@nylorun/runtime 0.32.0-beta → 0.34.0-beta

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 0.34.0-beta
+
+### Minor Changes
+
+- 2ef610b: An outside credential provider for the egress gate (Host feature `credential-provider`; no protocol change). A Host's operator names a service that holds people's keys with `NYLORUN_CREDENTIAL_PROVIDER_URL` and `NYLORUN_CREDENTIAL_PROVIDER_TOKEN`, which `nylorun start` passes from its shell to the `gateway` and `runtime` containers. For a pod Agent with an owner, egress-gate asks the provider (`POST /v1/hosts`, with the Agent and its owner) which hosts the owner connected, lets them through on 443 inside the Tenant's egress ceiling, terminates TLS for them and hands each request to `<url>/v1/forward/<path>` with the sandbox's own headers plus `nylorun-provider-host`, `nylorun-provider-agent`, `nylorun-provider-owner` and `nylorun-provider-token`; the provider adds the key and sends it on, so the Runtime never sees a value. Each segment's sandbox sees the variables the provider names (`POST /v1/environment`) as `nylorun_managed`, under the vault's own. A secret in the Agent's vault bound to the same host still wins. Answers are cached per Agent for 15 s (Host tuning `credentialProvider.*`); an Agent with no owner is never asked about, and a provider that fails answers nothing, so its hosts are refused as before.
+
+### Patch Changes
+
+- 145dc06: The AG-UI endpoint follows AG-UI 1.0 more closely, on `@ag-ui/core` 1.0.3. `RUN_STARTED` now declares `protocolVersion: "1.0"`, which 1.0 asks every producer to set. A run from a client older than 1.0, which sends `null` for optional fields such as `forwardedProps`, `parentRunId`, `tools[].parameters`, `resume[].payload` or a media part's `metadata`, is now accepted, with those fields treated as absent; it used to be refused with `400 Invalid RunAgentInput`.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [2ef610b]
+- Updated dependencies
+  - @nylorun/core@0.30.0-beta
+  - @nylorun/harness@0.29.6-beta
+
+## 0.33.0-beta
+
+### Minor Changes
+
+- 95f98f1: A model can use the Host's own identity (ADR-71, Host feature `model-host-identity`). `PUT /v1/tenant/model` takes `auth: { type: "host_identity", project, location }` for `google-vertex`. It keeps no secret, and the model gate calls Agent Platform with the Host's Google Application Default Credentials: on Google Cloud, the attached service account from the metadata server. It's off unless the operator lists the provider in `NYLORUN_MODEL_HOST_IDENTITY` on the process that runs the gates, which `nylorun start` passes from its shell to the `gateway` container. Every Tenant on that Host may use it. `nylorun tenant models set --provider google-vertex --model <id> --host-identity --project <id> --location <location>` sets it with no key.
+- d99b3ac: A session can have its own model (optional Host feature `session-model`). `PUT /v1/sessions/{id}/model` chooses one of a connected provider's models for that session's turns, `DELETE` clears it, and `GET` answers the model the next turn uses (`source: "session"` or `"tenant"`). The Tenant's model and every other session's stay as they are. The Model Gate calls the session's model on its provider's credential (a refreshed OAuth credential is written back to that provider), `turn.start.model` describes it, and the usage ledger records it. A choice names a connected provider and a model its catalog lists, is set by the application only (a trusted issuer's token can read it, not change it), and is refused while a turn runs or waits (`409 session_busy`); while its provider is disconnected the session uses the Tenant's model. The SDK adds `session.model()`, `setModel({ provider, model })` and `clearModel()`.
+
+  Studio's model picker under the message box now sets the model of that session only, instead of the Tenant's: "Tenant model" clears the session's choice, the picker is locked while a turn runs, it groups models by provider, and its search keeps what is typed. A Runtime without `session-model` shows no picker.
+
+### Patch Changes
+
+- 683de1a: The model catalog comes from pi-ai 1.3.0, which adds Gemini 4 Argon: `google-vertex/gemini-4-argon` on Google's Agent Platform (Vertex AI) and `google/gemini-4-argon` on the Gemini API, with a 1,048,576-token context and thinking. `nylorun tenant models set --provider google-vertex --model gemini-4-argon` takes a Google Cloud API key for the Agent Platform API; the Runtime still reads no ambient Google credentials.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [95f98f1]
+- Updated dependencies [d99b3ac]
+- Updated dependencies
+  - @nylorun/core@0.29.0-beta
+  - @nylorun/harness@0.29.5-beta
+
 ## 0.32.0-beta
 
 ### Minor Changes

package/dist/api/ag-ui/routes.js

@@ -21,7 +21,7 @@
  * `CUSTOM nylorun.stream_closed`, and the client reattaches with a new token.
  */
 import { randomUUID } from "node:crypto";
-import { EventType, } from "@ag-ui/core";
+import { EventType, omitOptionalNulls, } from "@ag-ui/core";
 import { RunAgentInputSchema } from "@ag-ui/core/schemas";
 import { PutSessionRequestSchema, } from "@nylorun/core/contracts";
 import { messagesFromEvents, NYLORUN_FILE_PROVIDER } from "./history.js";
@@ -269,7 +269,9 @@ export function agUiCaller(scope, agentId) {
 export async function startRun(ctx, scope, agentId, caller, body, response, 
 /** The request's trace context (R7.4): the turn the run starts joins the caller's trace. */
 trace) {
-    const parsed = RunAgentInputSchema.safeParse(body);
+    // Clients before AG-UI 1.0 send `null` for optional fields (`forwardedProps`,
+    // `tools[].parameters`, `resume[].payload`, a media part's `metadata`), which 1.0 refuses.
+    const parsed = RunAgentInputSchema.safeParse(omitOptionalNulls(body, "RunAgentInput"));
     if (!parsed.success)
         return fail(400, "Invalid RunAgentInput", { code: "invalid_request" });
     const input = parsed.data;

package/dist/api/ag-ui/translate.js

@@ -3,7 +3,7 @@
  * model call's `invocationId`, a tool call is the model's `callId`, a tool result is
  * `<callId>:result`, so live runs and `messagesFromEvents` agree.
  */
-import { EventType } from "@ag-ui/core";
+import { EventType, PROTOCOL_VERSION } from "@ag-ui/core";
 import { isEmptyAssistantMessage, parseTranscriptEvent, } from "@nylorun/core/contracts";
 /** The text a tool result shows; `undefined` while there is no result yet. */
 export function toolResultText(result) {
@@ -170,6 +170,8 @@ export class RunTranslator {
             type: EventType.RUN_STARTED,
             threadId: this.threadId,
             runId: this.runId,
+            // AG-UI 1.0 producers declare the version; the SDKs do not fill it in.
+            protocolVersion: PROTOCOL_VERSION,
         };
     }
     finished(outcome, result) {

package/dist/api/components.d.ts

@@ -2421,6 +2421,30 @@ export declare const SessionView: z.ZodObject<{
         error: z.ZodUnknown;
     }, z.core.$strict>>;
 }, z.core.$strict>;
+export declare const PutSessionModelRequest: z.ZodObject<{
+    provider: z.ZodString;
+    model: z.ZodString;
+}, z.core.$strict>;
+export declare const SessionModelView: z.ZodUnion<readonly [z.ZodObject<{
+    configured: z.ZodLiteral<false>;
+    choice: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodString;
+        model: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    configured: z.ZodLiteral<true>;
+    source: z.ZodEnum<{
+        session: "session";
+        tenant: "tenant";
+    }>;
+    provider: z.ZodString;
+    model: z.ZodString;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    choice: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodString;
+        model: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>]>;
 export declare const LiveEvent: z.ZodObject<{
     schema: z.ZodLiteral<"nylorun.event/2">;
     eventId: z.ZodString;
@@ -13457,6 +13481,7 @@ export declare const TenantStatus: z.ZodObject<{
         model: z.ZodString;
         authType: z.ZodEnum<{
             api_key: "api_key";
+            host_identity: "host_identity";
             oauth: "oauth";
             workload: "workload";
         }>;
@@ -13622,6 +13647,10 @@ export declare const SeedTenantConfigRequest: z.ZodObject<{
             expires: z.ZodNumber;
         }, z.core.$loose>, z.ZodObject<{
             type: z.ZodLiteral<"workload">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"host_identity">;
+            project: z.ZodString;
+            location: z.ZodString;
         }, z.core.$strict>], "type">;
     }, z.core.$strict>>;
     fixtureModel: z.ZodOptional<z.ZodLiteral<true>>;
@@ -13880,6 +13909,7 @@ export declare const ListProvidersResponse: z.ZodObject<{
         model: z.ZodString;
         authType: z.ZodEnum<{
             api_key: "api_key";
+            host_identity: "host_identity";
             oauth: "oauth";
             workload: "workload";
         }>;
@@ -13927,6 +13957,7 @@ export declare const HostModelView: z.ZodUnion<readonly [z.ZodObject<{
     model: z.ZodString;
     authType: z.ZodEnum<{
         api_key: "api_key";
+        host_identity: "host_identity";
         oauth: "oauth";
         workload: "workload";
     }>;
@@ -13995,6 +14026,10 @@ export declare const PutHostModelRequest: z.ZodObject<{
         expires: z.ZodNumber;
     }, z.core.$loose>, z.ZodObject<{
         type: z.ZodLiteral<"workload">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"host_identity">;
+        project: z.ZodString;
+        location: z.ZodString;
     }, z.core.$strict>], "type">;
 }, z.core.$strict>;
 export declare const SelectHostModelRequest: z.ZodObject<{

package/dist/api/components.js

@@ -5,7 +5,7 @@
  * global registry.
  */
 import { z } from "zod";
-import { QueuedResponseSchema, TriggerListSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentFolderRequestSchema, AgentManifestSourceSchema, AgentManifestSourceDiffSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+import { PutSessionModelRequestSchema, SessionModelViewSchema, QueuedResponseSchema, TriggerListSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentFolderRequestSchema, AgentManifestSourceSchema, AgentManifestSourceDiffSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
 function named(id, schema) {
     return schema.meta({ id });
 }
@@ -77,6 +77,8 @@ export const WebhookAcceptedResponse = named("WebhookAcceptedResponse", WebhookA
 export const ListSessionsResponse = named("ListSessionsResponse", ListSessionsResponseSchema);
 export const PutSessionRequest = named("PutSessionRequest", PutSessionRequestSchema);
 export const SessionView = named("SessionView", SessionViewSchema);
+export const PutSessionModelRequest = named("PutSessionModelRequest", PutSessionModelRequestSchema);
+export const SessionModelView = named("SessionModelView", SessionModelViewSchema);
 export const LiveEvent = named("LiveEvent", LiveEventSchema);
 /** `environment.state` → `EnvironmentStateEvent`. */
 export function eventComponentName(type) {

package/dist/api/http/routes/sessions.js

@@ -1,10 +1,10 @@
 import { RESPONSE_ALREADY_SENT } from "@hono/node-server/utils/response";
 import { z } from "zod";
 import { PROTOCOL_HEADER } from "@nylorun/core/compatibility";
-import { PutSessionRequestSchema, SessionCommandSchema, } from "@nylorun/core/contracts";
+import { PutSessionModelRequestSchema, PutSessionRequestSchema, SessionCommandSchema, } from "@nylorun/core/contracts";
 import { handleSessionSandboxTool, SandboxRouteError } from "../../../core/sandbox-routes.js";
 import { traceContextOf } from "../../../traces/ids.js";
-import { AcceptedResponse, QueuedResponse, ListSessionsResponse, SessionPage, HistoryPage, SessionEvent, PutSessionRequest, SandboxToolOutcome, SessionCommand, SessionItemsResponse, SessionView, StreamClosedFrame, } from "../../components.js";
+import { AcceptedResponse, QueuedResponse, ListSessionsResponse, SessionPage, HistoryPage, SessionEvent, PutSessionModelRequest, PutSessionRequest, SandboxToolOutcome, SessionCommand, SessionItemsResponse, SessionModelView, SessionView, StreamClosedFrame, } from "../../components.js";
 import { accessOf, requireApplication } from "../../../tenant/auth.js";
 import { command } from "../../../tenant/commands.js";
 import { loadSession, sessionOf } from "../../../tenant/context.js";
@@ -12,6 +12,7 @@ import { fail } from "../../../tenant/http.js";
 import { agentGrantsOf, sandboxRouteDeps } from "../../../tenant/agents.js";
 import { readHistory, requestCursor, streamHolderOf, streamSessionEvents } from "../../../tenant/session-streams.js";
 import { listSessions, putSession, sessionView } from "../../../tenant/sessions.js";
+import { chooseSessionModel, readSessionModel } from "../../../tenant/session-model.js";
 import { readJson } from "../body.js";
 import { TraceHeaders, tenantRoute } from "../define.js";
 import { pageQuery, pageSize, sessionPage, sessionPageQuery, parseQuery } from "./reads.js";
@@ -20,6 +21,18 @@ const OWN_SESSIONS = {
     credentials: ["application", "subject", "token"],
     scopes: ["sessions:own"],
 };
+/**
+ * A session's own model costs what its model costs: the application chooses it (for a subject
+ * too), never a token a person's browser holds.
+ */
+const APP_SESSIONS = {
+    credentials: ["application", "subject"],
+    scopes: ["sessions:own"],
+};
+function refuseToken(scope) {
+    if (scope.kind === "token")
+        fail(403, "A token caller cannot choose a session's model", { code: "scope_required" });
+}
 const json = (schema, description) => ({
     description,
     content: { "application/json": { schema } },
@@ -122,6 +135,54 @@ export function sessionRoutes(api) {
         const id = c.req.param("sessionId");
         return jsonResponse(200, await ctx.store.tx(async (t) => sessionView(t, await sessionOf(t, id, accessOf(scope)))));
     });
+    tenantRoute(api, OWN_SESSIONS, {
+        method: "get",
+        path: "/v1/sessions/{sessionId}/model",
+        tags: ["Sessions"],
+        summary: "Get a session's model",
+        description: "The model the session's next turn uses (feature `session-model`): its own (`source: \"session\"`) while its provider is connected, else the Tenant's (`source: \"tenant\"`). `choice` is the session's own model, kept while its provider is disconnected.",
+        request: { params: sessionId },
+        responses: { 200: json(SessionModelView, "The session's model") },
+    }, async (c) => {
+        const scope = c.get("scope");
+        return jsonResponse(200, await readSessionModel(c.env.tenant, c.req.param("sessionId"), accessOf(scope)));
+    });
+    tenantRoute(api, APP_SESSIONS, {
+        method: "put",
+        path: "/v1/sessions/{sessionId}/model",
+        tags: ["Sessions"],
+        summary: "Choose a session's model",
+        description: "Chooses one of a connected provider's models for the session's turns (feature `session-model`), in place of the Tenant's model. The Tenant's model and every other session's stay as they are. Only the application sets it, for itself or for a subject: a trusted issuer's token is refused. A turn calls one model, so the choice changes only while no turn runs or waits (`409 session_busy`). A provider that is not connected, or a model its catalog does not list, is `422 request_rejected`.",
+        request: { params: sessionId, body: body(PutSessionModelRequest) },
+        responses: {
+            200: json(SessionModelView, "The session's model"),
+            403: { description: "A trusted issuer's token (`scope_required`)" },
+            409: { description: "A turn is running or waits (`session_busy`)" },
+            422: { description: "The provider is not connected, or the model is not one of its models" },
+        },
+    }, async (c) => {
+        const scope = c.get("scope");
+        refuseToken(scope);
+        const choice = PutSessionModelRequestSchema.parse(await readJson(c));
+        return jsonResponse(200, await chooseSessionModel(c.env.tenant, c.req.param("sessionId"), choice, accessOf(scope)));
+    });
+    tenantRoute(api, APP_SESSIONS, {
+        method: "delete",
+        path: "/v1/sessions/{sessionId}/model",
+        tags: ["Sessions"],
+        summary: "Clear a session's model",
+        description: "Clears the session's own model (feature `session-model`): its next turns use the Tenant's model. Refused while a turn runs or waits (`409 session_busy`).",
+        request: { params: sessionId },
+        responses: {
+            200: json(SessionModelView, "The session's model"),
+            403: { description: "A trusted issuer's token (`scope_required`)" },
+            409: { description: "A turn is running or waits (`session_busy`)" },
+        },
+    }, async (c) => {
+        const scope = c.get("scope");
+        refuseToken(scope);
+        return jsonResponse(200, await chooseSessionModel(c.env.tenant, c.req.param("sessionId"), undefined, accessOf(scope)));
+    });
     tenantRoute(api, OWN_SESSIONS, {
         method: "get",
         path: "/v1/sessions/{sessionId}/items",

package/dist/api/openapi.js

@@ -194,6 +194,9 @@ const RUNTIME_TAGS = [
             "GET /v1/sessions/{sessionId}/events",
             "GET /v1/sessions/{sessionId}/items",
             "GET /v1/sessions/{sessionId}/manifest",
+            "GET /v1/sessions/{sessionId}/model",
+            "PUT /v1/sessions/{sessionId}/model",
+            "DELETE /v1/sessions/{sessionId}/model",
             "GET /v1/sessions/{sessionId}/usage",
             "GET /v1/sessions/{sessionId}/calls/model",
             "GET /v1/sessions/{sessionId}/calls/tool",

package/dist/gates/credential-provider.d.ts

@@ -0,0 +1,42 @@
+import type { Logger } from "../tenant/types.js";
+/** The headers the engine adds to a request it hands to the provider's forward route. */
+export declare const PROVIDER_HEADERS: {
+    /** The host the sandbox addressed, e.g. `api.vercel.com`. */
+    readonly host: "nylorun-provider-host";
+    /** The Agent (the egress sandbox) the request comes from. */
+    readonly agent: "nylorun-provider-agent";
+    /** The Agent's owner, e.g. `u:<org>:<user>`. */
+    readonly owner: "nylorun-provider-owner";
+    /** The provider's token: the sandbox's own `Authorization` header is left as it sent it. */
+    readonly token: "nylorun-provider-token";
+};
+/** Every header of this prefix a sandbox sends is dropped before the engine sets its own. */
+export declare const PROVIDER_HEADER_PREFIX = "nylorun-provider-";
+/** Where the provider is and its token (`StackConfig.credentialProvider`). */
+export interface CredentialProviderSettings {
+    /** `NYLORUN_CREDENTIAL_PROVIDER_URL`, without a trailing slash. */
+    readonly url: string;
+    /** `NYLORUN_CREDENTIAL_PROVIDER_TOKEN`. */
+    readonly token: string;
+}
+export interface CredentialProvider {
+    /** The provider's base URL, without a trailing slash. */
+    readonly url: string;
+    /** The variables to set to the stand-in for `agentId`'s sessions; none without an owner. */
+    environment(agentId: string, owner: string | undefined): Promise<readonly string[]>;
+    /** The exact host names `owner`'s keys are bound to (lowercase); none without an owner. */
+    hosts(agentId: string, owner: string | undefined): Promise<readonly string[]>;
+    /** Where one request to `path` (origin form, `/v2/projects?x=1`) is handed. */
+    forwardUrl(path: string): URL;
+    /** The headers that go with it, the provider's token among them. */
+    forwardHeaders(at: {
+        readonly host: string;
+        readonly agentId: string;
+        readonly owner: string;
+    }): Record<string, string>;
+}
+export declare function createCredentialProvider(settings: CredentialProviderSettings, options: {
+    readonly logger: Logger;
+    /** Tests replace the HTTP client. */
+    readonly fetch?: typeof fetch;
+}): CredentialProvider;

package/dist/gates/credential-provider.js

@@ -0,0 +1,140 @@
+/**
+ * The credential provider (v0.25 CP-E): a service outside the Runtime that holds a person's keys
+ * and adds them to the requests their Agents' sandboxes send, so the Runtime never sees a value.
+ * The Host's operator names it with `NYLORUN_CREDENTIAL_PROVIDER_URL` and
+ * `NYLORUN_CREDENTIAL_PROVIDER_TOKEN` (Host feature `credential-provider`); without them nothing
+ * here runs.
+ *
+ * Three calls, each with `Authorization: Bearer <token>`:
+ * - `POST <url>/v1/hosts` `{ agentId, owner }` → `{ hosts: string[] }`: the exact host names the
+ *   owner's keys are bound to. egress-gate lets a pod Agent's sandbox reach them (inside the
+ *   Tenant's egress ceiling), terminates TLS for them on 443 and hands each request on;
+ * - `POST <url>/v1/environment` `{ agentId, owner }` → `{ variables: string[] }`: the variables
+ *   each of a pod Agent's segments sets to the stand-in `nylorun_managed`, under the vault's own;
+ * - `ANY <url>/v1/forward/<path and query>`: one request of the sandbox's, with its headers as it
+ *   sent them (its own `Authorization` or inject header included, which the provider replaces),
+ *   plus `nylorun-provider-host`, `-agent`, `-owner` and, in place of a bearer the sandbox's own
+ *   `Authorization` would clash with, `nylorun-provider-token`. The provider sends it on to
+ *   `https://<host>/<path>` and streams the answer back (`egress-credentials.ts`).
+ *
+ * Only an Agent with an owner (its owner guard) is asked about; one without gets nothing and no
+ * call. An answer is kept per Agent and owner for `credentialProvider.cacheMs` (15 s). A call
+ * that fails (unreachable, slow past `timeoutMs`, a non-2xx answer, a body of another shape)
+ * answers nothing, kept for `retryMs`, so the gate refuses what it refused before; it is logged
+ * once until a call succeeds again. The token is never logged.
+ */
+import { isSandboxHostPattern } from "@nylorun/core/define";
+import { hostTuning } from "../tuning.js";
+/** The headers the engine adds to a request it hands to the provider's forward route. */
+export const PROVIDER_HEADERS = {
+    /** The host the sandbox addressed, e.g. `api.vercel.com`. */
+    host: "nylorun-provider-host",
+    /** The Agent (the egress sandbox) the request comes from. */
+    agent: "nylorun-provider-agent",
+    /** The Agent's owner, e.g. `u:<org>:<user>`. */
+    owner: "nylorun-provider-owner",
+    /** The provider's token: the sandbox's own `Authorization` header is left as it sent it. */
+    token: "nylorun-provider-token",
+};
+/** Every header of this prefix a sandbox sends is dropped before the engine sets its own. */
+export const PROVIDER_HEADER_PREFIX = "nylorun-provider-";
+/** The most host names, or variables, one answer may hold; the rest are ignored. */
+const ANSWER_MAX = 256;
+/** A variable name a shell can set. */
+const VARIABLE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+export function createCredentialProvider(settings, options) {
+    const url = settings.url.replace(/\/+$/, "");
+    const { logger } = options;
+    const fetchImpl = options.fetch ?? fetch;
+    const cache = new Map();
+    const pending = new Map();
+    /** The calls failing now: each is logged once, until one succeeds. */
+    const failing = new Set();
+    function fail(call, agentId, reason, fields = {}) {
+        if (!failing.has(call)) {
+            failing.add(call);
+            logger.warn("credential_provider_failed", { call, agentId, reason, ...fields });
+        }
+        return { ok: false, value: [] };
+    }
+    async function ask(call, agentId, owner) {
+        let response;
+        try {
+            response = await fetchImpl(`${url}/v1/${call}`, {
+                method: "POST",
+                headers: { authorization: `Bearer ${settings.token}`, "content-type": "application/json", accept: "application/json" },
+                body: JSON.stringify({ agentId, owner }),
+                signal: AbortSignal.timeout(hostTuning().credentialProvider.timeoutMs),
+            });
+        }
+        catch (error) {
+            const name = error instanceof Error ? error.name : "Error";
+            return fail(call, agentId, name === "TimeoutError" ? "timeout" : "unreachable", {
+                code: error?.cause?.code ?? name,
+            });
+        }
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => undefined);
+            return fail(call, agentId, "status", { status: response.status });
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            return fail(call, agentId, "not_json");
+        }
+        const list = body?.[call === "hosts" ? "hosts" : "variables"];
+        if (!Array.isArray(list))
+            return fail(call, agentId, "shape");
+        if (failing.delete(call))
+            logger.info("credential_provider_recovered", { call });
+        const items = list.filter((item) => typeof item === "string").slice(0, ANSWER_MAX);
+        const value = call === "hosts"
+            ? [...new Set(items.map((host) => host.toLowerCase().replace(/\.$/, "")).filter(isExactHost))]
+            : [...new Set(items.filter((name) => VARIABLE.test(name)))];
+        return { ok: true, value };
+    }
+    function answer(call, agentId, owner) {
+        if (owner === undefined || owner === "")
+            return Promise.resolve([]);
+        const key = `${call}\u0000${agentId}\u0000${owner}`;
+        const cached = cache.get(key);
+        if (cached && Date.now() < cached.until)
+            return Promise.resolve(cached.value);
+        const inFlight = pending.get(key);
+        if (inFlight)
+            return inFlight;
+        const tuning = hostTuning().credentialProvider;
+        const asked = ask(call, agentId, owner)
+            .catch(() => fail(call, agentId, "failed"))
+            .then(({ ok, value }) => {
+            // A failure is kept for `retryMs`, an answer for `cacheMs`.
+            const ttl = ok ? tuning.cacheMs : tuning.retryMs;
+            cache.delete(key);
+            cache.set(key, { until: Date.now() + ttl, value });
+            if (cache.size > tuning.cacheEntries)
+                cache.delete(cache.keys().next().value);
+            return value;
+        })
+            .finally(() => pending.delete(key));
+        pending.set(key, asked);
+        return asked;
+    }
+    return {
+        url,
+        environment: (agentId, owner) => answer("environment", agentId, owner),
+        hosts: (agentId, owner) => answer("hosts", agentId, owner),
+        forwardUrl: (path) => new URL(`${url}/v1/forward${path.startsWith("/") ? path : `/${path}`}`),
+        forwardHeaders: ({ host, agentId, owner }) => ({
+            [PROVIDER_HEADERS.host]: host,
+            [PROVIDER_HEADERS.agent]: agentId,
+            [PROVIDER_HEADERS.owner]: owner,
+            [PROVIDER_HEADERS.token]: settings.token,
+        }),
+    };
+}
+/** An exact host name (no `*.` pattern, no IP literal), as egress-gate serves. */
+function isExactHost(host) {
+    return !host.startsWith("*.") && isSandboxHostPattern(host);
+}

package/dist/gates/egress-credentials.d.ts

@@ -1,5 +1,6 @@
 import type { Duplex } from "node:stream";
 import type { Logger } from "../tenant/types.js";
+import { type CredentialProvider } from "./credential-provider.js";
 /** What the vault answers for one request to a host a credential may be bound to. */
 export type EgressCredentialRelease = {
     readonly status: "none";
@@ -34,6 +35,11 @@ export interface EgressTally {
     requests: number;
     readonly credentialIds: Set<string>;
 }
+/** The Agent a provider host's requests are handed on for, and its owner. */
+export interface ProviderRoute {
+    readonly agentId: string;
+    readonly owner: string;
+}
 export interface CredentialTerminator {
     /**
      * Answers the CONNECT, terminates TLS for `host` and serves its requests, sending each to one
@@ -48,10 +54,16 @@ export interface CredentialTerminator {
         }[];
         /** Counted as requests are served, read when the connection closes. */
         readonly tally: EgressTally;
+        /** A host the credential provider lists: its requests go to the provider's forward route. */
+        readonly provider?: ProviderRoute;
     }): Promise<void>;
+    /** Closes the kept-alive connections to the credential provider. */
+    close(): void;
 }
 export declare function credentialTerminator(options: {
     readonly credentials: EgressCredentials;
     readonly logger: Logger;
     readonly idleMs: number;
+    /** The outside credential provider, for hosts it lists. */
+    readonly provider?: CredentialProvider;
 }): CredentialTerminator;

package/dist/gates/egress-credentials.js

@@ -14,20 +14,29 @@
  * as an event; a value never is. Upgrades (WebSocket) and HTTP/2 are not served on this path.
  * Each connection keeps a tally for its `agent.egress` event (R7.3, D67): how many requests it
  * read and which credentials it set, by id.
+ *
+ * A host the outside credential provider lists (`credential-provider.ts`) and the vault does not
+ * bind is terminated the same way, but its requests go to the provider's forward route instead:
+ * `<provider>/v1/forward<path and query>`, with every header the sandbox sent (its own
+ * `Authorization` or inject header included, for the provider to replace) but `host` and any
+ * `nylorun-provider-*`, plus the engine's `nylorun-provider-host`, `-agent`, `-owner` and
+ * `-token`. Bodies stream both ways; the tally counts the requests, with no credential id.
  */
-import { createServer } from "node:http";
+import { Agent as HttpAgent, createServer, request as httpRequest } from "node:http";
 import { Agent, request } from "node:https";
 import { createSecureContext, TLSSocket } from "node:tls";
 import { hostTuning } from "../tuning.js";
 import { HOP_BY_HOP_HEADERS } from "../vault/headers.js";
+import { PROVIDER_HEADER_PREFIX } from "./credential-provider.js";
 /** The answer to a CONNECT the gate serves; a tunnel's byte counts leave it out. */
 export const CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
-/** `rawHeaders` without hop-by-hop headers and `drop`, as lowercase names to values. */
+/** `rawHeaders` without hop-by-hop headers and those `drop` matches, as lowercase names to values. */
 function forwardable(raw, drop) {
     const headers = {};
+    const dropped = typeof drop === "function" ? drop : (name) => name === drop;
     for (let i = 0; i + 1 < raw.length; i += 2) {
         const name = raw[i].toLowerCase();
-        if (HOP_BY_HOP_HEADERS.has(name) || name === drop)
+        if (HOP_BY_HOP_HEADERS.has(name) || dropped(name))
             continue;
         (headers[name] ??= []).push(raw[i + 1]);
     }
@@ -43,8 +52,14 @@ function reply(res, status, message) {
     res.end(body);
 }
 export function credentialTerminator(options) {
-    const { credentials, logger } = options;
+    const { credentials, logger, provider } = options;
     const terminated = new WeakMap();
+    // One kept-alive pool to the provider, shared by every terminated connection.
+    const providerAgent = provider
+        ? new URL(provider.url).protocol === "https:"
+            ? new Agent({ keepAlive: true })
+            : new HttpAgent({ keepAlive: true })
+        : undefined;
     const http = createServer((req, res) => {
         forward(req, res).catch((error) => {
             logger.error("egress_forward_failed", { error: error instanceof Error ? error.message : String(error) });
@@ -69,6 +84,8 @@ export function credentialTerminator(options) {
         }
         const { sandboxId, host } = at;
         at.tally.requests += 1;
+        if (at.provider && provider)
+            return handOn(req, res, at, at.provider, provider);
         const release = await credentials.release(sandboxId, host);
         if (release.status === "refused") {
             logger.warn("egress_credential_refused", { status: 502, reason: release.reason, sandboxId, host });
@@ -106,7 +123,44 @@ export function credentialTerminator(options) {
         });
         req.pipe(upstream);
     }
+    /**
+     * One request of a provider host, handed to the provider's forward route as the sandbox sent
+     * it: its own headers stay (the provider replaces the bound one), `host` and any
+     * `nylorun-provider-*` it sent go, and the engine's provider headers are set.
+     */
+    function handOn(req, res, at, route, to) {
+        const { sandboxId, host } = at;
+        if (!req.url?.startsWith("/")) {
+            req.resume();
+            return reply(res, 400, "requests on this connection name a path");
+        }
+        const target = to.forwardUrl(req.url);
+        const headers = forwardable(req.rawHeaders, (name) => name === "host" || name.startsWith(PROVIDER_HEADER_PREFIX));
+        for (const [name, value] of Object.entries(to.forwardHeaders({ host, agentId: route.agentId, owner: route.owner })))
+            headers[name] = [value];
+        const upstream = target.protocol === "https:"
+            ? request(target, { method: req.method, headers, agent: providerAgent })
+            : httpRequest(target, { method: req.method, headers, agent: providerAgent });
+        upstream.on("response", (response) => {
+            res.writeHead(response.statusCode ?? 502, response.statusMessage, forwardable(response.rawHeaders));
+            response.pipe(res);
+            response.on("error", () => res.destroy());
+        });
+        upstream.on("error", (error) => {
+            logger.warn("egress_provider_failed", { status: 502, sandboxId, host, code: error.code });
+            reply(res, 502, `could not reach the credential provider for ${host}`);
+        });
+        req.on("error", () => upstream.destroy());
+        res.on("close", () => {
+            if (!res.writableFinished)
+                upstream.destroy();
+        });
+        req.pipe(upstream);
+    }
     return {
+        close() {
+            providerAgent?.destroy();
+        },
         async terminate(client, target) {
             const { sandboxId, host, addresses, tally } = target;
             const leaf = await credentials.leaf(host);
@@ -131,13 +185,13 @@ export function credentialTerminator(options) {
                 secureContext: createSecureContext({ key: leaf.key, cert: leaf.cert }),
                 ALPNProtocols: ["http/1.1"],
             });
-            terminated.set(tls, { sandboxId, host, agent, tally });
+            terminated.set(tls, { sandboxId, host, agent, tally, ...(target.provider ? { provider: target.provider } : {}) });
             tls.on("error", () => tls.destroy());
             tls.on("close", () => {
                 agent.destroy();
                 client.destroy();
             });
-            logger.info("egress_terminated", { sandboxId, host });
+            logger.info("egress_terminated", { sandboxId, host, ...(target.provider ? { via: "provider" } : {}) });
             http.emit("connection", tls);
         },
     };