@nylorun/runtime 0.34.0-beta → 0.36.0-beta

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.36.0-beta
+
+### Minor Changes
+
+- 27253ea: A pod starts faster and its commands can install what they need (ADR-92).
+
+  - **The pod copies a bundled engine.** The Runtime image ships the pod's engine (`--service harness`) bundled into one script, with the one native addon it loads, as `/engine`: 12 files instead of `/app`'s ~30,000. The sandboxes service's `nylo-copy` copies `/engine` when the image has it, and `/app` otherwise, and the workload runs `/nylo/entry.mjs`. On beta's GKE cluster the copy went from 6–29 s to 0.2 s, and the engine's start from 7.2 s to 3.7 s.
+  - **A pod's disk is owned once:** `fsGroupChangePolicy: OnRootMismatch`. A mount of a disk holding 91,000 files went from 15–21 s to 3–8 s.
+  - **Commands run with bash** where the image has it (`/bin/bash -c`), as the `bash` tool says; `/bin/sh -c` only in an image without bash.
+  - **Node uses the proxy.** `NODE_USE_ENV_PROXY=1` joins the proxy variables a pod's commands get, so Node's `fetch`, and corepack's pnpm and yarn, reach the egress gate.
+  - **The dev preset allows toolchain downloads:** `nodejs.org`, `releases.astral.sh`, `static.rust-lang.org`, `sh.rustup.rs`, `dl.google.com`, `mise-versions.jdx.dev`, `tuf-repo-cdn.sigstore.dev`, and `release-assets.githubusercontent.com`, where GitHub's release downloads now redirect.
+  - **The egress gate checks the server name.** On a 443 tunnel, the gate reads the client's TLS ClientHello and closes the tunnel when its server name (SNI) isn't the CONNECT host, is missing, or the bytes aren't TLS, recording the refusal (`sni_mismatch`, `sni_missing`, `sni_invalid`, `sni_timeout`). A tunnel to an allowed host can no longer ask a shared front end for another one.
+
+## 0.35.0-beta
+
+### Minor Changes
+
+- 1376d3e: The outside credential provider can name host patterns, stand-ins and plain values (no protocol change). `POST /v1/hosts` may now answer `*.<suffix>` entries, such as `*.googleapis.com`, beside exact host names: egress-gate matches them as it matches `network.allow`, so `run.googleapis.com` and `a.b.googleapis.com` pass and `googleapis.com` itself does not. They still pass on 443 only, inside the Tenant's egress ceiling, a secret of the vault bound to the same host still wins, and `nylorun-provider-host` is still the host the sandbox addressed; an IP literal or a malformed entry is dropped. `POST /v1/environment` may now answer, for each variable, `{ name, standIn }`, which sets it to that stand-in (one shaped like the vendor's keys, for a CLI that checks a key's format), or `{ name, value }`, which sets it to that plain value (a setting beside a key, never a secret), beside a bare name, which is still `nylorun_managed`. A `standIn` or `value` is 1 to 1,024 printable characters with no control character or line break; any other entry is dropped, and the first entry for a name wins. The vault's own variables still win, and an older provider's names-only answer works as before.
+
 ## 0.34.0-beta
 
 ### Minor Changes

package/dist/adapters/sandbox/local.d.ts

@@ -8,11 +8,18 @@ export interface LocalBackendOptions {
     readonly env: Readonly<Record<string, string | undefined>>;
     /** The engine's `/harness` on the same volume, a disk root of its versions (R2d step 3). */
     readonly harnessRoot?: string;
+    /** The shell commands run under; default `/bin/bash` where the image has it, else `/bin/sh`. */
+    readonly shell?: string;
 }
 /**
- * How the pod runs a command: `/bin/sh -c` in its own process group, with the base environment,
- * the request's variables and the proxy of the moment. The sandbox tools and the disk's setup
- * (`harness/setup.ts`) both run commands this way.
+ * The shell the `bash` tool's commands run under: bash, as the tool says, where the image has it;
+ * `/bin/sh` (dash on Debian and Ubuntu) only in an image without it (ADR-92 §10).
+ */
+export declare function commandShell(exists?: (path: string) => boolean): string;
+/**
+ * How the pod runs a command: `bash -c` (`sh -c` in an image without bash) in its own process
+ * group, with the base environment, the request's variables and the proxy of the moment. The
+ * sandbox tools and the disk's setup (`harness/setup.ts`) both run commands this way.
  */
 export declare function localExec(options: LocalBackendOptions): (request: ExecRequest, signal: AbortSignal) => Promise<ExecResult>;
 export declare function localBackend(options: LocalBackendOptions): SandboxBackend;

package/dist/adapters/sandbox/local.js

@@ -17,6 +17,22 @@ import { posix } from "node:path";
 import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
 import { SandboxFileTooLargeError } from "../../sandbox/types.js";
 import { hostTuning } from "../../tuning.js";
+/**
+ * The shell the `bash` tool's commands run under: bash, as the tool says, where the image has it;
+ * `/bin/sh` (dash on Debian and Ubuntu) only in an image without it (ADR-92 §10).
+ */
+export function commandShell(exists = executable) {
+    return exists("/bin/bash") ? "/bin/bash" : "/bin/sh";
+}
+function executable(path) {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /** This process's environment without the engine's own variables. */
 function baseEnv(env, workspace) {
     const out = {};
@@ -53,16 +69,17 @@ function collector() {
     };
 }
 /**
- * How the pod runs a command: `/bin/sh -c` in its own process group, with the base environment,
- * the request's variables and the proxy of the moment. The sandbox tools and the disk's setup
- * (`harness/setup.ts`) both run commands this way.
+ * How the pod runs a command: `bash -c` (`sh -c` in an image without bash) in its own process
+ * group, with the base environment, the request's variables and the proxy of the moment. The
+ * sandbox tools and the disk's setup (`harness/setup.ts`) both run commands this way.
  */
 export function localExec(options) {
     const env = baseEnv(options.env, options.workspace ?? SANDBOX_WORKSPACE);
+    const shell = options.shell ?? commandShell();
     return (request, signal) => new Promise((resolve, reject) => {
         if (signal.aborted)
             return reject(signal.reason ?? new Error("Turn cancelled"));
-        const child = spawn("/bin/sh", ["-c", request.command], {
+        const child = spawn(shell, ["-c", request.command], {
             cwd: request.cwd,
             env: { ...env, ...(request.env ?? {}), ...(options.proxyEnv?.() ?? {}) },
             stdio: ["ignore", "pipe", "pipe"],

package/dist/gates/client-hello.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The server name (SNI) in a TLS ClientHello, read from the first bytes a client sends through a
+ * tunnel (ADR-92 §11). egress-gate compares it with the CONNECT host, so a tunnel opened to an
+ * allowed host can't ask a shared front end for another one (domain fronting by SNI).
+ *
+ * The ClientHello may span several TLS records; they are reassembled up to `MAX_HELLO_BYTES`.
+ */
+/** A ClientHello is far smaller; one that isn't complete by here is refused. */
+export declare const MAX_HELLO_BYTES: number;
+export type ClientHelloRead = 
+/** More bytes are needed. */
+{
+    readonly status: "incomplete";
+}
+/** Not a TLS ClientHello. */
+ | {
+    readonly status: "invalid";
+    readonly reason: string;
+}
+/** A whole ClientHello; `serverName` is lowercase, or undefined when it names none. */
+ | {
+    readonly status: "complete";
+    readonly serverName?: string;
+};
+/** Reads the ClientHello at the start of `data`, the bytes a client has sent so far. */
+export declare function readClientHello(data: Buffer): ClientHelloRead;

package/dist/gates/client-hello.js

@@ -0,0 +1,103 @@
+/**
+ * The server name (SNI) in a TLS ClientHello, read from the first bytes a client sends through a
+ * tunnel (ADR-92 §11). egress-gate compares it with the CONNECT host, so a tunnel opened to an
+ * allowed host can't ask a shared front end for another one (domain fronting by SNI).
+ *
+ * The ClientHello may span several TLS records; they are reassembled up to `MAX_HELLO_BYTES`.
+ */
+/** A ClientHello is far smaller; one that isn't complete by here is refused. */
+export const MAX_HELLO_BYTES = 64 * 1024;
+const RECORD_HANDSHAKE = 0x16;
+const HANDSHAKE_CLIENT_HELLO = 0x01;
+const EXTENSION_SERVER_NAME = 0x0000;
+const NAME_TYPE_HOST = 0x00;
+/** Reads the ClientHello at the start of `data`, the bytes a client has sent so far. */
+export function readClientHello(data) {
+    // The handshake message, reassembled from consecutive handshake records.
+    const chunks = [];
+    let have = 0;
+    let need;
+    let at = 0;
+    while (need === undefined || have < need) {
+        if (data.length < at + 5)
+            return data.length > MAX_HELLO_BYTES ? invalid("too long") : incomplete;
+        if (data[at] !== RECORD_HANDSHAKE)
+            return invalid("not a TLS handshake");
+        if (data[at + 1] !== 0x03)
+            return invalid("not a TLS record");
+        const length = data.readUInt16BE(at + 3);
+        if (length === 0)
+            return invalid("an empty record");
+        if (data.length < at + 5 + length)
+            return at + 5 + length > MAX_HELLO_BYTES ? invalid("too long") : incomplete;
+        const fragment = data.subarray(at + 5, at + 5 + length);
+        chunks.push(fragment);
+        have += fragment.length;
+        at += 5 + length;
+        if (need === undefined && have >= 4) {
+            const head = Buffer.concat(chunks);
+            if (head[0] !== HANDSHAKE_CLIENT_HELLO)
+                return invalid("not a ClientHello");
+            need = 4 + head.readUIntBE(1, 3);
+            if (need > MAX_HELLO_BYTES)
+                return invalid("too long");
+        }
+    }
+    return serverNameIn(Buffer.concat(chunks).subarray(4, need));
+}
+/** The server name in a ClientHello's body (after its 4-byte handshake header). */
+function serverNameIn(body) {
+    let at = 2 + 32; // client_version, random
+    if (body.length < at + 1)
+        return invalid("truncated");
+    at += 1 + body[at]; // session_id
+    if (body.length < at + 2)
+        return invalid("truncated");
+    at += 2 + body.readUInt16BE(at); // cipher_suites
+    if (body.length < at + 1)
+        return invalid("truncated");
+    at += 1 + body[at]; // compression_methods
+    if (body.length === at)
+        return { status: "complete" }; // no extensions
+    if (body.length < at + 2)
+        return invalid("truncated");
+    const end = at + 2 + body.readUInt16BE(at);
+    if (end > body.length)
+        return invalid("truncated");
+    at += 2;
+    while (at + 4 <= end) {
+        const type = body.readUInt16BE(at);
+        const length = body.readUInt16BE(at + 2);
+        const start = at + 4;
+        if (start + length > end)
+            return invalid("truncated");
+        if (type === EXTENSION_SERVER_NAME)
+            return hostIn(body.subarray(start, start + length));
+        at = start + length;
+    }
+    return { status: "complete" };
+}
+/** The host name in a server_name extension's data. */
+function hostIn(extension) {
+    if (extension.length < 2)
+        return invalid("truncated");
+    const end = Math.min(extension.length, 2 + extension.readUInt16BE(0));
+    let at = 2;
+    while (at + 3 <= end) {
+        const type = extension[at];
+        const length = extension.readUInt16BE(at + 1);
+        if (at + 3 + length > end)
+            return invalid("truncated");
+        if (type === NAME_TYPE_HOST) {
+            const name = extension.subarray(at + 3, at + 3 + length).toString("latin1");
+            // A host name is letters, digits, hyphens and dots; anything else (a NUL, a space) is refused.
+            if (!/^[A-Za-z0-9.-]+$/.test(name))
+                return invalid("a server name that isn't a host name");
+            return { status: "complete", serverName: name.toLowerCase().replace(/\.$/, "") };
+        }
+        at += 3 + length;
+    }
+    return { status: "complete" };
+}
+const incomplete = { status: "incomplete" };
+const invalid = (reason) => ({ status: "invalid", reason });

package/dist/gates/credential-provider.d.ts

@@ -12,6 +12,12 @@ export declare const PROVIDER_HEADERS: {
 };
 /** Every header of this prefix a sandbox sends is dropped before the engine sets its own. */
 export declare const PROVIDER_HEADER_PREFIX = "nylorun-provider-";
+/** One variable a pod Agent's segments set: its name and the value the sandbox sees. */
+export interface ProviderVariable {
+    readonly name: string;
+    /** The stand-in (`nylorun_managed` unless the provider names another) or a plain value. */
+    readonly value: string;
+}
 /** Where the provider is and its token (`StackConfig.credentialProvider`). */
 export interface CredentialProviderSettings {
     /** `NYLORUN_CREDENTIAL_PROVIDER_URL`, without a trailing slash. */
@@ -22,9 +28,15 @@ export interface CredentialProviderSettings {
 export interface CredentialProvider {
     /** The provider's base URL, without a trailing slash. */
     readonly url: string;
-    /** The variables to set to the stand-in for `agentId`'s sessions; none without an owner. */
-    environment(agentId: string, owner: string | undefined): Promise<readonly string[]>;
-    /** The exact host names `owner`'s keys are bound to (lowercase); none without an owner. */
+    /**
+     * The variables `agentId`'s sessions set, each with its stand-in or plain value; none without
+     * an owner.
+     */
+    environment(agentId: string, owner: string | undefined): Promise<readonly ProviderVariable[]>;
+    /**
+     * The hosts `owner`'s keys are bound to (lowercase): exact names and `*.<suffix>` patterns, to
+     * match as `network.allow`'s do (`egressAllows`); none without an owner.
+     */
     hosts(agentId: string, owner: string | undefined): Promise<readonly string[]>;
     /** Where one request to `path` (origin form, `/v2/projects?x=1`) is handed. */
     forwardUrl(path: string): URL;

package/dist/gates/credential-provider.js

@@ -6,11 +6,19 @@
  * here runs.
  *
  * Three calls, each with `Authorization: Bearer <token>`:
- * - `POST <url>/v1/hosts` `{ agentId, owner }` → `{ hosts: string[] }`: the exact host names the
- *   owner's keys are bound to. egress-gate lets a pod Agent's sandbox reach them (inside the
- *   Tenant's egress ceiling), terminates TLS for them on 443 and hands each request on;
- * - `POST <url>/v1/environment` `{ agentId, owner }` → `{ variables: string[] }`: the variables
- *   each of a pod Agent's segments sets to the stand-in `nylorun_managed`, under the vault's own;
+ * - `POST <url>/v1/hosts` `{ agentId, owner }` → `{ hosts: string[] }`: the hosts the owner's keys
+ *   are bound to, each an exact host name or a `*.<suffix>` pattern (`*.googleapis.com`, v0.26
+ *   TM-E1). A pattern matches as `network.allow`'s do: `run.googleapis.com` and
+ *   `a.b.googleapis.com`, never `googleapis.com` itself. An IP literal or a malformed entry is
+ *   dropped. egress-gate lets a pod Agent's sandbox reach them (inside the Tenant's egress
+ *   ceiling), terminates TLS for them on 443 and hands each request on;
+ * - `POST <url>/v1/environment` `{ agentId, owner }` → `{ variables: Entry[] }`: the variables each
+ *   of a pod Agent's segments sets, under the vault's own (v0.26 TM-E2). An entry is a name (`"X"`,
+ *   set to the stand-in `nylorun_managed`, as before v0.26), `{ name, standIn }` (set to that
+ *   stand-in, shaped like the vendor's keys) or `{ name, value }` (set to that plain value, a
+ *   setting beside a key and never a secret). A `standIn` or `value` is 1 to 1,024 printable
+ *   characters, with no control character or line break; an entry with anything else, or a name
+ *   a shell can't set, is dropped, and the first entry for a name wins;
  * - `ANY <url>/v1/forward/<path and query>`: one request of the sandbox's, with its headers as it
  *   sent them (its own `Authorization` or inject header included, which the provider replaces),
  *   plus `nylorun-provider-host`, `-agent`, `-owner` and, in place of a bearer the sandbox's own
@@ -23,6 +31,7 @@
  * answers nothing, kept for `retryMs`, so the gate refuses what it refused before; it is logged
  * once until a call succeeds again. The token is never logged.
  */
+import { ENVIRONMENT_SECRET_SENTINEL } from "@nylorun/core/contracts";
 import { isSandboxHostPattern } from "@nylorun/core/define";
 import { hostTuning } from "../tuning.js";
 /** The headers the engine adds to a request it hands to the provider's forward route. */
@@ -42,6 +51,8 @@ export const PROVIDER_HEADER_PREFIX = "nylorun-provider-";
 const ANSWER_MAX = 256;
 /** A variable name a shell can set. */
 const VARIABLE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+/** A stand-in or plain value: 1 to 1,024 printable characters, no control character or line break. */
+const VALUE = /^[^\p{Cc}\p{Cs}\p{Zl}\p{Zp}]{1,1024}$/u;
 export function createCredentialProvider(settings, options) {
     const url = settings.url.replace(/\/+$/, "");
     const { logger } = options;
@@ -89,11 +100,7 @@ export function createCredentialProvider(settings, options) {
             return fail(call, agentId, "shape");
         if (failing.delete(call))
             logger.info("credential_provider_recovered", { call });
-        const items = list.filter((item) => typeof item === "string").slice(0, ANSWER_MAX);
-        const value = call === "hosts"
-            ? [...new Set(items.map((host) => host.toLowerCase().replace(/\.$/, "")).filter(isExactHost))]
-            : [...new Set(items.filter((name) => VARIABLE.test(name)))];
-        return { ok: true, value };
+        return { ok: true, value: call === "hosts" ? hostsOf(list) : variablesOf(list) };
     }
     function answer(call, agentId, owner) {
         if (owner === undefined || owner === "")
@@ -134,7 +141,41 @@ export function createCredentialProvider(settings, options) {
         }),
     };
 }
-/** An exact host name (no `*.` pattern, no IP literal), as egress-gate serves. */
-function isExactHost(host) {
-    return !host.startsWith("*.") && isSandboxHostPattern(host);
+/**
+ * The hosts of a `/v1/hosts` answer: exact host names and `*.<suffix>` patterns, lowercase, without
+ * a trailing root dot, once each; an IP literal or a malformed entry is dropped.
+ */
+function hostsOf(list) {
+    const items = list.filter((item) => typeof item === "string").slice(0, ANSWER_MAX);
+    return [...new Set(items.map((host) => host.toLowerCase().replace(/\.$/, "")).filter(isSandboxHostPattern))];
+}
+/**
+ * The variables of a `/v1/environment` answer, each with the value the sandbox sees: a bare name is
+ * the stand-in `nylorun_managed`, `{ name, standIn }` that stand-in, `{ name, value }` that value.
+ * Any other entry is dropped, and the first entry for a name wins.
+ */
+function variablesOf(list) {
+    const variables = new Map();
+    for (const item of list) {
+        if (variables.size >= ANSWER_MAX)
+            break;
+        const variable = variableOf(item);
+        if (variable && !variables.has(variable.name))
+            variables.set(variable.name, variable);
+    }
+    return [...variables.values()];
+}
+function variableOf(item) {
+    if (typeof item === "string")
+        return VARIABLE.test(item) ? { name: item, value: ENVIRONMENT_SECRET_SENTINEL } : undefined;
+    if (typeof item !== "object" || item === null || Array.isArray(item))
+        return undefined;
+    const { name, standIn, value } = item;
+    if (typeof name !== "string" || !VARIABLE.test(name))
+        return undefined;
+    // Exactly one of the two: an entry naming both, or neither, is not one the engine can read.
+    if ((standIn === undefined) === (value === undefined))
+        return undefined;
+    const set = standIn ?? value;
+    return typeof set === "string" && VALUE.test(set) ? { name, value: set } : undefined;
 }

package/dist/gates/egress.d.ts

@@ -56,6 +56,8 @@ export interface StartEgressGateOptions {
     readonly cacheMs?: number;
     /** How long the gate waits for the upstream connection. Default `egress.connectTimeoutMs`. */
     readonly connectTimeoutMs?: number;
+    /** How long a 443 tunnel waits for the client's ClientHello. Default 15 s. */
+    readonly helloMs?: number;
     /** Tests replace name resolution. */
     readonly lookup?: (host: string) => Promise<readonly {
         address: string;

package/dist/gates/egress.js

@@ -12,12 +12,17 @@
  *    else 407;
  * 3. the port is 443 or 80, the target is a host name and no IP literal, and it matches the spec's
  *    `network.allow` exactly or by `*.suffix`, or (443 only) the outside credential provider lists
- *    it for the Agent's owner and the Tenant's egress ceiling holds it, else 403;
+ *    it for the Agent's owner, exactly or by `*.suffix` likewise, and the Tenant's egress ceiling
+ *    holds it, else 403;
  * 4. the sandbox has fewer than `maxPerSandbox` tunnels open, else 429;
  * 5. the name resolves, and to at least one address that is not private, loopback, link-local
  *    (cloud metadata included), multicast or reserved, else 502 or 403;
  * 6. the gate connects to that checked address (never to the name again) and pipes.
  *
+ * On port 443 the tunnel waits for the client's TLS ClientHello and refuses it, closing the tunnel,
+ * when its server name (SNI) isn't the CONNECT host, is missing, or the bytes aren't TLS (ADR-92
+ * §11): a tunnel to an allowed host can't ask a shared front end for another one.
+ *
  * A tunnel is opaque bytes, with two exceptions. First (R2c, D50): port 443 of a host that an
  * `environment_secret` of a live session on the sandbox is bound to. There the gate terminates
  * TLS and sets the credential's header on every request (`egress-credentials.ts`), still sending
@@ -47,6 +52,7 @@ import { isPrivateAddress } from "../tenant/outbound.js";
 import { readSandboxConfig } from "../sandbox/tenant-config.js";
 import { withinCeiling } from "../sandbox/resolve.js";
 import { bindListener } from "../host/http.js";
+import { MAX_HELLO_BYTES, readClientHello } from "./client-hello.js";
 import { hostTuning } from "../tuning.js";
 import { CONNECT_ESTABLISHED, credentialTerminator, } from "./egress-credentials.js";
 /**
@@ -227,15 +233,18 @@ export async function startEgressGate(options) {
         : undefined;
     const provider = terminator ? options.provider : undefined;
     /**
-     * Whether the credential provider lists `host` for the sandbox's owner, inside the Tenant's
-     * ceiling: only on 443, where the gate terminates TLS, and never for an Agent without an owner.
+     * Whether the credential provider lists `host` for the sandbox's owner, exactly or by a
+     * `*.suffix` pattern (`*.x.com` holds `a.x.com` and `b.a.x.com`, not `x.com`), inside the
+     * Tenant's ceiling: only on 443, where the gate terminates TLS, and never for an Agent without an
+     * owner. The request still names the host the sandbox addressed (`nylorun-provider-host`).
      */
     async function providerLists(sandboxId, sandbox, host, port) {
         if (!provider || port !== 443 || sandbox.owner === undefined)
             return false;
         if (sandbox.ceiling && !withinCeiling(host, sandbox.ceiling))
             return false;
-        return (await provider.hosts(sandboxId, sandbox.owner)).includes(host);
+        // An exact name or a `*.suffix` pattern, matched as `network.allow`'s are (v0.26 TM-E1).
+        return egressAllows(host, await provider.hosts(sandboxId, sandbox.owner));
     }
     const open = new Map();
     const tunnels = new Set();
@@ -357,11 +366,63 @@ export async function startEgressGate(options) {
             record.closed();
         });
         client.write(CONNECT_ESTABLISHED);
-        if (head.length > 0)
+        if (port === 443) {
+            // The server name the client asks for must be the host it was allowed (ADR-92 §11).
+            const hello = await clientHello(client, head, options.helloMs ?? 15_000);
+            if (hello.serverName !== host.toLowerCase()) {
+                const reason = hello.serverName === undefined ? `sni_${hello.problem ?? "missing"}` : "sni_mismatch";
+                logger.warn("egress_refused", { status: 403, reason, sandboxId, host, port, ...(hello.serverName ? { serverName: hello.serverName } : {}) });
+                record.refused(403, reason);
+                close();
+                return;
+            }
+            upstream.write(hello.bytes);
+        }
+        else if (head.length > 0)
             upstream.write(head);
         upstream.pipe(client);
         client.pipe(upstream);
     }
+    /**
+     * The client's first bytes on a tunnel, up to the end of its ClientHello, and the server name in
+     * it. The client is paused afterwards, so the bytes stay in order for the pipe.
+     */
+    function clientHello(client, head, timeoutMs) {
+        return new Promise((resolve) => {
+            let bytes = head;
+            let done = false;
+            const finish = (result) => {
+                if (done)
+                    return;
+                done = true;
+                clearTimeout(timer);
+                client.off("data", onData);
+                client.off("close", onClose);
+                client.pause();
+                resolve({ bytes, ...result });
+            };
+            const check = () => {
+                const read = readClientHello(bytes);
+                if (read.status === "complete")
+                    finish(read.serverName ? { serverName: read.serverName } : { problem: "missing" });
+                else if (read.status === "invalid")
+                    finish({ problem: "invalid" });
+                else if (bytes.length > MAX_HELLO_BYTES)
+                    finish({ problem: "invalid" });
+            };
+            const onData = (chunk) => {
+                bytes = Buffer.concat([bytes, chunk]);
+                check();
+            };
+            const onClose = () => finish({ problem: "missing" });
+            const timer = setTimeout(() => finish({ problem: "timeout" }), timeoutMs);
+            timer.unref?.();
+            client.on("data", onData);
+            client.once("close", onClose);
+            if (bytes.length > 0)
+                check();
+        });
+    }
     /** Connects to the first of `addresses` that answers within the connect timeout. */
     async function dialFirst(addresses, port) {
         for (const address of addresses) {

package/dist/harness/pod.js

@@ -160,6 +160,9 @@ export function podHost(config, logger, options = {}) {
                 http_proxy: proxy,
                 NO_PROXY: "localhost,127.0.0.1",
                 no_proxy: "localhost,127.0.0.1",
+                // Node's fetch (and corepack's pnpm and yarn) use the proxy only with this set; the engine
+                // drops `*_PROXY` names from the image's own environment, so it comes from here (ADR-92 §10).
+                NODE_USE_ENV_PROXY: "1",
             };
         },
         get epoch() {

package/dist/harness-api/start.js

@@ -7,10 +7,11 @@
  *
  * A pod Agent's sandbox variables are its vault's (R2c), then, with an outside credential
  * provider (`gates/credential-provider.ts`) and an owner on the Agent, each variable the provider
- * names for that owner, set to the stand-in `nylorun_managed` and never over a vault variable.
+ * names for that owner, set to the value it gives (the stand-in `nylorun_managed`, a stand-in of
+ * its own or a plain value) and never over a vault variable.
  * The provider is asked after the transaction, and one that fails adds nothing.
  */
-import { ENVIRONMENT_SECRET_SENTINEL, harnessLimitsOf } from "@nylorun/core/contracts";
+import { harnessLimitsOf } from "@nylorun/core/contracts";
 import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
 import { isWorkflowManifest } from "../core/flow-host.js";
 import { sandboxWorkspaceOf } from "../sandbox/share.js";
@@ -114,18 +115,19 @@ options = {}) {
     return { ...started, transcript, cursor };
 }
 /**
- * `opened` with the credential provider's variables for `ask` added to its sandbox's environment
- * as the stand-in, under the vault's own; `opened` itself when there are none.
+ * `opened` with the credential provider's variables for `ask` added to its sandbox's environment,
+ * each with the value the provider gives (a stand-in or a plain value), under the vault's own;
+ * `opened` itself when there are none.
  */
 async function withProviderVariables(ctx, opened, ask) {
     if (!ask || !ctx.credentialProvider)
         return opened;
-    const names = await ctx.credentialProvider.environment(ask.agentId, ask.owner);
+    const variables = await ctx.credentialProvider.environment(ask.agentId, ask.owner);
     const vault = opened.sandbox.environment ?? {};
-    const added = names.filter((name) => !Object.hasOwn(vault, name));
+    const added = variables.filter(({ name }) => !Object.hasOwn(vault, name));
     if (added.length === 0)
         return opened;
-    const environment = { ...Object.fromEntries(added.map((name) => [name, ENVIRONMENT_SECRET_SENTINEL])), ...vault };
+    const environment = { ...Object.fromEntries(added.map(({ name, value }) => [name, value])), ...vault };
     return { ...opened, sandbox: { ...opened.sandbox, environment } };
 }
 /** The run's `turn.start`. */

package/dist/host/harness-entry.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/host/harness-entry.js

@@ -0,0 +1,26 @@
+/**
+ * The pod's engine (`--service harness` in a sandbox pod), on its own: what `main()` does for that
+ * service, without importing the rest of the Host. `scripts/bundle-harness.mjs` bundles this file
+ * into one script, which the Runtime image ships as `/engine/harness.mjs` and the sandboxes service
+ * copies into each pod instead of `/app` (ADR-92 §5: 12 files instead of about 30,000).
+ */
+import { baselineEnvironment } from "./environment.js";
+import { parseStackConfig } from "./stack-config.js";
+import { runHarness } from "../harness/main.js";
+import { useHostTuning } from "../tuning.js";
+import { useHostIdentity } from "../vault/host-identity.js";
+import { useWorkloadToken } from "../vault/workload-token.js";
+async function start() {
+    const stack = parseStackConfig(process.env, process.argv.slice(2));
+    if (!stack.services.has("harness"))
+        throw new Error("This entry runs only --service harness");
+    if (stack.tuning)
+        useHostTuning(stack.tuning.values, stack.tuning.overrides);
+    useWorkloadToken(stack.workloadToken ?? {});
+    useHostIdentity(stack.modelHostIdentity ?? []);
+    await runHarness(stack, baselineEnvironment(process.env));
+}
+void start().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+});

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.34.0-beta",
+    "version": "0.36.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.34.0-beta",
+    "version": "0.36.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/sandbox/policy.d.ts

@@ -6,7 +6,7 @@ export declare const DEFAULT_SANDBOX_CPUS = 2;
 export declare const DEFAULT_SANDBOX_MEMORY_MIB = 1024;
 /** The default of the Tenant's Environment setting `limits.idle` (`environments.config`, D36). */
 export declare const DEFAULT_SANDBOX_IDLE = "15m";
-/** Package registries and code hosts. Concrete names so every backend can express them. */
+/** Package registries, toolchain downloads and code hosts. Concrete names so every backend can express them. */
 export declare const DEV_PRESET_HOSTS: readonly string[];
 export declare function resolveNetwork(manifest: SandboxManifest | undefined): ResolvedNetwork;
 /**

package/dist/sandbox/policy.js

@@ -6,21 +6,29 @@ export const DEFAULT_SANDBOX_CPUS = 2;
 export const DEFAULT_SANDBOX_MEMORY_MIB = 1024;
 /** The default of the Tenant's Environment setting `limits.idle` (`environments.config`, D36). */
 export const DEFAULT_SANDBOX_IDLE = "15m";
-/** Package registries and code hosts. Concrete names so every backend can express them. */
+/** Package registries, toolchain downloads and code hosts. Concrete names so every backend can express them. */
 export const DEV_PRESET_HOSTS = Object.freeze([
-    // npm and yarn
+    // npm and yarn; Node's own downloads, including node-gyp's headers for native modules
     "registry.npmjs.org",
     "registry.yarnpkg.com",
-    // Python
+    "nodejs.org",
+    // Python; uv's Python builds
     "pypi.org",
     "files.pythonhosted.org",
-    // Rust
+    "releases.astral.sh",
+    // Rust and rustup
     "crates.io",
     "index.crates.io",
     "static.crates.io",
-    // Go
+    "static.rust-lang.org",
+    "sh.rustup.rs",
+    // Go, and Go's toolchain downloads
     "proxy.golang.org",
     "sum.golang.org",
+    "dl.google.com",
+    // mise: its version lists, and the signatures it checks on GitHub releases
+    "mise-versions.jdx.dev",
+    "tuf-repo-cdn.sigstore.dev",
     // Debian and Ubuntu package mirrors
     "deb.debian.org",
     "security.debian.org",
@@ -32,6 +40,8 @@ export const DEV_PRESET_HOSTS = Object.freeze([
     "api.github.com",
     "codeload.github.com",
     "objects.githubusercontent.com",
+    // GitHub's release downloads redirect here
+    "release-assets.githubusercontent.com",
     "raw.githubusercontent.com",
     "gitlab.com",
 ]);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.34.0-beta";
+export declare const RUNTIME_VERSION = "0.36.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.34.0-beta";
+export const RUNTIME_VERSION = "0.36.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.34.0-beta",
+  "version": "0.36.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -92,6 +92,7 @@
     "@types/ws": "^8.18.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "drizzle-kit": "^0.31.11",
+    "esbuild": "^0.28.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vitest": "^5.0.4"
   }