@nylorun/runtime 0.31.0-beta → 0.33.0-beta

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # Changelog
 
+## 0.33.0-beta
+
+### Minor Changes
+
+- 95f98f1: A model can use the Host's own identity (ADR-71, Host feature `model-host-identity`). `PUT /v1/tenant/model` takes `auth: { type: "host_identity", project, location }` for `google-vertex`. It keeps no secret, and the model gate calls Agent Platform with the Host's Google Application Default Credentials: on Google Cloud, the attached service account from the metadata server. It's off unless the operator lists the provider in `NYLORUN_MODEL_HOST_IDENTITY` on the process that runs the gates, which `nylorun start` passes from its shell to the `gateway` container. Every Tenant on that Host may use it. `nylorun tenant models set --provider google-vertex --model <id> --host-identity --project <id> --location <location>` sets it with no key.
+- d99b3ac: A session can have its own model (optional Host feature `session-model`). `PUT /v1/sessions/{id}/model` chooses one of a connected provider's models for that session's turns, `DELETE` clears it, and `GET` answers the model the next turn uses (`source: "session"` or `"tenant"`). The Tenant's model and every other session's stay as they are. The Model Gate calls the session's model on its provider's credential (a refreshed OAuth credential is written back to that provider), `turn.start.model` describes it, and the usage ledger records it. A choice names a connected provider and a model its catalog lists, is set by the application only (a trusted issuer's token can read it, not change it), and is refused while a turn runs or waits (`409 session_busy`); while its provider is disconnected the session uses the Tenant's model. The SDK adds `session.model()`, `setModel({ provider, model })` and `clearModel()`.
+
+  Studio's model picker under the message box now sets the model of that session only, instead of the Tenant's: "Tenant model" clears the session's choice, the picker is locked while a turn runs, it groups models by provider, and its search keeps what is typed. A Runtime without `session-model` shows no picker.
+
+### Patch Changes
+
+- 683de1a: The model catalog comes from pi-ai 1.3.0, which adds Gemini 4 Argon: `google-vertex/gemini-4-argon` on Google's Agent Platform (Vertex AI) and `google/gemini-4-argon` on the Gemini API, with a 1,048,576-token context and thinking. `nylorun tenant models set --provider google-vertex --model gemini-4-argon` takes a Google Cloud API key for the Agent Platform API; the Runtime still reads no ambient Google credentials.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [95f98f1]
+- Updated dependencies [d99b3ac]
+- Updated dependencies
+  - @nylorun/core@0.29.0-beta
+  - @nylorun/harness@0.29.5-beta
+
+## 0.32.0-beta
+
+### Minor Changes
+
+- b3dad06: Both ends of the agent folder loop (track T7).
+
+  - `nylorun init <path>` names the agent after the path's last segment (`init agents/hello`). `--example` adds `tools/get_order.json`, `mcp.json` (a `Bearer ${ORDERS_MCP_TOKEN}` header) and `triggers/new-order.md`, explained in the folder's README.md, and the result passes `nylorun check`. The first run in a project (the nearest directory with `.git`) writes `.gitattributes` (`* text=auto eol=lf`), ignores `.nylorun/credentials.json` in `.gitignore`, and maps the folder files to their JSON Schemas in `.vscode/settings.json`, merged into an existing file. Its hint names `apply --agent` and `chat`.
+  - `nylorun apply --agent [<id>]` makes the Agent from the manifest after a save (or on an unchanged one), or moves it, as `nylorun agents put` does, and prints what it needs a person for.
+  - `nylorun apply --watch [--save]` checks and plans again on each change to the folders (and the files their `runtime.json` extends); it saves only with `--save`.
+  - A plan's change to the instructions prints their text diff, `-` and `+` lines.
+  - `nylorun chat <agent> [--session <id>] [--message <text>]` opens or reuses a session, sends `--message` or each line of standard input, and prints the reply as it comes.
+  - `nylorun check --json` prints `{ folders: [{ path, ok, manifest?, diagnostics }] }` for CI, with the same exit codes. `check` says "1 file", and `nylorun --version` prints the version.
+  - `packFolder` (`@nylorun/agents`) leaves out what the folder's `.nyloignore` names (gitignore rules), and resolves `extends` in `runtime.json`: the packed file is the merge, the folder's own keys winning, with `.nylorun/origin.json` naming the files it came from; a missing file or a cycle is a `FolderError`. `ignoreMatcher` is exported.
+  - `session.approve(id, approved)` and `session.respond(id, value)` take no options: each makes its own idempotency key.
+  - The Runtime's Agent view names each required secret of the version it runs that has no value, as an attention item (`secret_unset: required secret ORDERS_TOKEN unset`, state `input_required`), until it is set.
+  - The compiler's refusal of an unresolved `extends` says to resolve it before uploading.
+
+- b3dad06: Compare two versions' agent folders, and set what a folder may hold per Tenant (track T7).
+
+  - **`GET /v1/agent-manifests/{name}/source/diff?from=<v>&to=<v>`** answers the files added, removed and changed (by SHA-256) from one version's source to another's, each list sorted by path, and how many stayed the same (`AgentManifestSourceDiff` in `@nylorun/core/contracts`). A version saved as JSON has no source (`404`); a `from` or `to` that is not a version number is `400`. `client.agentManifests.sourceDiff(name, from, to)` in `@nylorun/agents` calls it.
+  - **Folder limits are Tenant settings**: the Runtime limits `folderFiles` (2,000), `folderBytes` (50 MiB) and `folderTextFileBytes` (1 MiB), T6's fixed values, set with `PUT /v1/tenant/limits` like the others. A folder save with more files or bytes is `413 limit_exceeded` (`details.limit` names the limit), and the compiler holds each Markdown or JSON file to `folderTextFileBytes` (`422 folder_invalid`).
+  - `compileAgentFolder({ entries, files, name, limits })` takes the limits as an optional input (`AgentFolderLimits`); each left out is `AGENT_FOLDER_LIMITS`'.
+  - `@nylorun/agents` also exports the types `AgentManifestSource`, `AgentManifestSourceDiff`, `AgentManifestSourceSummary` and `AgentFolderDiagnostic`, and `AGENT_FOLDER_MEDIA_TYPE`.
+
+### Patch Changes
+
+- 498d972: `nylorun check --fix` makes the edits the compiler's diagnostics carry (track T7). A diagnostic one edit fixes has a `fix` (`AgentFolderFix`, in `AgentFolderDiagnostic` and the Runtime API's): `rename_key` for an unknown key with exactly one did-you-mean (in `AGENT.md`, a trigger, a `SKILL.md`, a tool file, `runtime.json`, `mcp.json`, `flow.json` and a JSON Schema's keywords), at its line and column, and none when two keys are as close or the key it would be is already there; `crlf` for a file with CRLF line ends, which is now a `crlf` note (it is read as LF, as before); and `move_skill_secrets` for `secrets` in a root skill's `SKILL.md`, when `AGENT.md` lists none for the skill, or lists them all. Messages, manifests and hashes are unchanged. `applyFolderFixes` in `@nylorun/core/folder` makes them on text: the key token renamed with every other byte kept, LF line ends, and the secrets moved to `AGENT.md`'s `skills` block as `migrate folder` writes it, skipping (with why) a fix whose text is no longer where it was.
+
+  `nylorun check` marks each fixable problem `(fixable with --fix)` and writes nothing. `check --fix` makes the edits in the folder's files, prints each change by file, and checks again until nothing is left to fix; it leaves a file whose bytes changed since it was checked (writing nothing when one changes while it fixes), and a `runtime.json` that `extends` another. `check --json` gives each diagnostic's `fix`, and with `--fix` each folder's `fixed` and `unfixed`.
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [498d972]
+- Updated dependencies [d23304e]
+- Updated dependencies [b3dad06]
+- Updated dependencies [b3dad06]
+- Updated dependencies [b3dad06]
+- Updated dependencies [498d972]
+- Updated dependencies [b3dad06]
+- Updated dependencies
+  - @nylorun/core@0.28.0-beta
+  - @nylorun/harness@0.29.4-beta
+
 ## 0.31.0-beta
 
 ### Minor Changes

package/dist/api/components.d.ts

@@ -541,6 +541,33 @@ export declare const AgentManifestSource: z.ZodObject<{
         sha256: z.ZodString;
     }, z.core.$strict>>;
 }, z.core.$strict>;
+export declare const AgentManifestSourceDiff: z.ZodObject<{
+    name: z.ZodString;
+    from: z.ZodNumber;
+    to: z.ZodNumber;
+    added: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        size: z.ZodNumber;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+    removed: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        size: z.ZodNumber;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+    changed: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        from: z.ZodObject<{
+            size: z.ZodNumber;
+            sha256: z.ZodString;
+        }, z.core.$strict>;
+        to: z.ZodObject<{
+            size: z.ZodNumber;
+            sha256: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    unchanged: z.ZodNumber;
+}, z.core.$strict>;
 export declare const AgentManifestView: z.ZodObject<{
     name: z.ZodString;
     version: z.ZodNumber;
@@ -792,6 +819,22 @@ export declare const AgentManifestPlan: z.ZodObject<{
         line: z.ZodOptional<z.ZodNumber>;
         column: z.ZodOptional<z.ZodNumber>;
         pointer: z.ZodOptional<z.ZodString>;
+        fix: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"rename_key">;
+            file: z.ZodString;
+            line: z.ZodNumber;
+            column: z.ZodNumber;
+            from: z.ZodString;
+            to: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"crlf">;
+            file: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"move_skill_secrets">;
+            file: z.ZodString;
+            skill: z.ZodString;
+            secrets: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>], "kind">>;
     }, z.core.$strict>>>;
     compiler: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
@@ -925,6 +968,22 @@ export declare const SaveAgentManifestResponse: z.ZodObject<{
         line: z.ZodOptional<z.ZodNumber>;
         column: z.ZodOptional<z.ZodNumber>;
         pointer: z.ZodOptional<z.ZodString>;
+        fix: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"rename_key">;
+            file: z.ZodString;
+            line: z.ZodNumber;
+            column: z.ZodNumber;
+            from: z.ZodString;
+            to: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"crlf">;
+            file: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"move_skill_secrets">;
+            file: z.ZodString;
+            skill: z.ZodString;
+            secrets: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>], "kind">>;
     }, z.core.$strict>>>;
 }, z.core.$strict>;
 export declare const ListAgentManifestsResponse: z.ZodObject<{
@@ -1917,6 +1976,9 @@ export declare const PutTenantLimitsRequest: z.ZodObject<{
         flowConcurrency: z.ZodOptional<z.ZodNumber>;
         flowMapItems: z.ZodOptional<z.ZodNumber>;
         flowLoopIterations: z.ZodOptional<z.ZodNumber>;
+        folderFiles: z.ZodOptional<z.ZodNumber>;
+        folderBytes: z.ZodOptional<z.ZodNumber>;
+        folderTextFileBytes: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
     requestId: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
@@ -1992,6 +2054,9 @@ export declare const TenantLimitsView: z.ZodObject<{
         flowConcurrency: z.ZodNumber;
         flowMapItems: z.ZodNumber;
         flowLoopIterations: z.ZodNumber;
+        folderFiles: z.ZodNumber;
+        folderBytes: z.ZodNumber;
+        folderTextFileBytes: z.ZodNumber;
     }, z.core.$strict>;
 }, z.core.$strict>;
 export declare const ArtifactTree: z.ZodObject<{
@@ -2356,6 +2421,30 @@ export declare const SessionView: z.ZodObject<{
         error: z.ZodUnknown;
     }, z.core.$strict>>;
 }, z.core.$strict>;
+export declare const PutSessionModelRequest: z.ZodObject<{
+    provider: z.ZodString;
+    model: z.ZodString;
+}, z.core.$strict>;
+export declare const SessionModelView: z.ZodUnion<readonly [z.ZodObject<{
+    configured: z.ZodLiteral<false>;
+    choice: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodString;
+        model: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    configured: z.ZodLiteral<true>;
+    source: z.ZodEnum<{
+        session: "session";
+        tenant: "tenant";
+    }>;
+    provider: z.ZodString;
+    model: z.ZodString;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    choice: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodString;
+        model: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>]>;
 export declare const LiveEvent: z.ZodObject<{
     schema: z.ZodLiteral<"nylorun.event/2">;
     eventId: z.ZodString;
@@ -13392,6 +13481,7 @@ export declare const TenantStatus: z.ZodObject<{
         model: z.ZodString;
         authType: z.ZodEnum<{
             api_key: "api_key";
+            host_identity: "host_identity";
             oauth: "oauth";
             workload: "workload";
         }>;
@@ -13557,6 +13647,10 @@ export declare const SeedTenantConfigRequest: z.ZodObject<{
             expires: z.ZodNumber;
         }, z.core.$loose>, z.ZodObject<{
             type: z.ZodLiteral<"workload">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"host_identity">;
+            project: z.ZodString;
+            location: z.ZodString;
         }, z.core.$strict>], "type">;
     }, z.core.$strict>>;
     fixtureModel: z.ZodOptional<z.ZodLiteral<true>>;
@@ -13815,6 +13909,7 @@ export declare const ListProvidersResponse: z.ZodObject<{
         model: z.ZodString;
         authType: z.ZodEnum<{
             api_key: "api_key";
+            host_identity: "host_identity";
             oauth: "oauth";
             workload: "workload";
         }>;
@@ -13862,6 +13957,7 @@ export declare const HostModelView: z.ZodUnion<readonly [z.ZodObject<{
     model: z.ZodString;
     authType: z.ZodEnum<{
         api_key: "api_key";
+        host_identity: "host_identity";
         oauth: "oauth";
         workload: "workload";
     }>;
@@ -13930,6 +14026,10 @@ export declare const PutHostModelRequest: z.ZodObject<{
         expires: z.ZodNumber;
     }, z.core.$loose>, z.ZodObject<{
         type: z.ZodLiteral<"workload">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"host_identity">;
+        project: z.ZodString;
+        location: z.ZodString;
     }, z.core.$strict>], "type">;
 }, z.core.$strict>;
 export declare const SelectHostModelRequest: z.ZodObject<{

package/dist/api/components.js

@@ -5,7 +5,7 @@
  * global registry.
  */
 import { z } from "zod";
-import { QueuedResponseSchema, TriggerListSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentFolderRequestSchema, AgentManifestSourceSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+import { PutSessionModelRequestSchema, SessionModelViewSchema, QueuedResponseSchema, TriggerListSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentFolderRequestSchema, AgentManifestSourceSchema, AgentManifestSourceDiffSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
 function named(id, schema) {
     return schema.meta({ id });
 }
@@ -23,6 +23,7 @@ export const AgentManifest = named("AgentManifest", AgentManifestV8Schema);
 export const PutAgentManifestRequest = named("PutAgentManifestRequest", PutAgentManifestRequestSchema);
 export const PutAgentFolderRequest = named("PutAgentFolderRequest", PutAgentFolderRequestSchema);
 export const AgentManifestSource = named("AgentManifestSource", AgentManifestSourceSchema);
+export const AgentManifestSourceDiff = named("AgentManifestSourceDiff", AgentManifestSourceDiffSchema);
 export const AgentManifestView = named("AgentManifestView", AgentManifestViewSchema);
 export const AgentManifestPlan = named("AgentManifestPlan", AgentManifestPlanSchema);
 export const SaveAgentManifestResponse = named("SaveAgentManifestResponse", SaveAgentManifestResponseSchema);
@@ -76,6 +77,8 @@ export const WebhookAcceptedResponse = named("WebhookAcceptedResponse", WebhookA
 export const ListSessionsResponse = named("ListSessionsResponse", ListSessionsResponseSchema);
 export const PutSessionRequest = named("PutSessionRequest", PutSessionRequestSchema);
 export const SessionView = named("SessionView", SessionViewSchema);
+export const PutSessionModelRequest = named("PutSessionModelRequest", PutSessionModelRequestSchema);
+export const SessionModelView = named("SessionModelView", SessionModelViewSchema);
 export const LiveEvent = named("LiveEvent", LiveEventSchema);
 /** `environment.state` → `EnvironmentStateEvent`. */
 export function eventComponentName(type) {

package/dist/api/http/routes/agent-manifests.d.ts

@@ -4,7 +4,8 @@
  * moves every Agent that tracks the manifest to the new version; a pinned one stays. Reading needs `agents:read` (or a write scope), saving and deleting
  * `agent-manifests:write`, from any client (Q12). A token caller reaches none: a manifest holds
  * an agent's instructions, tools and servers. A save may send an agent folder by hash instead of
- * the manifest (track T6): the Runtime compiles it and keeps it as the version's source.
+ * the manifest (track T6): the Runtime compiles it and keeps it as the version's source, and
+ * `source/diff` compares two versions' sources (track T7).
  */
 import type { OpenAPIHono } from "@hono/zod-openapi";
 import type { TenantEnv } from "../app.js";

package/dist/api/http/routes/agent-manifests.js

@@ -1,9 +1,9 @@
 import { z } from "zod";
 import { AGENT_FOLDER_MEDIA_TYPE, contentTypeFor, isAgentManifestName, PutAgentFolderRequestSchema, PutAgentManifestRequestSchema, } from "@nylorun/core/contracts";
-import { AgentManifestPlan, AgentManifestSource, AgentManifestVersions, AgentManifestView, DeleteAgentManifestResponse, ListAgentManifestsResponse, PutAgentFolderRequest, PutAgentManifestRequest, SaveAgentManifestResponse, } from "../../components.js";
+import { AgentManifestPlan, AgentManifestSource, AgentManifestSourceDiff, AgentManifestVersions, AgentManifestView, DeleteAgentManifestResponse, ListAgentManifestsResponse, PutAgentFolderRequest, PutAgentManifestRequest, SaveAgentManifestResponse, } from "../../components.js";
 import { requirePrincipal } from "../../../tenant/auth.js";
 import { fail } from "../../../tenant/http.js";
-import { agentManifestVersions, deleteAgentManifest, getAgentManifest, getAgentManifestSource, listAgentManifests, readAgentManifestSourceFile, saveAgentFolder, saveAgentManifest, } from "../../../tenant/agent-manifests.js";
+import { agentManifestVersions, deleteAgentManifest, diffAgentManifestSources, getAgentManifest, getAgentManifestSource, listAgentManifests, readAgentManifestSourceFile, saveAgentFolder, saveAgentManifest, } from "../../../tenant/agent-manifests.js";
 import { readJson } from "../body.js";
 import { tenantRoute } from "../define.js";
 import { jsonResponse } from "../respond.js";
@@ -172,6 +172,33 @@ export function agentManifestRoutes(api) {
             headers: { "content-type": contentTypeFor(path), "content-length": String(file.size) },
         });
     });
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/agent-manifests/{name}/source/diff",
+        tags: ["Agent manifests"],
+        summary: "Compare two versions' folders",
+        description: "The files added, removed and changed from version `from`'s source to version `to`'s, by path, a file changed when its SHA-256 differs (feature `agent-folders`). Each list is sorted by path. A version saved as JSON has no source (`404`).",
+        request: {
+            params: namePath,
+            query: z.object({
+                from: z.string().meta({ description: "The version to compare from" }),
+                to: z.string().meta({ description: "The version to compare to" }),
+            }),
+        },
+        responses: {
+            200: json(AgentManifestSourceDiff, "What changed"),
+            400: { description: "`from` or `to` is not a version number" },
+            404: { description: "No such version, or one was saved as JSON and has no source" },
+        },
+    }, async (c) => {
+        requirePrincipal(c.get("scope"));
+        const name = nameOf(c.req.param("name"));
+        const from = Number(c.req.query("from"));
+        const to = Number(c.req.query("to"));
+        if (!Number.isInteger(from) || from < 1 || !Number.isInteger(to) || to < 1)
+            fail(400, "from and to are the versions to compare: positive integers");
+        return jsonResponse(200, await diffAgentManifestSources(c.env.tenant, name, from, to));
+    });
     tenantRoute(api, WRITE, {
         method: "delete",
         path: "/v1/agent-manifests/{name}",

package/dist/api/http/routes/sessions.js

@@ -1,10 +1,10 @@
 import { RESPONSE_ALREADY_SENT } from "@hono/node-server/utils/response";
 import { z } from "zod";
 import { PROTOCOL_HEADER } from "@nylorun/core/compatibility";
-import { PutSessionRequestSchema, SessionCommandSchema, } from "@nylorun/core/contracts";
+import { PutSessionModelRequestSchema, PutSessionRequestSchema, SessionCommandSchema, } from "@nylorun/core/contracts";
 import { handleSessionSandboxTool, SandboxRouteError } from "../../../core/sandbox-routes.js";
 import { traceContextOf } from "../../../traces/ids.js";
-import { AcceptedResponse, QueuedResponse, ListSessionsResponse, SessionPage, HistoryPage, SessionEvent, PutSessionRequest, SandboxToolOutcome, SessionCommand, SessionItemsResponse, SessionView, StreamClosedFrame, } from "../../components.js";
+import { AcceptedResponse, QueuedResponse, ListSessionsResponse, SessionPage, HistoryPage, SessionEvent, PutSessionModelRequest, PutSessionRequest, SandboxToolOutcome, SessionCommand, SessionItemsResponse, SessionModelView, SessionView, StreamClosedFrame, } from "../../components.js";
 import { accessOf, requireApplication } from "../../../tenant/auth.js";
 import { command } from "../../../tenant/commands.js";
 import { loadSession, sessionOf } from "../../../tenant/context.js";
@@ -12,6 +12,7 @@ import { fail } from "../../../tenant/http.js";
 import { agentGrantsOf, sandboxRouteDeps } from "../../../tenant/agents.js";
 import { readHistory, requestCursor, streamHolderOf, streamSessionEvents } from "../../../tenant/session-streams.js";
 import { listSessions, putSession, sessionView } from "../../../tenant/sessions.js";
+import { chooseSessionModel, readSessionModel } from "../../../tenant/session-model.js";
 import { readJson } from "../body.js";
 import { TraceHeaders, tenantRoute } from "../define.js";
 import { pageQuery, pageSize, sessionPage, sessionPageQuery, parseQuery } from "./reads.js";
@@ -20,6 +21,18 @@ const OWN_SESSIONS = {
     credentials: ["application", "subject", "token"],
     scopes: ["sessions:own"],
 };
+/**
+ * A session's own model costs what its model costs: the application chooses it (for a subject
+ * too), never a token a person's browser holds.
+ */
+const APP_SESSIONS = {
+    credentials: ["application", "subject"],
+    scopes: ["sessions:own"],
+};
+function refuseToken(scope) {
+    if (scope.kind === "token")
+        fail(403, "A token caller cannot choose a session's model", { code: "scope_required" });
+}
 const json = (schema, description) => ({
     description,
     content: { "application/json": { schema } },
@@ -122,6 +135,54 @@ export function sessionRoutes(api) {
         const id = c.req.param("sessionId");
         return jsonResponse(200, await ctx.store.tx(async (t) => sessionView(t, await sessionOf(t, id, accessOf(scope)))));
     });
+    tenantRoute(api, OWN_SESSIONS, {
+        method: "get",
+        path: "/v1/sessions/{sessionId}/model",
+        tags: ["Sessions"],
+        summary: "Get a session's model",
+        description: "The model the session's next turn uses (feature `session-model`): its own (`source: \"session\"`) while its provider is connected, else the Tenant's (`source: \"tenant\"`). `choice` is the session's own model, kept while its provider is disconnected.",
+        request: { params: sessionId },
+        responses: { 200: json(SessionModelView, "The session's model") },
+    }, async (c) => {
+        const scope = c.get("scope");
+        return jsonResponse(200, await readSessionModel(c.env.tenant, c.req.param("sessionId"), accessOf(scope)));
+    });
+    tenantRoute(api, APP_SESSIONS, {
+        method: "put",
+        path: "/v1/sessions/{sessionId}/model",
+        tags: ["Sessions"],
+        summary: "Choose a session's model",
+        description: "Chooses one of a connected provider's models for the session's turns (feature `session-model`), in place of the Tenant's model. The Tenant's model and every other session's stay as they are. Only the application sets it, for itself or for a subject: a trusted issuer's token is refused. A turn calls one model, so the choice changes only while no turn runs or waits (`409 session_busy`). A provider that is not connected, or a model its catalog does not list, is `422 request_rejected`.",
+        request: { params: sessionId, body: body(PutSessionModelRequest) },
+        responses: {
+            200: json(SessionModelView, "The session's model"),
+            403: { description: "A trusted issuer's token (`scope_required`)" },
+            409: { description: "A turn is running or waits (`session_busy`)" },
+            422: { description: "The provider is not connected, or the model is not one of its models" },
+        },
+    }, async (c) => {
+        const scope = c.get("scope");
+        refuseToken(scope);
+        const choice = PutSessionModelRequestSchema.parse(await readJson(c));
+        return jsonResponse(200, await chooseSessionModel(c.env.tenant, c.req.param("sessionId"), choice, accessOf(scope)));
+    });
+    tenantRoute(api, APP_SESSIONS, {
+        method: "delete",
+        path: "/v1/sessions/{sessionId}/model",
+        tags: ["Sessions"],
+        summary: "Clear a session's model",
+        description: "Clears the session's own model (feature `session-model`): its next turns use the Tenant's model. Refused while a turn runs or waits (`409 session_busy`).",
+        request: { params: sessionId },
+        responses: {
+            200: json(SessionModelView, "The session's model"),
+            403: { description: "A trusted issuer's token (`scope_required`)" },
+            409: { description: "A turn is running or waits (`session_busy`)" },
+        },
+    }, async (c) => {
+        const scope = c.get("scope");
+        refuseToken(scope);
+        return jsonResponse(200, await chooseSessionModel(c.env.tenant, c.req.param("sessionId"), undefined, accessOf(scope)));
+    });
     tenantRoute(api, OWN_SESSIONS, {
         method: "get",
         path: "/v1/sessions/{sessionId}/items",

package/dist/api/openapi.js

@@ -121,6 +121,7 @@ const RUNTIME_TAGS = [
             "GET /v1/agent-manifests/{name}/versions/{version}",
             "GET /v1/agent-manifests/{name}/versions/{version}/source",
             "GET /v1/agent-manifests/{name}/versions/{version}/source/files/{path}",
+            "GET /v1/agent-manifests/{name}/source/diff",
             "DELETE /v1/agent-manifests/{name}",
         ],
     },
@@ -193,6 +194,9 @@ const RUNTIME_TAGS = [
             "GET /v1/sessions/{sessionId}/events",
             "GET /v1/sessions/{sessionId}/items",
             "GET /v1/sessions/{sessionId}/manifest",
+            "GET /v1/sessions/{sessionId}/model",
+            "PUT /v1/sessions/{sessionId}/model",
+            "DELETE /v1/sessions/{sessionId}/model",
             "GET /v1/sessions/{sessionId}/usage",
             "GET /v1/sessions/{sessionId}/calls/model",
             "GET /v1/sessions/{sessionId}/calls/tool",

package/dist/gates/handler.js

@@ -23,8 +23,8 @@ export function createModelCallHandler(options) {
                 request = call;
                 const gate = inProcessModelGate({
                     root: vault.root,
-                    readHostModel: () => vault.readHostModel(),
-                    writeHostCredential: (credential) => vault.writeHostCredential(credential),
+                    readHostModel: (request) => vault.readHostModel(request.sessionId),
+                    writeHostCredential: (credential, provider) => vault.writeHostCredential(credential, provider),
                     // The Tenant's Runtime limits `model*`, read for this call.
                     settings: await modelCallSettings(vault.store),
                     ...(blobs ? { files: callFiles(vault.store, blobs) } : {}),

package/dist/gates/in-process.d.ts

@@ -15,9 +15,10 @@ import type { ModelCaller } from "../model/call-headers.js";
 export interface InProcessModelGateOptions {
     /** The Tenant's home: `piModel` redacts secrets it finds there from failure messages. */
     readonly root?: string;
-    readonly readHostModel: () => Promise<HostModelSecret | undefined>;
-    /** Writes back a credential pi-ai refreshed (OAuth). */
-    readonly writeHostCredential: (credential: Credential) => Promise<void>;
+    /** The host model a call uses: its session's own model (`session-model`), else the Tenant's. */
+    readonly readHostModel: (request: ModelGateRequest) => Promise<HostModelSecret | undefined>;
+    /** Writes back a credential pi-ai refreshed (OAuth) to `provider`'s, the one the call read. */
+    readonly writeHostCredential: (credential: Credential, provider: string) => Promise<void>;
     readonly settings?: ModelCallSettings;
     /** Reads the files a call's prompt names (protocol 6): artifacts, for model-gate. */
     readonly files?: (request: ModelGateRequest) => FileResolver;

package/dist/gates/in-process.js

@@ -45,8 +45,8 @@ export function tenantModelGate(options) {
             // The Tenant's Runtime limits `model*`, read for this call.
             const gate = inProcessModelGate({
                 root: options.root,
-                readHostModel: () => vault.readHostModel(),
-                writeHostCredential: (credential) => vault.updateHostCredential(credential),
+                readHostModel: (request) => vault.readHostModel(request.sessionId),
+                writeHostCredential: (credential, provider) => vault.updateHostCredential(credential, provider),
                 settings: await modelCallSettings(options.store),
                 ...(options.blobs ? { files: callFiles(options.store, options.blobs) } : {}),
                 caller: callCaller(options.store),
@@ -71,11 +71,17 @@ export async function serve(store, gate, request, signal) {
 export function inProcessModelGate(options) {
     return {
         async call(request, signal) {
-            // One adapter per call, as before the gate: it reads the host model when invoked.
+            // One adapter per call, as before the gate: it reads the host model when invoked, and a
+            // refreshed credential goes back to the provider it read.
+            let provider;
             const adapter = piModel({
                 ...(options.root !== undefined ? { root: options.root } : {}),
-                readHostModel: options.readHostModel,
-                writeHostCredential: options.writeHostCredential,
+                readHostModel: async () => {
+                    const stored = await options.readHostModel(request);
+                    provider = stored?.provider;
+                    return stored;
+                },
+                writeHostCredential: (credential) => options.writeHostCredential(credential, provider),
                 ...(options.settings ? { settings: options.settings } : {}),
                 ...(options.files ? { files: options.files(request) } : {}),
                 ...(options.caller ? { caller: () => options.caller(request) } : {}),

package/dist/gates/tenant-vaults.d.ts

@@ -22,9 +22,10 @@ export interface TenantVault {
     readonly store: SessionStore;
     /** The Tenant's home: secrets found there are redacted from failure messages. */
     readonly root: string;
-    readHostModel(): Promise<HostModelSecret | undefined>;
-    /** Writes back a credential pi-ai refreshed (OAuth). */
-    writeHostCredential(credential: Credential): Promise<void>;
+    /** The host model a call uses: its session's own model (`session-model`), else the Tenant's. */
+    readHostModel(sessionId?: string): Promise<HostModelSecret | undefined>;
+    /** Writes back a credential pi-ai refreshed (OAuth) to `provider`'s, else the active one's. */
+    writeHostCredential(credential: Credential, provider?: string): Promise<void>;
     /** A session, for the remote MCP servers and HTTP tools its pinned manifest declares. */
     session(sessionId: string): Promise<Session | undefined>;
     /**

package/dist/gates/tenant-vaults.js

@@ -47,8 +47,8 @@ export function createTenantVaults(options) {
             tenantId,
             store,
             root: paths.home,
-            readHostModel: () => vault.readHostModel(),
-            writeHostCredential: (credential) => vault.updateHostCredential(credential),
+            readHostModel: (sessionId) => vault.readHostModel(sessionId),
+            writeHostCredential: (credential, provider) => vault.updateHostCredential(credential, provider),
             session,
             authorizeMcp: (sessionId, request) => authorizeSessionMcp(credentials, session, sessionId, request),
             keys: () => keys,

package/dist/harness-api/start.js

@@ -82,7 +82,7 @@ options = {}) {
     });
     // The model an agent's harness decides files by, read outside the session's transaction.
     const model = options.harness && !isWorkflowManifest(opened.current.manifest)
-        ? await currentModelDescriptor(ctx)
+        ? await currentModelDescriptor(ctx, opened.current.model)
         : undefined;
     const started = model ? { ...opened, model } : opened;
     // One history (P0.3): the engine resumes from the transcript folded from the record.

package/dist/host/main.js

@@ -65,6 +65,7 @@ import { startHarnessListener } from "../harness-api/ws-server.js";
 import { httpSandboxesClient } from "../sandbox/pods/client.js";
 import { retry } from "../retry.js";
 import { hostTuning, useHostTuning } from "../tuning.js";
+import { useHostIdentity } from "../vault/host-identity.js";
 import { useWorkloadToken } from "../vault/workload-token.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
@@ -220,6 +221,7 @@ export async function main() {
     if (stack.tuning)
         useHostTuning(stack.tuning.values, stack.tuning.overrides);
     useWorkloadToken(stack.workloadToken ?? {});
+    useHostIdentity(stack.modelHostIdentity ?? []);
     if (stack.services.has("gates") || stack.services.has("keys") || stack.services.has("egress"))
         return runGates(stack);
     if (stack.services.has("harness"))

package/dist/host/stack-config.d.ts

@@ -188,6 +188,11 @@ export interface StackConfig {
         file?: string;
         origins?: string[];
     };
+    /**
+     * `NYLORUN_MODEL_HOST_IDENTITY`: the comma-separated providers whose models may use the Host's
+     * own identity (ADR-71, `vault/host-identity.ts`). Absent: none.
+     */
+    modelHostIdentity?: string[];
     /** Present when the process runs gates. */
     gates?: GatesConfig;
     /** Present when the process runs egress. */

package/dist/host/stack-config.js

@@ -50,6 +50,7 @@ import { isTenantId } from "@nylorun/core/compatibility";
 import { LOOPBACK_HOSTS } from "@nylorun/core/contracts";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 import { HostTuningError, parseHostTuning } from "../tuning.js";
+import { HOST_IDENTITY_PROVIDERS } from "../vault/host-identity.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
 /**
  * Services that may share a process (D12): they hold the same secrets and parse the same
@@ -327,6 +328,7 @@ export function parseStackConfig(env, argv) {
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
     const workloadToken = parseWorkloadToken(env);
+    const modelHostIdentity = parseModelHostIdentity(env);
     const objectStore = parseObjectStore(env);
     const traces = services.has("core") ? parseTraces(env) : undefined;
     const removedResolverVariables = Object.keys(env)
@@ -350,6 +352,7 @@ export function parseStackConfig(env, argv) {
         ...(delivery ? { delivery } : {}),
         ...(tenant ? { tenant } : {}),
         ...(workloadToken ? { workloadToken } : {}),
+        ...(modelHostIdentity ? { modelHostIdentity } : {}),
         ...(objectStore ? { objectStore } : {}),
         ...(traces ? { traces } : {}),
         ...(tuning ? { tuning } : {}),
@@ -468,6 +471,18 @@ function parseWorkloadToken(env) {
         return undefined;
     return { ...(file ? { file } : {}), ...(origins ? { origins } : {}) };
 }
+/** `StackConfig.modelHostIdentity` (ADR-71): each a provider that can use the Host's identity. */
+function parseModelHostIdentity(env) {
+    const raw = read(env, "NYLORUN_MODEL_HOST_IDENTITY");
+    if (raw === undefined)
+        return undefined;
+    const providers = [...new Set(raw.split(",").map((item) => item.trim()).filter((item) => item !== ""))];
+    for (const provider of providers) {
+        if (!HOST_IDENTITY_PROVIDERS.includes(provider))
+            throw new StackConfigError(`NYLORUN_MODEL_HOST_IDENTITY: ${provider} can't use the Host's identity (only ${HOST_IDENTITY_PROVIDERS.join(", ")})`);
+    }
+    return providers.length ? providers : undefined;
+}
 /** `NYLORUN_WORKLOAD_TOKEN_ORIGINS`: each an `https` origin (`http` only to a loopback host). */
 function parseOrigins(raw) {
     if (raw === undefined)