@nylorun/runtime 0.34.0-beta → 0.35.0-beta

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.35.0-beta
+
+### Minor Changes
+
+- 1376d3e: The outside credential provider can name host patterns, stand-ins and plain values (no protocol change). `POST /v1/hosts` may now answer `*.<suffix>` entries, such as `*.googleapis.com`, beside exact host names: egress-gate matches them as it matches `network.allow`, so `run.googleapis.com` and `a.b.googleapis.com` pass and `googleapis.com` itself does not. They still pass on 443 only, inside the Tenant's egress ceiling, a secret of the vault bound to the same host still wins, and `nylorun-provider-host` is still the host the sandbox addressed; an IP literal or a malformed entry is dropped. `POST /v1/environment` may now answer, for each variable, `{ name, standIn }`, which sets it to that stand-in (one shaped like the vendor's keys, for a CLI that checks a key's format), or `{ name, value }`, which sets it to that plain value (a setting beside a key, never a secret), beside a bare name, which is still `nylorun_managed`. A `standIn` or `value` is 1 to 1,024 printable characters with no control character or line break; any other entry is dropped, and the first entry for a name wins. The vault's own variables still win, and an older provider's names-only answer works as before.
+
 ## 0.34.0-beta
 
 ### Minor Changes

package/dist/gates/credential-provider.d.ts

@@ -12,6 +12,12 @@ export declare const PROVIDER_HEADERS: {
 };
 /** Every header of this prefix a sandbox sends is dropped before the engine sets its own. */
 export declare const PROVIDER_HEADER_PREFIX = "nylorun-provider-";
+/** One variable a pod Agent's segments set: its name and the value the sandbox sees. */
+export interface ProviderVariable {
+    readonly name: string;
+    /** The stand-in (`nylorun_managed` unless the provider names another) or a plain value. */
+    readonly value: string;
+}
 /** Where the provider is and its token (`StackConfig.credentialProvider`). */
 export interface CredentialProviderSettings {
     /** `NYLORUN_CREDENTIAL_PROVIDER_URL`, without a trailing slash. */
@@ -22,9 +28,15 @@ export interface CredentialProviderSettings {
 export interface CredentialProvider {
     /** The provider's base URL, without a trailing slash. */
     readonly url: string;
-    /** The variables to set to the stand-in for `agentId`'s sessions; none without an owner. */
-    environment(agentId: string, owner: string | undefined): Promise<readonly string[]>;
-    /** The exact host names `owner`'s keys are bound to (lowercase); none without an owner. */
+    /**
+     * The variables `agentId`'s sessions set, each with its stand-in or plain value; none without
+     * an owner.
+     */
+    environment(agentId: string, owner: string | undefined): Promise<readonly ProviderVariable[]>;
+    /**
+     * The hosts `owner`'s keys are bound to (lowercase): exact names and `*.<suffix>` patterns, to
+     * match as `network.allow`'s do (`egressAllows`); none without an owner.
+     */
     hosts(agentId: string, owner: string | undefined): Promise<readonly string[]>;
     /** Where one request to `path` (origin form, `/v2/projects?x=1`) is handed. */
     forwardUrl(path: string): URL;

package/dist/gates/credential-provider.js

@@ -6,11 +6,19 @@
  * here runs.
  *
  * Three calls, each with `Authorization: Bearer <token>`:
- * - `POST <url>/v1/hosts` `{ agentId, owner }` → `{ hosts: string[] }`: the exact host names the
- *   owner's keys are bound to. egress-gate lets a pod Agent's sandbox reach them (inside the
- *   Tenant's egress ceiling), terminates TLS for them on 443 and hands each request on;
- * - `POST <url>/v1/environment` `{ agentId, owner }` → `{ variables: string[] }`: the variables
- *   each of a pod Agent's segments sets to the stand-in `nylorun_managed`, under the vault's own;
+ * - `POST <url>/v1/hosts` `{ agentId, owner }` → `{ hosts: string[] }`: the hosts the owner's keys
+ *   are bound to, each an exact host name or a `*.<suffix>` pattern (`*.googleapis.com`, v0.26
+ *   TM-E1). A pattern matches as `network.allow`'s do: `run.googleapis.com` and
+ *   `a.b.googleapis.com`, never `googleapis.com` itself. An IP literal or a malformed entry is
+ *   dropped. egress-gate lets a pod Agent's sandbox reach them (inside the Tenant's egress
+ *   ceiling), terminates TLS for them on 443 and hands each request on;
+ * - `POST <url>/v1/environment` `{ agentId, owner }` → `{ variables: Entry[] }`: the variables each
+ *   of a pod Agent's segments sets, under the vault's own (v0.26 TM-E2). An entry is a name (`"X"`,
+ *   set to the stand-in `nylorun_managed`, as before v0.26), `{ name, standIn }` (set to that
+ *   stand-in, shaped like the vendor's keys) or `{ name, value }` (set to that plain value, a
+ *   setting beside a key and never a secret). A `standIn` or `value` is 1 to 1,024 printable
+ *   characters, with no control character or line break; an entry with anything else, or a name
+ *   a shell can't set, is dropped, and the first entry for a name wins;
  * - `ANY <url>/v1/forward/<path and query>`: one request of the sandbox's, with its headers as it
  *   sent them (its own `Authorization` or inject header included, which the provider replaces),
  *   plus `nylorun-provider-host`, `-agent`, `-owner` and, in place of a bearer the sandbox's own
@@ -23,6 +31,7 @@
  * answers nothing, kept for `retryMs`, so the gate refuses what it refused before; it is logged
  * once until a call succeeds again. The token is never logged.
  */
+import { ENVIRONMENT_SECRET_SENTINEL } from "@nylorun/core/contracts";
 import { isSandboxHostPattern } from "@nylorun/core/define";
 import { hostTuning } from "../tuning.js";
 /** The headers the engine adds to a request it hands to the provider's forward route. */
@@ -42,6 +51,8 @@ export const PROVIDER_HEADER_PREFIX = "nylorun-provider-";
 const ANSWER_MAX = 256;
 /** A variable name a shell can set. */
 const VARIABLE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+/** A stand-in or plain value: 1 to 1,024 printable characters, no control character or line break. */
+const VALUE = /^[^\p{Cc}\p{Cs}\p{Zl}\p{Zp}]{1,1024}$/u;
 export function createCredentialProvider(settings, options) {
     const url = settings.url.replace(/\/+$/, "");
     const { logger } = options;
@@ -89,11 +100,7 @@ export function createCredentialProvider(settings, options) {
             return fail(call, agentId, "shape");
         if (failing.delete(call))
             logger.info("credential_provider_recovered", { call });
-        const items = list.filter((item) => typeof item === "string").slice(0, ANSWER_MAX);
-        const value = call === "hosts"
-            ? [...new Set(items.map((host) => host.toLowerCase().replace(/\.$/, "")).filter(isExactHost))]
-            : [...new Set(items.filter((name) => VARIABLE.test(name)))];
-        return { ok: true, value };
+        return { ok: true, value: call === "hosts" ? hostsOf(list) : variablesOf(list) };
     }
     function answer(call, agentId, owner) {
         if (owner === undefined || owner === "")
@@ -134,7 +141,41 @@ export function createCredentialProvider(settings, options) {
         }),
     };
 }
-/** An exact host name (no `*.` pattern, no IP literal), as egress-gate serves. */
-function isExactHost(host) {
-    return !host.startsWith("*.") && isSandboxHostPattern(host);
+/**
+ * The hosts of a `/v1/hosts` answer: exact host names and `*.<suffix>` patterns, lowercase, without
+ * a trailing root dot, once each; an IP literal or a malformed entry is dropped.
+ */
+function hostsOf(list) {
+    const items = list.filter((item) => typeof item === "string").slice(0, ANSWER_MAX);
+    return [...new Set(items.map((host) => host.toLowerCase().replace(/\.$/, "")).filter(isSandboxHostPattern))];
+}
+/**
+ * The variables of a `/v1/environment` answer, each with the value the sandbox sees: a bare name is
+ * the stand-in `nylorun_managed`, `{ name, standIn }` that stand-in, `{ name, value }` that value.
+ * Any other entry is dropped, and the first entry for a name wins.
+ */
+function variablesOf(list) {
+    const variables = new Map();
+    for (const item of list) {
+        if (variables.size >= ANSWER_MAX)
+            break;
+        const variable = variableOf(item);
+        if (variable && !variables.has(variable.name))
+            variables.set(variable.name, variable);
+    }
+    return [...variables.values()];
+}
+function variableOf(item) {
+    if (typeof item === "string")
+        return VARIABLE.test(item) ? { name: item, value: ENVIRONMENT_SECRET_SENTINEL } : undefined;
+    if (typeof item !== "object" || item === null || Array.isArray(item))
+        return undefined;
+    const { name, standIn, value } = item;
+    if (typeof name !== "string" || !VARIABLE.test(name))
+        return undefined;
+    // Exactly one of the two: an entry naming both, or neither, is not one the engine can read.
+    if ((standIn === undefined) === (value === undefined))
+        return undefined;
+    const set = standIn ?? value;
+    return typeof set === "string" && VALUE.test(set) ? { name, value: set } : undefined;
 }

package/dist/gates/egress.js

@@ -12,7 +12,8 @@
  *    else 407;
  * 3. the port is 443 or 80, the target is a host name and no IP literal, and it matches the spec's
  *    `network.allow` exactly or by `*.suffix`, or (443 only) the outside credential provider lists
- *    it for the Agent's owner and the Tenant's egress ceiling holds it, else 403;
+ *    it for the Agent's owner, exactly or by `*.suffix` likewise, and the Tenant's egress ceiling
+ *    holds it, else 403;
  * 4. the sandbox has fewer than `maxPerSandbox` tunnels open, else 429;
  * 5. the name resolves, and to at least one address that is not private, loopback, link-local
  *    (cloud metadata included), multicast or reserved, else 502 or 403;
@@ -227,15 +228,18 @@ export async function startEgressGate(options) {
         : undefined;
     const provider = terminator ? options.provider : undefined;
     /**
-     * Whether the credential provider lists `host` for the sandbox's owner, inside the Tenant's
-     * ceiling: only on 443, where the gate terminates TLS, and never for an Agent without an owner.
+     * Whether the credential provider lists `host` for the sandbox's owner, exactly or by a
+     * `*.suffix` pattern (`*.x.com` holds `a.x.com` and `b.a.x.com`, not `x.com`), inside the
+     * Tenant's ceiling: only on 443, where the gate terminates TLS, and never for an Agent without an
+     * owner. The request still names the host the sandbox addressed (`nylorun-provider-host`).
      */
     async function providerLists(sandboxId, sandbox, host, port) {
         if (!provider || port !== 443 || sandbox.owner === undefined)
             return false;
         if (sandbox.ceiling && !withinCeiling(host, sandbox.ceiling))
             return false;
-        return (await provider.hosts(sandboxId, sandbox.owner)).includes(host);
+        // An exact name or a `*.suffix` pattern, matched as `network.allow`'s are (v0.26 TM-E1).
+        return egressAllows(host, await provider.hosts(sandboxId, sandbox.owner));
     }
     const open = new Map();
     const tunnels = new Set();

package/dist/harness-api/start.js

@@ -7,10 +7,11 @@
  *
  * A pod Agent's sandbox variables are its vault's (R2c), then, with an outside credential
  * provider (`gates/credential-provider.ts`) and an owner on the Agent, each variable the provider
- * names for that owner, set to the stand-in `nylorun_managed` and never over a vault variable.
+ * names for that owner, set to the value it gives (the stand-in `nylorun_managed`, a stand-in of
+ * its own or a plain value) and never over a vault variable.
  * The provider is asked after the transaction, and one that fails adds nothing.
  */
-import { ENVIRONMENT_SECRET_SENTINEL, harnessLimitsOf } from "@nylorun/core/contracts";
+import { harnessLimitsOf } from "@nylorun/core/contracts";
 import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
 import { isWorkflowManifest } from "../core/flow-host.js";
 import { sandboxWorkspaceOf } from "../sandbox/share.js";
@@ -114,18 +115,19 @@ options = {}) {
     return { ...started, transcript, cursor };
 }
 /**
- * `opened` with the credential provider's variables for `ask` added to its sandbox's environment
- * as the stand-in, under the vault's own; `opened` itself when there are none.
+ * `opened` with the credential provider's variables for `ask` added to its sandbox's environment,
+ * each with the value the provider gives (a stand-in or a plain value), under the vault's own;
+ * `opened` itself when there are none.
  */
 async function withProviderVariables(ctx, opened, ask) {
     if (!ask || !ctx.credentialProvider)
         return opened;
-    const names = await ctx.credentialProvider.environment(ask.agentId, ask.owner);
+    const variables = await ctx.credentialProvider.environment(ask.agentId, ask.owner);
     const vault = opened.sandbox.environment ?? {};
-    const added = names.filter((name) => !Object.hasOwn(vault, name));
+    const added = variables.filter(({ name }) => !Object.hasOwn(vault, name));
     if (added.length === 0)
         return opened;
-    const environment = { ...Object.fromEntries(added.map((name) => [name, ENVIRONMENT_SECRET_SENTINEL])), ...vault };
+    const environment = { ...Object.fromEntries(added.map(({ name, value }) => [name, value])), ...vault };
     return { ...opened, sandbox: { ...opened.sandbox, environment } };
 }
 /** The run's `turn.start`. */

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.34.0-beta",
+    "version": "0.35.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.34.0-beta",
+    "version": "0.35.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.34.0-beta";
+export declare const RUNTIME_VERSION = "0.35.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.34.0-beta";
+export const RUNTIME_VERSION = "0.35.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.34.0-beta",
+  "version": "0.35.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",