@nylorun/runtime 0.33.0-beta → 0.34.0-beta

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.34.0-beta
+
+### Minor Changes
+
+- 2ef610b: An outside credential provider for the egress gate (Host feature `credential-provider`; no protocol change). A Host's operator names a service that holds people's keys with `NYLORUN_CREDENTIAL_PROVIDER_URL` and `NYLORUN_CREDENTIAL_PROVIDER_TOKEN`, which `nylorun start` passes from its shell to the `gateway` and `runtime` containers. For a pod Agent with an owner, egress-gate asks the provider (`POST /v1/hosts`, with the Agent and its owner) which hosts the owner connected, lets them through on 443 inside the Tenant's egress ceiling, terminates TLS for them and hands each request to `<url>/v1/forward/<path>` with the sandbox's own headers plus `nylorun-provider-host`, `nylorun-provider-agent`, `nylorun-provider-owner` and `nylorun-provider-token`; the provider adds the key and sends it on, so the Runtime never sees a value. Each segment's sandbox sees the variables the provider names (`POST /v1/environment`) as `nylorun_managed`, under the vault's own. A secret in the Agent's vault bound to the same host still wins. Answers are cached per Agent for 15 s (Host tuning `credentialProvider.*`); an Agent with no owner is never asked about, and a provider that fails answers nothing, so its hosts are refused as before.
+
+### Patch Changes
+
+- 145dc06: The AG-UI endpoint follows AG-UI 1.0 more closely, on `@ag-ui/core` 1.0.3. `RUN_STARTED` now declares `protocolVersion: "1.0"`, which 1.0 asks every producer to set. A run from a client older than 1.0, which sends `null` for optional fields such as `forwardedProps`, `parentRunId`, `tools[].parameters`, `resume[].payload` or a media part's `metadata`, is now accepted, with those fields treated as absent; it used to be refused with `400 Invalid RunAgentInput`.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [2ef610b]
+- Updated dependencies
+  - @nylorun/core@0.30.0-beta
+  - @nylorun/harness@0.29.6-beta
+
 ## 0.33.0-beta
 
 ### Minor Changes

package/dist/api/ag-ui/routes.js

@@ -21,7 +21,7 @@
  * `CUSTOM nylorun.stream_closed`, and the client reattaches with a new token.
  */
 import { randomUUID } from "node:crypto";
-import { EventType, } from "@ag-ui/core";
+import { EventType, omitOptionalNulls, } from "@ag-ui/core";
 import { RunAgentInputSchema } from "@ag-ui/core/schemas";
 import { PutSessionRequestSchema, } from "@nylorun/core/contracts";
 import { messagesFromEvents, NYLORUN_FILE_PROVIDER } from "./history.js";
@@ -269,7 +269,9 @@ export function agUiCaller(scope, agentId) {
 export async function startRun(ctx, scope, agentId, caller, body, response, 
 /** The request's trace context (R7.4): the turn the run starts joins the caller's trace. */
 trace) {
-    const parsed = RunAgentInputSchema.safeParse(body);
+    // Clients before AG-UI 1.0 send `null` for optional fields (`forwardedProps`,
+    // `tools[].parameters`, `resume[].payload`, a media part's `metadata`), which 1.0 refuses.
+    const parsed = RunAgentInputSchema.safeParse(omitOptionalNulls(body, "RunAgentInput"));
     if (!parsed.success)
         return fail(400, "Invalid RunAgentInput", { code: "invalid_request" });
     const input = parsed.data;

package/dist/api/ag-ui/translate.js

@@ -3,7 +3,7 @@
  * model call's `invocationId`, a tool call is the model's `callId`, a tool result is
  * `<callId>:result`, so live runs and `messagesFromEvents` agree.
  */
-import { EventType } from "@ag-ui/core";
+import { EventType, PROTOCOL_VERSION } from "@ag-ui/core";
 import { isEmptyAssistantMessage, parseTranscriptEvent, } from "@nylorun/core/contracts";
 /** The text a tool result shows; `undefined` while there is no result yet. */
 export function toolResultText(result) {
@@ -170,6 +170,8 @@ export class RunTranslator {
             type: EventType.RUN_STARTED,
             threadId: this.threadId,
             runId: this.runId,
+            // AG-UI 1.0 producers declare the version; the SDKs do not fill it in.
+            protocolVersion: PROTOCOL_VERSION,
         };
     }
     finished(outcome, result) {

package/dist/gates/credential-provider.d.ts

@@ -0,0 +1,42 @@
+import type { Logger } from "../tenant/types.js";
+/** The headers the engine adds to a request it hands to the provider's forward route. */
+export declare const PROVIDER_HEADERS: {
+    /** The host the sandbox addressed, e.g. `api.vercel.com`. */
+    readonly host: "nylorun-provider-host";
+    /** The Agent (the egress sandbox) the request comes from. */
+    readonly agent: "nylorun-provider-agent";
+    /** The Agent's owner, e.g. `u:<org>:<user>`. */
+    readonly owner: "nylorun-provider-owner";
+    /** The provider's token: the sandbox's own `Authorization` header is left as it sent it. */
+    readonly token: "nylorun-provider-token";
+};
+/** Every header of this prefix a sandbox sends is dropped before the engine sets its own. */
+export declare const PROVIDER_HEADER_PREFIX = "nylorun-provider-";
+/** Where the provider is and its token (`StackConfig.credentialProvider`). */
+export interface CredentialProviderSettings {
+    /** `NYLORUN_CREDENTIAL_PROVIDER_URL`, without a trailing slash. */
+    readonly url: string;
+    /** `NYLORUN_CREDENTIAL_PROVIDER_TOKEN`. */
+    readonly token: string;
+}
+export interface CredentialProvider {
+    /** The provider's base URL, without a trailing slash. */
+    readonly url: string;
+    /** The variables to set to the stand-in for `agentId`'s sessions; none without an owner. */
+    environment(agentId: string, owner: string | undefined): Promise<readonly string[]>;
+    /** The exact host names `owner`'s keys are bound to (lowercase); none without an owner. */
+    hosts(agentId: string, owner: string | undefined): Promise<readonly string[]>;
+    /** Where one request to `path` (origin form, `/v2/projects?x=1`) is handed. */
+    forwardUrl(path: string): URL;
+    /** The headers that go with it, the provider's token among them. */
+    forwardHeaders(at: {
+        readonly host: string;
+        readonly agentId: string;
+        readonly owner: string;
+    }): Record<string, string>;
+}
+export declare function createCredentialProvider(settings: CredentialProviderSettings, options: {
+    readonly logger: Logger;
+    /** Tests replace the HTTP client. */
+    readonly fetch?: typeof fetch;
+}): CredentialProvider;

package/dist/gates/credential-provider.js

@@ -0,0 +1,140 @@
+/**
+ * The credential provider (v0.25 CP-E): a service outside the Runtime that holds a person's keys
+ * and adds them to the requests their Agents' sandboxes send, so the Runtime never sees a value.
+ * The Host's operator names it with `NYLORUN_CREDENTIAL_PROVIDER_URL` and
+ * `NYLORUN_CREDENTIAL_PROVIDER_TOKEN` (Host feature `credential-provider`); without them nothing
+ * here runs.
+ *
+ * Three calls, each with `Authorization: Bearer <token>`:
+ * - `POST <url>/v1/hosts` `{ agentId, owner }` → `{ hosts: string[] }`: the exact host names the
+ *   owner's keys are bound to. egress-gate lets a pod Agent's sandbox reach them (inside the
+ *   Tenant's egress ceiling), terminates TLS for them on 443 and hands each request on;
+ * - `POST <url>/v1/environment` `{ agentId, owner }` → `{ variables: string[] }`: the variables
+ *   each of a pod Agent's segments sets to the stand-in `nylorun_managed`, under the vault's own;
+ * - `ANY <url>/v1/forward/<path and query>`: one request of the sandbox's, with its headers as it
+ *   sent them (its own `Authorization` or inject header included, which the provider replaces),
+ *   plus `nylorun-provider-host`, `-agent`, `-owner` and, in place of a bearer the sandbox's own
+ *   `Authorization` would clash with, `nylorun-provider-token`. The provider sends it on to
+ *   `https://<host>/<path>` and streams the answer back (`egress-credentials.ts`).
+ *
+ * Only an Agent with an owner (its owner guard) is asked about; one without gets nothing and no
+ * call. An answer is kept per Agent and owner for `credentialProvider.cacheMs` (15 s). A call
+ * that fails (unreachable, slow past `timeoutMs`, a non-2xx answer, a body of another shape)
+ * answers nothing, kept for `retryMs`, so the gate refuses what it refused before; it is logged
+ * once until a call succeeds again. The token is never logged.
+ */
+import { isSandboxHostPattern } from "@nylorun/core/define";
+import { hostTuning } from "../tuning.js";
+/** The headers the engine adds to a request it hands to the provider's forward route. */
+export const PROVIDER_HEADERS = {
+    /** The host the sandbox addressed, e.g. `api.vercel.com`. */
+    host: "nylorun-provider-host",
+    /** The Agent (the egress sandbox) the request comes from. */
+    agent: "nylorun-provider-agent",
+    /** The Agent's owner, e.g. `u:<org>:<user>`. */
+    owner: "nylorun-provider-owner",
+    /** The provider's token: the sandbox's own `Authorization` header is left as it sent it. */
+    token: "nylorun-provider-token",
+};
+/** Every header of this prefix a sandbox sends is dropped before the engine sets its own. */
+export const PROVIDER_HEADER_PREFIX = "nylorun-provider-";
+/** The most host names, or variables, one answer may hold; the rest are ignored. */
+const ANSWER_MAX = 256;
+/** A variable name a shell can set. */
+const VARIABLE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+export function createCredentialProvider(settings, options) {
+    const url = settings.url.replace(/\/+$/, "");
+    const { logger } = options;
+    const fetchImpl = options.fetch ?? fetch;
+    const cache = new Map();
+    const pending = new Map();
+    /** The calls failing now: each is logged once, until one succeeds. */
+    const failing = new Set();
+    function fail(call, agentId, reason, fields = {}) {
+        if (!failing.has(call)) {
+            failing.add(call);
+            logger.warn("credential_provider_failed", { call, agentId, reason, ...fields });
+        }
+        return { ok: false, value: [] };
+    }
+    async function ask(call, agentId, owner) {
+        let response;
+        try {
+            response = await fetchImpl(`${url}/v1/${call}`, {
+                method: "POST",
+                headers: { authorization: `Bearer ${settings.token}`, "content-type": "application/json", accept: "application/json" },
+                body: JSON.stringify({ agentId, owner }),
+                signal: AbortSignal.timeout(hostTuning().credentialProvider.timeoutMs),
+            });
+        }
+        catch (error) {
+            const name = error instanceof Error ? error.name : "Error";
+            return fail(call, agentId, name === "TimeoutError" ? "timeout" : "unreachable", {
+                code: error?.cause?.code ?? name,
+            });
+        }
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => undefined);
+            return fail(call, agentId, "status", { status: response.status });
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            return fail(call, agentId, "not_json");
+        }
+        const list = body?.[call === "hosts" ? "hosts" : "variables"];
+        if (!Array.isArray(list))
+            return fail(call, agentId, "shape");
+        if (failing.delete(call))
+            logger.info("credential_provider_recovered", { call });
+        const items = list.filter((item) => typeof item === "string").slice(0, ANSWER_MAX);
+        const value = call === "hosts"
+            ? [...new Set(items.map((host) => host.toLowerCase().replace(/\.$/, "")).filter(isExactHost))]
+            : [...new Set(items.filter((name) => VARIABLE.test(name)))];
+        return { ok: true, value };
+    }
+    function answer(call, agentId, owner) {
+        if (owner === undefined || owner === "")
+            return Promise.resolve([]);
+        const key = `${call}\u0000${agentId}\u0000${owner}`;
+        const cached = cache.get(key);
+        if (cached && Date.now() < cached.until)
+            return Promise.resolve(cached.value);
+        const inFlight = pending.get(key);
+        if (inFlight)
+            return inFlight;
+        const tuning = hostTuning().credentialProvider;
+        const asked = ask(call, agentId, owner)
+            .catch(() => fail(call, agentId, "failed"))
+            .then(({ ok, value }) => {
+            // A failure is kept for `retryMs`, an answer for `cacheMs`.
+            const ttl = ok ? tuning.cacheMs : tuning.retryMs;
+            cache.delete(key);
+            cache.set(key, { until: Date.now() + ttl, value });
+            if (cache.size > tuning.cacheEntries)
+                cache.delete(cache.keys().next().value);
+            return value;
+        })
+            .finally(() => pending.delete(key));
+        pending.set(key, asked);
+        return asked;
+    }
+    return {
+        url,
+        environment: (agentId, owner) => answer("environment", agentId, owner),
+        hosts: (agentId, owner) => answer("hosts", agentId, owner),
+        forwardUrl: (path) => new URL(`${url}/v1/forward${path.startsWith("/") ? path : `/${path}`}`),
+        forwardHeaders: ({ host, agentId, owner }) => ({
+            [PROVIDER_HEADERS.host]: host,
+            [PROVIDER_HEADERS.agent]: agentId,
+            [PROVIDER_HEADERS.owner]: owner,
+            [PROVIDER_HEADERS.token]: settings.token,
+        }),
+    };
+}
+/** An exact host name (no `*.` pattern, no IP literal), as egress-gate serves. */
+function isExactHost(host) {
+    return !host.startsWith("*.") && isSandboxHostPattern(host);
+}

package/dist/gates/egress-credentials.d.ts

@@ -1,5 +1,6 @@
 import type { Duplex } from "node:stream";
 import type { Logger } from "../tenant/types.js";
+import { type CredentialProvider } from "./credential-provider.js";
 /** What the vault answers for one request to a host a credential may be bound to. */
 export type EgressCredentialRelease = {
     readonly status: "none";
@@ -34,6 +35,11 @@ export interface EgressTally {
     requests: number;
     readonly credentialIds: Set<string>;
 }
+/** The Agent a provider host's requests are handed on for, and its owner. */
+export interface ProviderRoute {
+    readonly agentId: string;
+    readonly owner: string;
+}
 export interface CredentialTerminator {
     /**
      * Answers the CONNECT, terminates TLS for `host` and serves its requests, sending each to one
@@ -48,10 +54,16 @@ export interface CredentialTerminator {
         }[];
         /** Counted as requests are served, read when the connection closes. */
         readonly tally: EgressTally;
+        /** A host the credential provider lists: its requests go to the provider's forward route. */
+        readonly provider?: ProviderRoute;
     }): Promise<void>;
+    /** Closes the kept-alive connections to the credential provider. */
+    close(): void;
 }
 export declare function credentialTerminator(options: {
     readonly credentials: EgressCredentials;
     readonly logger: Logger;
     readonly idleMs: number;
+    /** The outside credential provider, for hosts it lists. */
+    readonly provider?: CredentialProvider;
 }): CredentialTerminator;

package/dist/gates/egress-credentials.js

@@ -14,20 +14,29 @@
  * as an event; a value never is. Upgrades (WebSocket) and HTTP/2 are not served on this path.
  * Each connection keeps a tally for its `agent.egress` event (R7.3, D67): how many requests it
  * read and which credentials it set, by id.
+ *
+ * A host the outside credential provider lists (`credential-provider.ts`) and the vault does not
+ * bind is terminated the same way, but its requests go to the provider's forward route instead:
+ * `<provider>/v1/forward<path and query>`, with every header the sandbox sent (its own
+ * `Authorization` or inject header included, for the provider to replace) but `host` and any
+ * `nylorun-provider-*`, plus the engine's `nylorun-provider-host`, `-agent`, `-owner` and
+ * `-token`. Bodies stream both ways; the tally counts the requests, with no credential id.
  */
-import { createServer } from "node:http";
+import { Agent as HttpAgent, createServer, request as httpRequest } from "node:http";
 import { Agent, request } from "node:https";
 import { createSecureContext, TLSSocket } from "node:tls";
 import { hostTuning } from "../tuning.js";
 import { HOP_BY_HOP_HEADERS } from "../vault/headers.js";
+import { PROVIDER_HEADER_PREFIX } from "./credential-provider.js";
 /** The answer to a CONNECT the gate serves; a tunnel's byte counts leave it out. */
 export const CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
-/** `rawHeaders` without hop-by-hop headers and `drop`, as lowercase names to values. */
+/** `rawHeaders` without hop-by-hop headers and those `drop` matches, as lowercase names to values. */
 function forwardable(raw, drop) {
     const headers = {};
+    const dropped = typeof drop === "function" ? drop : (name) => name === drop;
     for (let i = 0; i + 1 < raw.length; i += 2) {
         const name = raw[i].toLowerCase();
-        if (HOP_BY_HOP_HEADERS.has(name) || name === drop)
+        if (HOP_BY_HOP_HEADERS.has(name) || dropped(name))
             continue;
         (headers[name] ??= []).push(raw[i + 1]);
     }
@@ -43,8 +52,14 @@ function reply(res, status, message) {
     res.end(body);
 }
 export function credentialTerminator(options) {
-    const { credentials, logger } = options;
+    const { credentials, logger, provider } = options;
     const terminated = new WeakMap();
+    // One kept-alive pool to the provider, shared by every terminated connection.
+    const providerAgent = provider
+        ? new URL(provider.url).protocol === "https:"
+            ? new Agent({ keepAlive: true })
+            : new HttpAgent({ keepAlive: true })
+        : undefined;
     const http = createServer((req, res) => {
         forward(req, res).catch((error) => {
             logger.error("egress_forward_failed", { error: error instanceof Error ? error.message : String(error) });
@@ -69,6 +84,8 @@ export function credentialTerminator(options) {
         }
         const { sandboxId, host } = at;
         at.tally.requests += 1;
+        if (at.provider && provider)
+            return handOn(req, res, at, at.provider, provider);
         const release = await credentials.release(sandboxId, host);
         if (release.status === "refused") {
             logger.warn("egress_credential_refused", { status: 502, reason: release.reason, sandboxId, host });
@@ -106,7 +123,44 @@ export function credentialTerminator(options) {
         });
         req.pipe(upstream);
     }
+    /**
+     * One request of a provider host, handed to the provider's forward route as the sandbox sent
+     * it: its own headers stay (the provider replaces the bound one), `host` and any
+     * `nylorun-provider-*` it sent go, and the engine's provider headers are set.
+     */
+    function handOn(req, res, at, route, to) {
+        const { sandboxId, host } = at;
+        if (!req.url?.startsWith("/")) {
+            req.resume();
+            return reply(res, 400, "requests on this connection name a path");
+        }
+        const target = to.forwardUrl(req.url);
+        const headers = forwardable(req.rawHeaders, (name) => name === "host" || name.startsWith(PROVIDER_HEADER_PREFIX));
+        for (const [name, value] of Object.entries(to.forwardHeaders({ host, agentId: route.agentId, owner: route.owner })))
+            headers[name] = [value];
+        const upstream = target.protocol === "https:"
+            ? request(target, { method: req.method, headers, agent: providerAgent })
+            : httpRequest(target, { method: req.method, headers, agent: providerAgent });
+        upstream.on("response", (response) => {
+            res.writeHead(response.statusCode ?? 502, response.statusMessage, forwardable(response.rawHeaders));
+            response.pipe(res);
+            response.on("error", () => res.destroy());
+        });
+        upstream.on("error", (error) => {
+            logger.warn("egress_provider_failed", { status: 502, sandboxId, host, code: error.code });
+            reply(res, 502, `could not reach the credential provider for ${host}`);
+        });
+        req.on("error", () => upstream.destroy());
+        res.on("close", () => {
+            if (!res.writableFinished)
+                upstream.destroy();
+        });
+        req.pipe(upstream);
+    }
     return {
+        close() {
+            providerAgent?.destroy();
+        },
         async terminate(client, target) {
             const { sandboxId, host, addresses, tally } = target;
             const leaf = await credentials.leaf(host);
@@ -131,13 +185,13 @@ export function credentialTerminator(options) {
                 secureContext: createSecureContext({ key: leaf.key, cert: leaf.cert }),
                 ALPNProtocols: ["http/1.1"],
             });
-            terminated.set(tls, { sandboxId, host, agent, tally });
+            terminated.set(tls, { sandboxId, host, agent, tally, ...(target.provider ? { provider: target.provider } : {}) });
             tls.on("error", () => tls.destroy());
             tls.on("close", () => {
                 agent.destroy();
                 client.destroy();
             });
-            logger.info("egress_terminated", { sandboxId, host });
+            logger.info("egress_terminated", { sandboxId, host, ...(target.provider ? { via: "provider" } : {}) });
             http.emit("connection", tls);
         },
     };

package/dist/gates/egress.d.ts

@@ -3,17 +3,23 @@ import { type Socket } from "node:net";
 import type { EgressRunningTurn, AgentEventPayload } from "@nylorun/core/contracts";
 import type { EgressTokenVerdict } from "../sandbox/egress-token.js";
 import type { SessionStore } from "../store/types.js";
+import type { CredentialProvider } from "./credential-provider.js";
 import type { Logger } from "../tenant/types.js";
 import { type EgressCredentials } from "./egress-credentials.js";
 /**
  * What egress-gate reads of a sandbox: its current host epoch, the pod that joined at it, and
  * its spec's `network.allow`; `undefined` when it is gone, deleted, lost, expired or not a pod.
+ * For an Agent with an owner guard, also the owner and the Tenant's egress ceiling
+ * (`environments.config`'s `limits.network`) when the Tenant sets one: what the credential
+ * provider is asked about and kept inside.
  */
 export interface EgressSandboxes {
     live(sandboxId: string): Promise<{
         readonly epoch: number;
         readonly podUid?: string;
         readonly allow: readonly string[];
+        readonly owner?: string;
+        readonly ceiling?: readonly string[];
     } | undefined>;
 }
 /** One connection's record (R7.3, D67): `agent.egress`'s payload. */
@@ -63,6 +69,11 @@ export interface StartEgressGateOptions {
     readonly credentials?: EgressCredentials;
     /** Where connections are recorded (R7.3). None: they are only logged. */
     readonly record?: EgressRecord;
+    /**
+     * The outside credential provider (`NYLORUN_CREDENTIAL_PROVIDER_URL`): the hosts it lists for an
+     * Agent's owner pass on 443 and are handed to it. Needs `credentials` (the leaf). None: off.
+     */
+    readonly provider?: CredentialProvider;
 }
 export interface EgressGate {
     /** Where the gate listens, e.g. `http://0.0.0.0:4200`. */
@@ -84,7 +95,9 @@ export declare function startEgressGate(options: StartEgressGateOptions): Promis
 /**
  * `EgressSandboxes` over the Tenant's `sandbox_resources` (one indexed read): a pod sandbox's
  * host epoch, the pod that joined at it and its spec's allowlist; nothing for a virtual
- * Environment, or one deleted or lost, as `staleHost` judges a host token.
+ * Environment, or one deleted or lost, as `staleHost` judges a host token. An Agent with an
+ * owner guard also gets its owner and, when the Tenant sets one, its egress ceiling (one more
+ * read, of the Tenant's `environments.config`).
  */
 export declare function storeEgressSandboxes(store: SessionStore): EgressSandboxes;
 /**

package/dist/gates/egress.js

@@ -11,17 +11,21 @@
  * 2. its sandbox is live and its host epoch and pod are the token's (`EgressSandboxes.live`),
  *    else 407;
  * 3. the port is 443 or 80, the target is a host name and no IP literal, and it matches the spec's
- *    `network.allow` exactly or by `*.suffix`, else 403;
+ *    `network.allow` exactly or by `*.suffix`, or (443 only) the outside credential provider lists
+ *    it for the Agent's owner and the Tenant's egress ceiling holds it, else 403;
  * 4. the sandbox has fewer than `maxPerSandbox` tunnels open, else 429;
  * 5. the name resolves, and to at least one address that is not private, loopback, link-local
  *    (cloud metadata included), multicast or reserved, else 502 or 403;
  * 6. the gate connects to that checked address (never to the name again) and pipes.
  *
- * A tunnel is opaque bytes, with one exception (R2c, D50): port 443 of a host that an
+ * A tunnel is opaque bytes, with two exceptions. First (R2c, D50): port 443 of a host that an
  * `environment_secret` of a live session on the sandbox is bound to. There the gate terminates
  * TLS and sets the credential's header on every request (`egress-credentials.ts`), still sending
- * only to the checked address. Every other host gets the tunnel. Any other request
- * (an absolute-form plain HTTP request included) is answered 405. Refusals are logged; the token
+ * only to the checked address. Second, port 443 of a host the credential provider lists
+ * (`credential-provider.ts`) and no secret binds: terminated the same way, its requests are handed
+ * to the provider's forward route, which adds the key; the vault's binding wins where both apply.
+ * Every other host gets the tunnel. Any other request (an absolute-form plain HTTP request
+ * included) is answered 405. Refusals are logged; the token
  * never is. Tunnels close after `idleMs` without traffic in either direction.
  *
  * Every connection to a named host on a live token is recorded once (R7.3, D67), when it closes
@@ -40,6 +44,8 @@ import { createServer } from "node:http";
 import { BlockList, connect, isIP } from "node:net";
 import { isSandboxHostPattern } from "@nylorun/core/define";
 import { isPrivateAddress } from "../tenant/outbound.js";
+import { readSandboxConfig } from "../sandbox/tenant-config.js";
+import { withinCeiling } from "../sandbox/resolve.js";
 import { bindListener } from "../host/http.js";
 import { hostTuning } from "../tuning.js";
 import { CONNECT_ESTABLISHED, credentialTerminator, } from "./egress-credentials.js";
@@ -212,8 +218,25 @@ export async function startEgressGate(options) {
         return value;
     }
     const terminator = options.credentials
-        ? credentialTerminator({ credentials: options.credentials, logger, idleMs })
+        ? credentialTerminator({
+            credentials: options.credentials,
+            logger,
+            idleMs,
+            ...(options.provider ? { provider: options.provider } : {}),
+        })
         : undefined;
+    const provider = terminator ? options.provider : undefined;
+    /**
+     * Whether the credential provider lists `host` for the sandbox's owner, inside the Tenant's
+     * ceiling: only on 443, where the gate terminates TLS, and never for an Agent without an owner.
+     */
+    async function providerLists(sandboxId, sandbox, host, port) {
+        if (!provider || port !== 443 || sandbox.owner === undefined)
+            return false;
+        if (sandbox.ceiling && !withinCeiling(host, sandbox.ceiling))
+            return false;
+        return (await provider.hosts(sandboxId, sandbox.owner)).includes(host);
+    }
     const open = new Map();
     const tunnels = new Set();
     /** Each connection's record, once its Environment and target are known. */
@@ -257,7 +280,9 @@ export async function startEgressGate(options) {
             return refuse(403, "port_refused", { sandboxId }, `port ${port} is not allowed; tunnels open to 443 or 80 only`);
         if (isIP(host.replace(/^\[|\]$/g, "")) !== 0 || !isSandboxHostPattern(host) || host.startsWith("*."))
             return refuse(403, "not_a_host_name", { sandboxId }, `${host} is not a host name; IP literals are refused`);
-        if (!egressAllows(host, sandbox.allow))
+        // A host the provider lists goes to it, even one the spec allows, unless the vault binds it.
+        const provided = await providerLists(sandboxId, sandbox, host, port);
+        if (!provided && !egressAllows(host, sandbox.allow))
             return refuse(403, "host_not_allowed", { sandboxId }, `${host} is not in this sandbox's network.allow`);
         // The turns running on the Environment as the connection opens: the read starts as the
         // name resolves, and the 200 does not wait for it.
@@ -298,6 +323,20 @@ export async function startEgressGate(options) {
             client.once("close", () => record.closed(tally));
             return terminator.terminate(client, { sandboxId, host, addresses: allowed, tally });
         }
+        if (terminator && provided && sandbox.owner !== undefined) {
+            record.credentialBound = true;
+            if (head.length > 0)
+                return refuse(403, "early_data", { sandboxId }, "wait for the CONNECT answer before sending");
+            const tally = { requests: 0, credentialIds: new Set() };
+            client.once("close", () => record.closed(tally));
+            return terminator.terminate(client, {
+                sandboxId,
+                host,
+                addresses: allowed,
+                tally,
+                provider: { agentId: sandboxId, owner: sandbox.owner },
+            });
+        }
         const upstream = await dialFirst(allowed.map((entry) => entry.address), port);
         if (!upstream)
             return refuse(502, "connect_failed", { sandboxId }, `could not connect to ${host}:${port}`);
@@ -383,6 +422,7 @@ export async function startEgressGate(options) {
                 for (const tunnel of tunnels)
                     tunnel.destroy();
                 server.closeAllConnections();
+                terminator?.close();
             });
             return closing;
         },
@@ -391,23 +431,31 @@ export async function startEgressGate(options) {
 /**
  * `EgressSandboxes` over the Tenant's `sandbox_resources` (one indexed read): a pod sandbox's
  * host epoch, the pod that joined at it and its spec's allowlist; nothing for a virtual
- * Environment, or one deleted or lost, as `staleHost` judges a host token.
+ * Environment, or one deleted or lost, as `staleHost` judges a host token. An Agent with an
+ * owner guard also gets its owner and, when the Tenant sets one, its egress ceiling (one more
+ * read, of the Tenant's `environments.config`).
  */
 export function storeEgressSandboxes(store) {
     return {
         async live(sandboxId) {
-            const sandbox = await store.tx((t) => t.environment(sandboxId));
-            const pod = sandbox?.pod;
-            if (!sandbox || sandbox.kind !== "pod" || !pod)
-                return undefined;
-            if (pod.desired === "deleted" || pod.observed === "lost")
-                return undefined;
-            return {
-                epoch: pod.hostEpoch,
-                ...(pod.podUid ? { podUid: pod.podUid } : {}),
-                // The applied allowlist: a recipe change writes it at once (Q8).
-                allow: sandbox.applied.network?.allowedHosts ?? [],
-            };
+            return store.tx(async (t) => {
+                const sandbox = await t.environment(sandboxId);
+                const pod = sandbox?.pod;
+                if (!sandbox || sandbox.kind !== "pod" || !pod)
+                    return undefined;
+                if (pod.desired === "deleted" || pod.observed === "lost")
+                    return undefined;
+                const owner = sandbox.ownerUserId;
+                const ceiling = owner === undefined ? undefined : (await readSandboxConfig(t)).limits?.network;
+                return {
+                    epoch: pod.hostEpoch,
+                    ...(pod.podUid ? { podUid: pod.podUid } : {}),
+                    // The applied allowlist: a recipe change writes it at once (Q8).
+                    allow: sandbox.applied.network?.allowedHosts ?? [],
+                    ...(owner === undefined ? {} : { owner }),
+                    ...(ceiling === undefined ? {} : { ceiling }),
+                };
+            });
         },
     };
 }

package/dist/harness-api/start.js

@@ -4,8 +4,13 @@
  * outcomes are read; then the transcript is folded from the record (P0.3). `buildTurnStart`
  * turns that into the run's `turn.start`: the checkpoint goes without its transcript, which the
  * harness holds at the fold's cursor or reads once.
+ *
+ * A pod Agent's sandbox variables are its vault's (R2c), then, with an outside credential
+ * provider (`gates/credential-provider.ts`) and an owner on the Agent, each variable the provider
+ * names for that owner, set to the stand-in `nylorun_managed` and never over a vault variable.
+ * The provider is asked after the transaction, and one that fails adds nothing.
  */
-import { harnessLimitsOf } from "@nylorun/core/contracts";
+import { ENVIRONMENT_SECRET_SENTINEL, harnessLimitsOf } from "@nylorun/core/contracts";
 import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
 import { isWorkflowManifest } from "../core/flow-host.js";
 import { sandboxWorkspaceOf } from "../sandbox/share.js";
@@ -33,6 +38,8 @@ options = {}) {
     const id = lease.sessionId;
     // Read before the transaction: the first read of the Tenant may create the key.
     const key = options.harness ? await traceKey(ctx.store) : undefined;
+    // The pod Agent and its owner the credential provider is asked about, once the transaction ends.
+    let providerAsk;
     const opened = await ownedTx(ctx.store, id, lease.epoch, async (t, current) => {
         // A turn's first segment runs the version its Agent runs now (T3, D73).
         if (options.harness && (await repinTurn(t, current)))
@@ -52,6 +59,10 @@ options = {}) {
         const workspace = sandboxWorkspaceOf(current);
         const resource = workspace.environmentId === undefined ? undefined : await t.environment(workspace.environmentId);
         const environment = await ctx.vault.environmentVariables(t, current.environmentId);
+        providerAsk =
+            ctx.credentialProvider && resource?.kind === "pod" && resource.ownerUserId
+                ? { agentId: resource.id, owner: resource.ownerUserId }
+                : undefined;
         const sandbox = {
             ...workspace,
             ...(Object.keys(environment).length > 0 ? { environment } : {}),
@@ -84,7 +95,8 @@ options = {}) {
     const model = options.harness && !isWorkflowManifest(opened.current.manifest)
         ? await currentModelDescriptor(ctx, opened.current.model)
         : undefined;
-    const started = model ? { ...opened, model } : opened;
+    const provided = await withProviderVariables(ctx, opened, providerAsk);
+    const started = model ? { ...provided, model } : provided;
     // One history (P0.3): the engine resumes from the transcript folded from the record.
     const { current } = started;
     const cp = current.checkpoint;
@@ -101,6 +113,21 @@ options = {}) {
     checkParity(id, transcript, transcriptOf(cp.state));
     return { ...started, transcript, cursor };
 }
+/**
+ * `opened` with the credential provider's variables for `ask` added to its sandbox's environment
+ * as the stand-in, under the vault's own; `opened` itself when there are none.
+ */
+async function withProviderVariables(ctx, opened, ask) {
+    if (!ask || !ctx.credentialProvider)
+        return opened;
+    const names = await ctx.credentialProvider.environment(ask.agentId, ask.owner);
+    const vault = opened.sandbox.environment ?? {};
+    const added = names.filter((name) => !Object.hasOwn(vault, name));
+    if (added.length === 0)
+        return opened;
+    const environment = { ...Object.fromEntries(added.map((name) => [name, ENVIRONMENT_SECRET_SENTINEL])), ...vault };
+    return { ...opened, sandbox: { ...opened.sandbox, environment } };
+}
 /** The run's `turn.start`. */
 export function buildTurnStart(ctx, segment) {
     const { current } = segment;

package/dist/host/gates.d.ts

@@ -20,6 +20,7 @@ import type { PostgresClient } from "../store/postgres/connect.js";
 import type { Logger } from "../tenant/types.js";
 import type { EgressConfig, GatesConfig } from "./stack-config.js";
 import { type EgressGate, type StartEgressGateOptions } from "../gates/egress.js";
+import { type CredentialProviderSettings } from "../gates/credential-provider.js";
 export interface StartGatesOptions {
     readonly gates: GatesConfig;
     readonly logger: Logger;
@@ -71,10 +72,16 @@ export interface StartEgressOptions {
     readonly vaults?: TenantVaults;
     /** Replaces how sandboxes are read, and the gate's limits and hooks (tests). */
     readonly gate?: Partial<Omit<StartEgressGateOptions, "listen" | "logger" | "verify">>;
+    /**
+     * The outside credential provider (`NYLORUN_CREDENTIAL_PROVIDER_*`, Host feature
+     * `credential-provider`): the hosts it lists for an Agent's owner are handed to it.
+     */
+    readonly credentialProvider?: CredentialProviderSettings;
 }
 /**
  * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
  * Tenant's public keys and reading its sandboxes from the same database as the gates, where it
- * also records each connection (R7.3).
+ * also records each connection (R7.3). With a credential provider, the hosts it lists for an
+ * Agent's owner are terminated and handed to it.
  */
 export declare function startEgress(options: StartEgressOptions): Promise<EgressGate>;

package/dist/host/gates.js

@@ -30,6 +30,7 @@ import { bindListener, headerValue, isAllowedRequestHost, sendRejected } from ".
 import { startEgressGate, storeEgressRecord, storeEgressSandboxes, } from "../gates/egress.js";
 import { verifyEgressToken } from "../sandbox/egress-token.js";
 import { leafKeyPair } from "../keys/x509.js";
+import { createCredentialProvider } from "../gates/credential-provider.js";
 import { hostTuning } from "../tuning.js";
 export async function startGates(options) {
     const { gates, logger, database } = options;
@@ -159,7 +160,8 @@ export async function startGates(options) {
 /**
  * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
  * Tenant's public keys and reading its sandboxes from the same database as the gates, where it
- * also records each connection (R7.3).
+ * also records each connection (R7.3). With a credential provider, the hosts it lists for an
+ * Agent's owner are terminated and handed to it.
  */
 export async function startEgress(options) {
     const { database } = options;
@@ -194,6 +196,9 @@ export async function startEgress(options) {
                 return { key: pair.privateKey, cert };
             },
         },
+        ...(options.credentialProvider
+            ? { provider: createCredentialProvider(options.credentialProvider, { logger: options.logger }) }
+            : {}),
         ...options.gate,
     });
 }

package/dist/host/main.js

@@ -63,6 +63,7 @@ import { createRunGrants } from "../tenant/run-grants.js";
 import { runHarness } from "../harness/main.js";
 import { startHarnessListener } from "../harness-api/ws-server.js";
 import { httpSandboxesClient } from "../sandbox/pods/client.js";
+import { createCredentialProvider } from "../gates/credential-provider.js";
 import { retry } from "../retry.js";
 import { hostTuning, useHostTuning } from "../tuning.js";
 import { useHostIdentity } from "../vault/host-identity.js";
@@ -169,6 +170,7 @@ async function runGates(stack) {
         ...(stack.packing ? { packing: stack.packing } : {}),
         endpoints: describeEndpoints(stack.endpoints),
         objectStore: stack.objectStore ? "s3" : "none",
+        ...(stack.credentialProvider ? { credentialProvider: stack.credentialProvider.url } : {}),
     });
     warnRemovedSettings(stack, logger);
     const database = createDatabase(stack);
@@ -189,7 +191,13 @@ async function runGates(stack) {
             logger.info("gates_ready", { url: server.url });
         }
         if (stack.egress) {
-            const egress = await startEgress({ egress: stack.egress, database, hostRoot: resolveHostRoot(), logger });
+            const egress = await startEgress({
+                egress: stack.egress,
+                database,
+                hostRoot: resolveHostRoot(),
+                logger,
+                ...(stack.credentialProvider ? { credentialProvider: stack.credentialProvider } : {}),
+            });
             servers.push(egress);
             logger.info("egress_ready", { url: egress.url });
         }
@@ -271,6 +279,7 @@ export async function main() {
         endpoints: describeEndpoints(stack.endpoints),
         objectStore: stack.objectStore ? "s3" : "fs",
         traces: stack.traces?.export ? "otlp" : "off",
+        ...(stack.credentialProvider ? { credentialProvider: stack.credentialProvider.url } : {}),
     });
     const infra = createInfra(stack, { logger });
     const database = infra.database;
@@ -377,6 +386,10 @@ export async function main() {
             harnessImage: stack.sandboxes.harnessImage,
         }
         : undefined;
+    // The outside credential provider: each pod Agent segment's variables it names (CP-E).
+    const credentialProvider = stack.credentialProvider
+        ? createCredentialProvider(stack.credentialProvider, { logger })
+        : undefined;
     const tenantSettings = stack.tenant ?? { name: "default" };
     const module = createTenantModule({
         open: createPostgresTenantOpener({
@@ -404,6 +417,7 @@ export async function main() {
                 ...(blobs ? { blobs } : {}),
                 ...(stack.harnessMode === "remote" ? { harness: "remote" } : {}),
                 ...(pods ? { pods } : {}),
+                ...(credentialProvider ? { credentialProvider } : {}),
                 ...(stack.traces
                     ? { traces: { resource: stack.traces.resource, content: new Set(stack.traces.content) } }
                     : {}),

package/dist/host/stack-config.d.ts

@@ -42,7 +42,9 @@
  * their source (`OTEL_SERVICE_NAME`, `OTEL_RESOURCE_ATTRIBUTES`) and which content they carry
  * (`NYLORUN_TRACE_CONTENT`, or all of it with `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`).
  * So is the Host tuning (`NYLORUN_TUNING`, `tuning.ts`), for every service: its timings,
- * retries and internal sizes.
+ * retries and internal sizes. So is the outside credential provider
+ * (`NYLORUN_CREDENTIAL_PROVIDER_URL`, `NYLORUN_CREDENTIAL_PROVIDER_TOKEN`), for egress-gate and
+ * a process running core or loop (`gates/credential-provider.ts`).
  */
 import { type TraceResource } from "../traces/otlp.js";
 import { type TraceContentKind } from "../traces/map.js";
@@ -193,6 +195,15 @@ export interface StackConfig {
      * own identity (ADR-71, `vault/host-identity.ts`). Absent: none.
      */
     modelHostIdentity?: string[];
+    /**
+     * `NYLORUN_CREDENTIAL_PROVIDER_URL` and `NYLORUN_CREDENTIAL_PROVIDER_TOKEN`, for a process running
+     * egress, core or loop (Host feature `credential-provider`): the outside service egress-gate
+     * hands an Agent owner's connected hosts to, and core asks for their variables. Absent: none.
+     */
+    credentialProvider?: {
+        url: string;
+        token: string;
+    };
     /** Present when the process runs gates. */
     gates?: GatesConfig;
     /** Present when the process runs egress. */

package/dist/host/stack-config.js

@@ -42,7 +42,9 @@
  * their source (`OTEL_SERVICE_NAME`, `OTEL_RESOURCE_ATTRIBUTES`) and which content they carry
  * (`NYLORUN_TRACE_CONTENT`, or all of it with `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`).
  * So is the Host tuning (`NYLORUN_TUNING`, `tuning.ts`), for every service: its timings,
- * retries and internal sizes.
+ * retries and internal sizes. So is the outside credential provider
+ * (`NYLORUN_CREDENTIAL_PROVIDER_URL`, `NYLORUN_CREDENTIAL_PROVIDER_TOKEN`), for egress-gate and
+ * a process running core or loop (`gates/credential-provider.ts`).
  */
 import { DEFAULT_SERVICE_NAME } from "../traces/otlp.js";
 import { TRACE_CONTENT_KINDS } from "../traces/map.js";
@@ -329,6 +331,7 @@ export function parseStackConfig(env, argv) {
     const tenant = servesApi ? parseTenant(env) : undefined;
     const workloadToken = parseWorkloadToken(env);
     const modelHostIdentity = parseModelHostIdentity(env);
+    const credentialProvider = servesApi || services.has("egress") ? parseCredentialProvider(env) : undefined;
     const objectStore = parseObjectStore(env);
     const traces = services.has("core") ? parseTraces(env) : undefined;
     const removedResolverVariables = Object.keys(env)
@@ -353,6 +356,7 @@ export function parseStackConfig(env, argv) {
         ...(tenant ? { tenant } : {}),
         ...(workloadToken ? { workloadToken } : {}),
         ...(modelHostIdentity ? { modelHostIdentity } : {}),
+        ...(credentialProvider ? { credentialProvider } : {}),
         ...(objectStore ? { objectStore } : {}),
         ...(traces ? { traces } : {}),
         ...(tuning ? { tuning } : {}),
@@ -483,6 +487,33 @@ function parseModelHostIdentity(env) {
     }
     return providers.length ? providers : undefined;
 }
+/**
+ * `StackConfig.credentialProvider`: the provider's `http` or `https` base URL (no credentials,
+ * query or fragment; `http` is for a provider on the Docker bridge or the machine itself) and its
+ * token, each required with the other.
+ */
+function parseCredentialProvider(env) {
+    const raw = read(env, "NYLORUN_CREDENTIAL_PROVIDER_URL");
+    const token = read(env, "NYLORUN_CREDENTIAL_PROVIDER_TOKEN");
+    if (raw === undefined && token === undefined)
+        return undefined;
+    if (raw === undefined)
+        throw new StackConfigError("NYLORUN_CREDENTIAL_PROVIDER_TOKEN is set without NYLORUN_CREDENTIAL_PROVIDER_URL: set the provider's base URL, such as http://172.17.0.1:18793/edge/provider");
+    if (token === undefined)
+        throw new StackConfigError("NYLORUN_CREDENTIAL_PROVIDER_TOKEN is required with NYLORUN_CREDENTIAL_PROVIDER_URL: the bearer the provider accepts");
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new StackConfigError(`NYLORUN_CREDENTIAL_PROVIDER_URL is not a URL: ${raw}`);
+    }
+    if ((url.protocol !== "http:" && url.protocol !== "https:") || url.username || url.password || url.search || url.hash)
+        throw new StackConfigError("NYLORUN_CREDENTIAL_PROVIDER_URL must be an http or https base URL with no credentials, query or fragment, such as http://172.17.0.1:18793/edge/provider");
+    if (token.length < 16 || !/^[\x21-\x7e]+$/.test(token))
+        throw new StackConfigError("NYLORUN_CREDENTIAL_PROVIDER_TOKEN must be at least 16 printable characters with no spaces");
+    return { url: `${url.origin}${url.pathname}`.replace(/\/+$/, ""), token };
+}
 /** `NYLORUN_WORKLOAD_TOKEN_ORIGINS`: each an `https` origin (`http` only to a loopback host). */
 function parseOrigins(raw) {
     if (raw === undefined)

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.33.0-beta",
+    "version": "0.34.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -36,7 +36,8 @@
         "gateway-credentials",
         "agent-folders",
         "session-model",
-        "model-host-identity"
+        "model-host-identity",
+        "credential-provider"
       ]
     },
     "description": "For operators: the Tenant's models, vaults, signing keys, settings and application keys, at `/v1/tenant/*` on the Tenant's URL, through `@nylorun/admin`. Every operation takes a management key, acting as itself: never for a subject and never from a browser. Management keys are issued only on the Tenant's machine (`nylorun tenant keys put <id> --management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`."

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.33.0-beta",
+    "version": "0.34.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -36,7 +36,8 @@
         "gateway-credentials",
         "agent-folders",
         "session-model",
-        "model-host-identity"
+        "model-host-identity",
+        "credential-provider"
       ]
     },
     "description": "For developers: agent manifests, Agents, sessions (with AG-UI and A2A) and artifacts, through `@nylorun/agents`. Every Tenant serves it on its one URL, beside the Management API (`/openapi/management.json`). Every request sends `Nylorun-Protocol`. Who may call each operation is its `security` and its `x-nylorun-credentials` and `x-nylorun-scopes` (the subject scopes that reach it) fields: an application key (servers) or a trusted issuer's token (browsers and apps)."

package/dist/tenant/context.d.ts

@@ -28,6 +28,7 @@ import type { McpDiagnostic, McpSnapshot } from "../mcp/snapshot.js";
 import type { HarnessApiServer } from "../harness-api/server.js";
 import type { WorkspacePort } from "../harness-api/workspace.js";
 import type { SandboxesClient } from "../sandbox/pods/client.js";
+import type { CredentialProvider } from "../gates/credential-provider.js";
 import type { SandboxSignal } from "../execution/types.js";
 import type { TenantConfig } from "./types.js";
 import type { SessionStreams } from "./session-streams.js";
@@ -290,6 +291,11 @@ export interface TenantContext {
      * Absent without a cluster (`nylorun local sandbox enable`): kind `pod` is `agent_unavailable`.
      */
     readonly pods?: TenantPods;
+    /**
+     * The outside credential provider (`gates/credential-provider.ts`): the variables a pod Agent's
+     * segments set to the stand-in for its owner. Absent: none.
+     */
+    readonly credentialProvider?: CredentialProvider;
     /**
      * Seam: reconcile a pod sandbox, or arm one of its timers (`DurableExecution.sandbox`),
      * outside any tx. What a transaction causes goes through `t.signalSandbox` instead, which

package/dist/tenant/runtime.d.ts

@@ -15,6 +15,7 @@ import { type HarnessPeer } from "../harness-api/server.js";
 import { type HostAuthority } from "../sandbox/join.js";
 import type { TenantPods } from "./context.js";
 import type { TraceOptions } from "../traces/options.js";
+import type { CredentialProvider } from "../gates/credential-provider.js";
 /** TENANTS-CCR: test/injection hooks until TenantConfig gains them. */
 export type TenantOpenHooks = {
     modelProvider?: ModelProvider;
@@ -84,6 +85,11 @@ export type TenantOpenHooks = {
      * pods copy the engine from. Without it, kind `pod` is `agent_unavailable`.
      */
     pods?: TenantPods;
+    /**
+     * The outside credential provider (`NYLORUN_CREDENTIAL_PROVIDER_*`): a pod Agent's segments set
+     * the variables it names for the Agent's owner to the stand-in, under the vault's own.
+     */
+    credentialProvider?: CredentialProvider;
     /** How the trace route makes spans (R7.5): the Host's `OTEL_*` resource and content opt-ins. */
     traces?: TraceOptions;
 } & OpenedTenant;

package/dist/tenant/runtime.js

@@ -261,6 +261,7 @@ export class TenantRuntime {
                 },
                 abortLocal: (sessionId, turnId) => abortLocal(ctx, sessionId, "cancel", turnId),
                 ...(hooks.pods ? { pods: hooks.pods } : {}),
+                ...(hooks.credentialProvider ? { credentialProvider: hooks.credentialProvider } : {}),
                 sandboxSignal: async (sandboxId, signal) => {
                     if (ctx.closing || ctx.closed)
                         return false;

package/dist/tuning.d.ts

@@ -240,6 +240,12 @@ export declare const HostTuningSchema: z.ZodObject<{
         credentialsHeadersTimeoutMs: z.ZodDefault<z.ZodNumber>;
         credentialsMaxSockets: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strict>>;
+    credentialProvider: z.ZodPrefault<z.ZodObject<{
+        cacheMs: z.ZodDefault<z.ZodNumber>;
+        retryMs: z.ZodDefault<z.ZodNumber>;
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        cacheEntries: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
     pods: z.ZodPrefault<z.ZodObject<{
         readyDeadlineMs: z.ZodDefault<z.ZodNumber>;
         pollMs: z.ZodDefault<z.ZodNumber>;

package/dist/tuning.js

@@ -386,6 +386,20 @@ export const HostTuningSchema = z
         /** The upstream sockets one such tunnel opens at once. */
         credentialsMaxSockets: count(8),
     }),
+    /**
+     * The outside credential provider (`NYLORUN_CREDENTIAL_PROVIDER_URL`), which egress-gate asks
+     * for an Agent's connected hosts and core for its variables (`gates/credential-provider.ts`).
+     */
+    credentialProvider: group({
+        /** How long an Agent's answer (hosts, or variables) is reused. */
+        cacheMs: ms(15_000, 0),
+        /** How long a failed answer (nothing) is reused before the provider is asked again. */
+        retryMs: ms(5_000, 0),
+        /** How long one `hosts` or `environment` call may take. */
+        timeoutMs: ms(3_000),
+        /** How many Agents' answers are kept. */
+        cacheEntries: count(4_096),
+    }),
     /** Sandbox pods through the sandboxes service (F7.2). */
     pods: group({
         /** How long a pod may take to be ready before its start fails. */

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.33.0-beta";
+export declare const RUNTIME_VERSION = "0.34.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.33.0-beta";
+export const RUNTIME_VERSION = "0.34.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.33.0-beta",
+  "version": "0.34.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -59,14 +59,14 @@
     "db:studio": "drizzle-kit studio"
   },
   "dependencies": {
-    "@ag-ui/core": "~1.0.2",
+    "@ag-ui/core": "~1.0.3",
     "@asteasolutions/zod-to-openapi": "^9.1.0",
     "@earendil-works/pi-ai": "1.3.0",
     "@hono/node-server": "^2.1.5",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.29.0-beta",
-    "@nylorun/harness": "0.29.5-beta",
+    "@nylorun/core": "0.30.0-beta",
+    "@nylorun/harness": "0.29.6-beta",
     "@restatedev/restate-sdk": "1.17.3",
     "@restatedev/restate-sdk-clients": "1.17.3",
     "@s2-dev/streamstore": "0.28.0",
@@ -85,7 +85,7 @@
   },
   "devDependencies": {
     "@a2a-js/sdk": "~1.3.0",
-    "@ag-ui/client": "1.0.2",
+    "@ag-ui/client": "1.0.3",
     "@scalar/openapi-parser": "^0.29.13",
     "@types/node": "^26.6.5",
     "@types/pg": "^8.23.1",