZodString>;
+                inject: z.ZodOptional<z.ZodObject<{
+                    header: z.ZodString;
+                    format: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>, z.ZodObject<{
+                required: z.ZodOptional<z.ZodBoolean>;
+                description: z.ZodOptional<z.ZodString>;
+                type: z.ZodLiteral<"environment_variable">;
+            }, z.core.$strict>, z.ZodObject<{
+                via: z.ZodOptional<z.ZodString>;
+                identity: z.ZodOptional<z.ZodObject<{
+                    header: z.ZodString;
+                }, z.core.$strict>>;
+                required: z.ZodOptional<z.ZodBoolean>;
+                description: z.ZodOptional<z.ZodString>;
+                type: z.ZodLiteral<"bearer">;
+                url: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                via: z.ZodOptional<z.ZodString>;
+                identity: z.ZodOptional<z.ZodObject<{
+                    header: z.ZodString;
+                }, z.core.$strict>>;
+                required: z.ZodOptional<z.ZodBoolean>;
+                description: z.ZodOptional<z.ZodString>;
+                type: z.ZodLiteral<"headers">;
+                url: z.ZodString;
+            }, z.core.$strict>], "type">>>;
+            triggers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                schedule: z.ZodOptional<z.ZodString>;
+                timezone: z.ZodOptional<z.ZodString>;
+                at: z.ZodOptional<z.ZodISODateTime>;
+                webhook: z.ZodOptional<z.ZodEnum<{
+                    "standard-webhooks": "standard-webhooks";
+                }>>;
+                session: z.ZodString;
+                prompt: z.ZodString;
+            }, z.core.$strict>>>;
+            selfWake: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    diagnostics: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        severity: z.ZodEnum<{
+            error: "error";
+            info: "info";
+            note: "note";
+            warning: "warning";
+        }>;
+        code: z.ZodString;
+        message: z.ZodString;
+        file: z.ZodOptional<z.ZodString>;
+        line: z.ZodOptional<z.ZodNumber>;
+        column: z.ZodOptional<z.ZodNumber>;
+        pointer: z.ZodOptional<z.ZodString>;
+        fix: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"rename_key">;
+            file: z.ZodString;
+            line: z.ZodNumber;
+            column: z.ZodNumber;
+            from: z.ZodString;
+            to: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"crlf">;
+            file: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"move_skill_secrets">;
+            file: z.ZodString;
+            skill: z.ZodString;
+            secrets: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>], "kind">>;
+    }, z.core.$strict>>>;
+    compiler: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const SaveAgentManifestResponse: z.ZodObject<{
     manifest: z.ZodObject<{
@@ -761,12 +944,47 @@ export declare const SaveAgentManifestResponse: z.ZodObject<{
         }, z.core.$strict>;
         createdAt: z.ZodString;
         agents: z.ZodNumber;
+        source: z.ZodOptional<z.ZodObject<{
+            compiler: z.ZodString;
+            files: z.ZodNumber;
+            bytes: z.ZodNumber;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
     unchanged: z.ZodBoolean;
     warnings: z.ZodArray<z.ZodObject<{
         code: z.ZodString;
         message: z.ZodString;
     }, z.core.$strict>>;
+    diagnostics: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        severity: z.ZodEnum<{
+            error: "error";
+            info: "info";
+            note: "note";
+            warning: "warning";
+        }>;
+        code: z.ZodString;
+        message: z.ZodString;
+        file: z.ZodOptional<z.ZodString>;
+        line: z.ZodOptional<z.ZodNumber>;
+        column: z.ZodOptional<z.ZodNumber>;
+        pointer: z.ZodOptional<z.ZodString>;
+        fix: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"rename_key">;
+            file: z.ZodString;
+            line: z.ZodNumber;
+            column: z.ZodNumber;
+            from: z.ZodString;
+            to: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"crlf">;
+            file: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"move_skill_secrets">;
+            file: z.ZodString;
+            skill: z.ZodString;
+            secrets: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>], "kind">>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export declare const ListAgentManifestsResponse: z.ZodObject<{
     manifests: z.ZodArray<z.ZodObject<{
@@ -874,6 +1092,11 @@ export declare const ListAgentManifestsResponse: z.ZodObject<{
         }, z.core.$strict>;
         createdAt: z.ZodString;
         agents: z.ZodNumber;
+        source: z.ZodOptional<z.ZodObject<{
+            compiler: z.ZodString;
+            files: z.ZodNumber;
+            bytes: z.ZodNumber;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export declare const AgentManifestVersions: z.ZodObject<{
@@ -1753,6 +1976,9 @@ export declare const PutTenantLimitsRequest: z.ZodObject<{
         flowConcurrency: z.ZodOptional<z.ZodNumber>;
         flowMapItems: z.ZodOptional<z.ZodNumber>;
         flowLoopIterations: z.ZodOptional<z.ZodNumber>;
+        folderFiles: z.ZodOptional<z.ZodNumber>;
+        folderBytes: z.ZodOptional<z.ZodNumber>;
+        folderTextFileBytes: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
     requestId: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
@@ -1828,6 +2054,9 @@ export declare const TenantLimitsView: z.ZodObject<{
         flowConcurrency: z.ZodNumber;
         flowMapItems: z.ZodNumber;
         flowLoopIterations: z.ZodNumber;
+        folderFiles: z.ZodNumber;
+        folderBytes: z.ZodNumber;
+        folderTextFileBytes: z.ZodNumber;
     }, z.core.$strict>;
 }, z.core.$strict>;
 export declare const ArtifactTree: z.ZodObject<{

package/dist/api/components.js

@@ -5,7 +5,7 @@
  * global registry.
  */
 import { z } from "zod";
-import { QueuedResponseSchema, TriggerListSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+import { QueuedResponseSchema, TriggerListSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentFolderRequestSchema, AgentManifestSourceSchema, AgentManifestSourceDiffSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
 function named(id, schema) {
     return schema.meta({ id });
 }
@@ -21,6 +21,9 @@ export const AgentView = named("AgentView", AgentViewSchema);
 export const EnvironmentSecretSlots = named("EnvironmentSecretSlots", EnvironmentSecretSlotsSchema);
 export const AgentManifest = named("AgentManifest", AgentManifestV8Schema);
 export const PutAgentManifestRequest = named("PutAgentManifestRequest", PutAgentManifestRequestSchema);
+export const PutAgentFolderRequest = named("PutAgentFolderRequest", PutAgentFolderRequestSchema);
+export const AgentManifestSource = named("AgentManifestSource", AgentManifestSourceSchema);
+export const AgentManifestSourceDiff = named("AgentManifestSourceDiff", AgentManifestSourceDiffSchema);
 export const AgentManifestView = named("AgentManifestView", AgentManifestViewSchema);
 export const AgentManifestPlan = named("AgentManifestPlan", AgentManifestPlanSchema);
 export const SaveAgentManifestResponse = named("SaveAgentManifestResponse", SaveAgentManifestResponseSchema);

package/dist/api/http/routes/agent-manifests.d.ts

@@ -3,7 +3,9 @@
  * versioned documents Agents are made from, each with a harness and a runtime section. A save
  * moves every Agent that tracks the manifest to the new version; a pinned one stays. Reading needs `agents:read` (or a write scope), saving and deleting
  * `agent-manifests:write`, from any client (Q12). A token caller reaches none: a manifest holds
- * an agent's instructions, tools and servers.
+ * an agent's instructions, tools and servers. A save may send an agent folder by hash instead of
+ * the manifest (track T6): the Runtime compiles it and keeps it as the version's source, and
+ * `source/diff` compares two versions' sources (track T7).
  */
 import type { OpenAPIHono } from "@hono/zod-openapi";
 import type { TenantEnv } from "../app.js";

package/dist/api/http/routes/agent-manifests.js

@@ -1,9 +1,9 @@
 import { z } from "zod";
-import { isAgentManifestName, PutAgentManifestRequestSchema } from "@nylorun/core/contracts";
-import { AgentManifestPlan, AgentManifestVersions, AgentManifestView, DeleteAgentManifestResponse, ListAgentManifestsResponse, PutAgentManifestRequest, SaveAgentManifestResponse, } from "../../components.js";
+import { AGENT_FOLDER_MEDIA_TYPE, contentTypeFor, isAgentManifestName, PutAgentFolderRequestSchema, PutAgentManifestRequestSchema, } from "@nylorun/core/contracts";
+import { AgentManifestPlan, AgentManifestSource, AgentManifestSourceDiff, AgentManifestVersions, AgentManifestView, DeleteAgentManifestResponse, ListAgentManifestsResponse, PutAgentFolderRequest, PutAgentManifestRequest, SaveAgentManifestResponse, } from "../../components.js";
 import { requirePrincipal } from "../../../tenant/auth.js";
 import { fail } from "../../../tenant/http.js";
-import { agentManifestVersions, deleteAgentManifest, getAgentManifest, listAgentManifests, saveAgentManifest, } from "../../../tenant/agent-manifests.js";
+import { agentManifestVersions, deleteAgentManifest, diffAgentManifestSources, getAgentManifest, getAgentManifestSource, listAgentManifests, readAgentManifestSourceFile, saveAgentFolder, saveAgentManifest, } from "../../../tenant/agent-manifests.js";
 import { readJson } from "../body.js";
 import { tenantRoute } from "../define.js";
 import { jsonResponse } from "../respond.js";
@@ -59,13 +59,19 @@ export function agentManifestRoutes(api) {
         path: "/v1/agent-manifests/{name}",
         tags: ["Agent manifests"],
         summary: "Save an agent manifest",
-        description: "Saves the manifest as its next version, or answers the latest unchanged when nothing differs. Every Agent that tracks the manifest moves to the new version: at once, at its pod's next start for a runtime change a pod applies only when it starts, or once a required secret the version adds is set; a pinned one stays, and so does one whose kind, harness or storage the version changes (`agents_behind`). The Runtime checks the harness and runtime sections against each other: a custom harness needs a pod with an image, every credential the harness names is a declared slot of the right type, and the runtime's kind gives the loop the sandbox it needs; every gap is named in one `422 manifest_inconsistent` (`details.gaps`). `If-Match: <version>` refuses the save with `412 manifest_changed` when the latest version is no longer the one you read (`0` for a manifest that does not exist yet). With `?dryRun=true` the answer is the plan: the changes by section, every reason a save would be refused (`errors`, the gaps first), warnings, the Agents it would move (`moves`) and how many stay on older versions (`behind`); nothing is saved. Clients compose the authoring files and drop their `$schema` before they send one document.",
+        description: "Saves the manifest as its next version, or answers the latest unchanged when nothing differs. Every Agent that tracks the manifest moves to the new version: at once, at its pod's next start for a runtime change a pod applies only when it starts, or once a required secret the version adds is set; a pinned one stays, and so does one whose kind, harness or storage the version changes (`agents_behind`). The Runtime checks the harness and runtime sections against each other: a custom harness needs a pod with an image, every credential the harness names is a declared slot of the right type, and the runtime's kind gives the loop the sandbox it needs; every gap is named in one `422 manifest_inconsistent` (`details.gaps`). `If-Match: <version>` refuses the save with `412 manifest_changed` when the latest version is no longer the one you read (`0` for a manifest that does not exist yet). With `?dryRun=true` the answer is the plan: the changes by section, every reason a save would be refused (`errors`, the gaps first), warnings, the Agents it would move (`moves`) and how many stay on older versions (`behind`); nothing is saved. Clients compose the authoring files and drop their `$schema` before they send one document. With `Content-Type: application/vnd.nylorun.folder+json` the body is an agent folder by hash instead (feature `agent-folders`): every file uploaded first with `PUT /v1/files/sha256:<hex>`, the Runtime compiles it with `@nylorun/core/folder`, a folder that does not compile is `422 folder_invalid` (`details.diagnostics`, each with its file, line and column), and the version keeps the folder as its source; the plan adds the compiled `manifest`, the compiler's `diagnostics` and `compiler`.",
         request: {
             params: namePath,
             query: z.object({
                 dryRun: z.enum(["true", "false"]).optional().meta({ description: "`true`: answer the plan and save nothing" }),
             }),
-            body: { required: true, content: { "application/json": { schema: PutAgentManifestRequest } } },
+            body: {
+                required: true,
+                content: {
+                    "application/json": { schema: PutAgentManifestRequest },
+                    [AGENT_FOLDER_MEDIA_TYPE]: { schema: PutAgentFolderRequest },
+                },
+            },
         },
         responses: {
             200: json(z.union([SaveAgentManifestResponse, AgentManifestPlan]), "The version saved, or the plan with dryRun"),
@@ -74,16 +80,23 @@ export function agentManifestRoutes(api) {
             },
             412: { description: "If-Match named a version that is no longer the latest (`manifest_changed`)" },
             413: { description: "A skill's files hold more than the manifest's skill limit together (`limit_exceeded`)" },
-            422: { description: "The harness and runtime sections do not fit (`manifest_inconsistent`, `details.gaps`)" },
+            422: {
+                description: "The harness and runtime sections do not fit (`manifest_inconsistent`, `details.gaps`), or an agent folder does not compile (`folder_invalid`, `details.diagnostics`)",
+            },
         },
     }, async (c) => {
         const name = nameOf(c.req.param("name"));
-        const body = PutAgentManifestRequestSchema.parse(await readJson(c));
         const ifMatch = ifMatchOf(c.req.header("if-match"));
-        const options = ifMatch === undefined ? {} : { ifMatch };
-        return jsonResponse(200, c.req.query("dryRun") === "true"
+        const options = { ...(ifMatch === undefined ? {} : { ifMatch }), ...(c.req.query("dryRun") === "true" ? { dryRun: true } : {}) };
+        const media = (c.req.header("content-type") ?? "").split(";")[0].trim().toLowerCase();
+        if (media === AGENT_FOLDER_MEDIA_TYPE) {
+            const folder = PutAgentFolderRequestSchema.parse(await readJson(c));
+            return jsonResponse(200, await saveAgentFolder(c.env.tenant, name, folder, c.get("scope"), options));
+        }
+        const body = PutAgentManifestRequestSchema.parse(await readJson(c));
+        return jsonResponse(200, options.dryRun
             ? await saveAgentManifest(c.env.tenant, name, body, c.get("scope"), { ...options, dryRun: true })
-            : await saveAgentManifest(c.env.tenant, name, body, c.get("scope"), options));
+            : await saveAgentManifest(c.env.tenant, name, body, c.get("scope"), { ...options, dryRun: false }));
     });
     tenantRoute(api, READ, {
         method: "get",
@@ -120,6 +133,72 @@ export function agentManifestRoutes(api) {
         requirePrincipal(c.get("scope"));
         return jsonResponse(200, await getAgentManifest(c.env.tenant, nameOf(c.req.param("name")), versionOf(c.req.param("version"))));
     });
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/agent-manifests/{name}/versions/{version}/source",
+        tags: ["Agent manifests"],
+        summary: "Get the folder a version was compiled from",
+        description: "The agent folder the version was saved from (feature `agent-folders`): its compiler, size and every file, sorted by path. A version saved as JSON has none (`404`).",
+        request: { params: namePath.extend({ version: z.string().meta({ description: "The version number" }) }) },
+        responses: { 200: json(AgentManifestSource, "The folder") },
+    }, async (c) => {
+        requirePrincipal(c.get("scope"));
+        return jsonResponse(200, await getAgentManifestSource(c.env.tenant, nameOf(c.req.param("name")), versionOf(c.req.param("version"))));
+    });
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/agent-manifests/{name}/versions/{version}/source/files/{path}",
+        tags: ["Agent manifests"],
+        summary: "Download one file of a version's folder",
+        description: "Streams the file at `path` (its path in the folder, with `/` percent-encoded as `%2F`) as it was saved.",
+        request: {
+            params: namePath.extend({
+                version: z.string().meta({ description: "The version number" }),
+                path: z.string().meta({ description: "The file's path in the folder, percent-encoded" }),
+            }),
+        },
+        responses: {
+            200: {
+                description: "The file's bytes",
+                content: { "application/octet-stream": { schema: z.string().meta({ format: "binary" }) } },
+            },
+        },
+    }, async (c) => {
+        requirePrincipal(c.get("scope"));
+        const path = c.req.param("path");
+        const file = await readAgentManifestSourceFile(c.env.tenant, nameOf(c.req.param("name")), versionOf(c.req.param("version")), path);
+        return new Response(file.body, {
+            status: 200,
+            headers: { "content-type": contentTypeFor(path), "content-length": String(file.size) },
+        });
+    });
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/agent-manifests/{name}/source/diff",
+        tags: ["Agent manifests"],
+        summary: "Compare two versions' folders",
+        description: "The files added, removed and changed from version `from`'s source to version `to`'s, by path, a file changed when its SHA-256 differs (feature `agent-folders`). Each list is sorted by path. A version saved as JSON has no source (`404`).",
+        request: {
+            params: namePath,
+            query: z.object({
+                from: z.string().meta({ description: "The version to compare from" }),
+                to: z.string().meta({ description: "The version to compare to" }),
+            }),
+        },
+        responses: {
+            200: json(AgentManifestSourceDiff, "What changed"),
+            400: { description: "`from` or `to` is not a version number" },
+            404: { description: "No such version, or one was saved as JSON and has no source" },
+        },
+    }, async (c) => {
+        requirePrincipal(c.get("scope"));
+        const name = nameOf(c.req.param("name"));
+        const from = Number(c.req.query("from"));
+        const to = Number(c.req.query("to"));
+        if (!Number.isInteger(from) || from < 1 || !Number.isInteger(to) || to < 1)
+            fail(400, "from and to are the versions to compare: positive integers");
+        return jsonResponse(200, await diffAgentManifestSources(c.env.tenant, name, from, to));
+    });
     tenantRoute(api, WRITE, {
         method: "delete",
         path: "/v1/agent-manifests/{name}",

package/dist/api/openapi.js

@@ -119,6 +119,9 @@ const RUNTIME_TAGS = [
             "GET /v1/agent-manifests/{name}",
             "GET /v1/agent-manifests/{name}/versions",
             "GET /v1/agent-manifests/{name}/versions/{version}",
+            "GET /v1/agent-manifests/{name}/versions/{version}/source",
+            "GET /v1/agent-manifests/{name}/versions/{version}/source/files/{path}",
+            "GET /v1/agent-manifests/{name}/source/diff",
             "DELETE /v1/agent-manifests/{name}",
         ],
     },

package/dist/host/http.js

@@ -1,6 +1,7 @@
 import { createHash, timingSafeEqual } from "node:crypto";
 import { jsonResponse } from "../api/http/respond.js";
 import { HOST_PROTOCOL, } from "@nylorun/core/compatibility";
+import { AGENT_FOLDER_MEDIA_TYPE } from "@nylorun/core/contracts";
 export const OPAQUE_NOT_FOUND = {
     status: "rejected",
     code: "not_found",
@@ -113,7 +114,8 @@ export function isJsonContentType(value) {
     if (value === undefined)
         return false;
     const media = value.split(";")[0].trim().toLowerCase();
-    return media === "application/json";
+    // An agent folder by hash (track T6) is JSON too.
+    return media === "application/json" || media === AGENT_FOLDER_MEDIA_TYPE;
 }
 /** True when the request carries a body (Content-Length > 0 or chunked). */
 export function requestHasBody(request) {