@nylorun/runtime 0.35.0-beta → 0.36.0-beta

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.36.0-beta
+
+### Minor Changes
+
+- 27253ea: A pod starts faster and its commands can install what they need (ADR-92).
+
+  - **The pod copies a bundled engine.** The Runtime image ships the pod's engine (`--service harness`) bundled into one script, with the one native addon it loads, as `/engine`: 12 files instead of `/app`'s ~30,000. The sandboxes service's `nylo-copy` copies `/engine` when the image has it, and `/app` otherwise, and the workload runs `/nylo/entry.mjs`. On beta's GKE cluster the copy went from 6–29 s to 0.2 s, and the engine's start from 7.2 s to 3.7 s.
+  - **A pod's disk is owned once:** `fsGroupChangePolicy: OnRootMismatch`. A mount of a disk holding 91,000 files went from 15–21 s to 3–8 s.
+  - **Commands run with bash** where the image has it (`/bin/bash -c`), as the `bash` tool says; `/bin/sh -c` only in an image without bash.
+  - **Node uses the proxy.** `NODE_USE_ENV_PROXY=1` joins the proxy variables a pod's commands get, so Node's `fetch`, and corepack's pnpm and yarn, reach the egress gate.
+  - **The dev preset allows toolchain downloads:** `nodejs.org`, `releases.astral.sh`, `static.rust-lang.org`, `sh.rustup.rs`, `dl.google.com`, `mise-versions.jdx.dev`, `tuf-repo-cdn.sigstore.dev`, and `release-assets.githubusercontent.com`, where GitHub's release downloads now redirect.
+  - **The egress gate checks the server name.** On a 443 tunnel, the gate reads the client's TLS ClientHello and closes the tunnel when its server name (SNI) isn't the CONNECT host, is missing, or the bytes aren't TLS, recording the refusal (`sni_mismatch`, `sni_missing`, `sni_invalid`, `sni_timeout`). A tunnel to an allowed host can no longer ask a shared front end for another one.
+
 ## 0.35.0-beta
 
 ### Minor Changes

package/dist/adapters/sandbox/local.d.ts

@@ -8,11 +8,18 @@ export interface LocalBackendOptions {
     readonly env: Readonly<Record<string, string | undefined>>;
     /** The engine's `/harness` on the same volume, a disk root of its versions (R2d step 3). */
     readonly harnessRoot?: string;
+    /** The shell commands run under; default `/bin/bash` where the image has it, else `/bin/sh`. */
+    readonly shell?: string;
 }
 /**
- * How the pod runs a command: `/bin/sh -c` in its own process group, with the base environment,
- * the request's variables and the proxy of the moment. The sandbox tools and the disk's setup
- * (`harness/setup.ts`) both run commands this way.
+ * The shell the `bash` tool's commands run under: bash, as the tool says, where the image has it;
+ * `/bin/sh` (dash on Debian and Ubuntu) only in an image without it (ADR-92 §10).
+ */
+export declare function commandShell(exists?: (path: string) => boolean): string;
+/**
+ * How the pod runs a command: `bash -c` (`sh -c` in an image without bash) in its own process
+ * group, with the base environment, the request's variables and the proxy of the moment. The
+ * sandbox tools and the disk's setup (`harness/setup.ts`) both run commands this way.
  */
 export declare function localExec(options: LocalBackendOptions): (request: ExecRequest, signal: AbortSignal) => Promise<ExecResult>;
 export declare function localBackend(options: LocalBackendOptions): SandboxBackend;

package/dist/adapters/sandbox/local.js

@@ -17,6 +17,22 @@ import { posix } from "node:path";
 import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
 import { SandboxFileTooLargeError } from "../../sandbox/types.js";
 import { hostTuning } from "../../tuning.js";
+/**
+ * The shell the `bash` tool's commands run under: bash, as the tool says, where the image has it;
+ * `/bin/sh` (dash on Debian and Ubuntu) only in an image without it (ADR-92 §10).
+ */
+export function commandShell(exists = executable) {
+    return exists("/bin/bash") ? "/bin/bash" : "/bin/sh";
+}
+function executable(path) {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /** This process's environment without the engine's own variables. */
 function baseEnv(env, workspace) {
     const out = {};
@@ -53,16 +69,17 @@ function collector() {
     };
 }
 /**
- * How the pod runs a command: `/bin/sh -c` in its own process group, with the base environment,
- * the request's variables and the proxy of the moment. The sandbox tools and the disk's setup
- * (`harness/setup.ts`) both run commands this way.
+ * How the pod runs a command: `bash -c` (`sh -c` in an image without bash) in its own process
+ * group, with the base environment, the request's variables and the proxy of the moment. The
+ * sandbox tools and the disk's setup (`harness/setup.ts`) both run commands this way.
  */
 export function localExec(options) {
     const env = baseEnv(options.env, options.workspace ?? SANDBOX_WORKSPACE);
+    const shell = options.shell ?? commandShell();
     return (request, signal) => new Promise((resolve, reject) => {
         if (signal.aborted)
             return reject(signal.reason ?? new Error("Turn cancelled"));
-        const child = spawn("/bin/sh", ["-c", request.command], {
+        const child = spawn(shell, ["-c", request.command], {
             cwd: request.cwd,
             env: { ...env, ...(request.env ?? {}), ...(options.proxyEnv?.() ?? {}) },
             stdio: ["ignore", "pipe", "pipe"],

package/dist/gates/client-hello.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The server name (SNI) in a TLS ClientHello, read from the first bytes a client sends through a
+ * tunnel (ADR-92 §11). egress-gate compares it with the CONNECT host, so a tunnel opened to an
+ * allowed host can't ask a shared front end for another one (domain fronting by SNI).
+ *
+ * The ClientHello may span several TLS records; they are reassembled up to `MAX_HELLO_BYTES`.
+ */
+/** A ClientHello is far smaller; one that isn't complete by here is refused. */
+export declare const MAX_HELLO_BYTES: number;
+export type ClientHelloRead = 
+/** More bytes are needed. */
+{
+    readonly status: "incomplete";
+}
+/** Not a TLS ClientHello. */
+ | {
+    readonly status: "invalid";
+    readonly reason: string;
+}
+/** A whole ClientHello; `serverName` is lowercase, or undefined when it names none. */
+ | {
+    readonly status: "complete";
+    readonly serverName?: string;
+};
+/** Reads the ClientHello at the start of `data`, the bytes a client has sent so far. */
+export declare function readClientHello(data: Buffer): ClientHelloRead;

package/dist/gates/client-hello.js

@@ -0,0 +1,103 @@
+/**
+ * The server name (SNI) in a TLS ClientHello, read from the first bytes a client sends through a
+ * tunnel (ADR-92 §11). egress-gate compares it with the CONNECT host, so a tunnel opened to an
+ * allowed host can't ask a shared front end for another one (domain fronting by SNI).
+ *
+ * The ClientHello may span several TLS records; they are reassembled up to `MAX_HELLO_BYTES`.
+ */
+/** A ClientHello is far smaller; one that isn't complete by here is refused. */
+export const MAX_HELLO_BYTES = 64 * 1024;
+const RECORD_HANDSHAKE = 0x16;
+const HANDSHAKE_CLIENT_HELLO = 0x01;
+const EXTENSION_SERVER_NAME = 0x0000;
+const NAME_TYPE_HOST = 0x00;
+/** Reads the ClientHello at the start of `data`, the bytes a client has sent so far. */
+export function readClientHello(data) {
+    // The handshake message, reassembled from consecutive handshake records.
+    const chunks = [];
+    let have = 0;
+    let need;
+    let at = 0;
+    while (need === undefined || have < need) {
+        if (data.length < at + 5)
+            return data.length > MAX_HELLO_BYTES ? invalid("too long") : incomplete;
+        if (data[at] !== RECORD_HANDSHAKE)
+            return invalid("not a TLS handshake");
+        if (data[at + 1] !== 0x03)
+            return invalid("not a TLS record");
+        const length = data.readUInt16BE(at + 3);
+        if (length === 0)
+            return invalid("an empty record");
+        if (data.length < at + 5 + length)
+            return at + 5 + length > MAX_HELLO_BYTES ? invalid("too long") : incomplete;
+        const fragment = data.subarray(at + 5, at + 5 + length);
+        chunks.push(fragment);
+        have += fragment.length;
+        at += 5 + length;
+        if (need === undefined && have >= 4) {
+            const head = Buffer.concat(chunks);
+            if (head[0] !== HANDSHAKE_CLIENT_HELLO)
+                return invalid("not a ClientHello");
+            need = 4 + head.readUIntBE(1, 3);
+            if (need > MAX_HELLO_BYTES)
+                return invalid("too long");
+        }
+    }
+    return serverNameIn(Buffer.concat(chunks).subarray(4, need));
+}
+/** The server name in a ClientHello's body (after its 4-byte handshake header). */
+function serverNameIn(body) {
+    let at = 2 + 32; // client_version, random
+    if (body.length < at + 1)
+        return invalid("truncated");
+    at += 1 + body[at]; // session_id
+    if (body.length < at + 2)
+        return invalid("truncated");
+    at += 2 + body.readUInt16BE(at); // cipher_suites
+    if (body.length < at + 1)
+        return invalid("truncated");
+    at += 1 + body[at]; // compression_methods
+    if (body.length === at)
+        return { status: "complete" }; // no extensions
+    if (body.length < at + 2)
+        return invalid("truncated");
+    const end = at + 2 + body.readUInt16BE(at);
+    if (end > body.length)
+        return invalid("truncated");
+    at += 2;
+    while (at + 4 <= end) {
+        const type = body.readUInt16BE(at);
+        const length = body.readUInt16BE(at + 2);
+        const start = at + 4;
+        if (start + length > end)
+            return invalid("truncated");
+        if (type === EXTENSION_SERVER_NAME)
+            return hostIn(body.subarray(start, start + length));
+        at = start + length;
+    }
+    return { status: "complete" };
+}
+/** The host name in a server_name extension's data. */
+function hostIn(extension) {
+    if (extension.length < 2)
+        return invalid("truncated");
+    const end = Math.min(extension.length, 2 + extension.readUInt16BE(0));
+    let at = 2;
+    while (at + 3 <= end) {
+        const type = extension[at];
+        const length = extension.readUInt16BE(at + 1);
+        if (at + 3 + length > end)
+            return invalid("truncated");
+        if (type === NAME_TYPE_HOST) {
+            const name = extension.subarray(at + 3, at + 3 + length).toString("latin1");
+            // A host name is letters, digits, hyphens and dots; anything else (a NUL, a space) is refused.
+            if (!/^[A-Za-z0-9.-]+$/.test(name))
+                return invalid("a server name that isn't a host name");
+            return { status: "complete", serverName: name.toLowerCase().replace(/\.$/, "") };
+        }
+        at += 3 + length;
+    }
+    return { status: "complete" };
+}
+const incomplete = { status: "incomplete" };
+const invalid = (reason) => ({ status: "invalid", reason });

package/dist/gates/egress.d.ts

@@ -56,6 +56,8 @@ export interface StartEgressGateOptions {
     readonly cacheMs?: number;
     /** How long the gate waits for the upstream connection. Default `egress.connectTimeoutMs`. */
     readonly connectTimeoutMs?: number;
+    /** How long a 443 tunnel waits for the client's ClientHello. Default 15 s. */
+    readonly helloMs?: number;
     /** Tests replace name resolution. */
     readonly lookup?: (host: string) => Promise<readonly {
         address: string;

package/dist/gates/egress.js

@@ -19,6 +19,10 @@
  *    (cloud metadata included), multicast or reserved, else 502 or 403;
  * 6. the gate connects to that checked address (never to the name again) and pipes.
  *
+ * On port 443 the tunnel waits for the client's TLS ClientHello and refuses it, closing the tunnel,
+ * when its server name (SNI) isn't the CONNECT host, is missing, or the bytes aren't TLS (ADR-92
+ * §11): a tunnel to an allowed host can't ask a shared front end for another one.
+ *
  * A tunnel is opaque bytes, with two exceptions. First (R2c, D50): port 443 of a host that an
  * `environment_secret` of a live session on the sandbox is bound to. There the gate terminates
  * TLS and sets the credential's header on every request (`egress-credentials.ts`), still sending
@@ -48,6 +52,7 @@ import { isPrivateAddress } from "../tenant/outbound.js";
 import { readSandboxConfig } from "../sandbox/tenant-config.js";
 import { withinCeiling } from "../sandbox/resolve.js";
 import { bindListener } from "../host/http.js";
+import { MAX_HELLO_BYTES, readClientHello } from "./client-hello.js";
 import { hostTuning } from "../tuning.js";
 import { CONNECT_ESTABLISHED, credentialTerminator, } from "./egress-credentials.js";
 /**
@@ -361,11 +366,63 @@ export async function startEgressGate(options) {
             record.closed();
         });
         client.write(CONNECT_ESTABLISHED);
-        if (head.length > 0)
+        if (port === 443) {
+            // The server name the client asks for must be the host it was allowed (ADR-92 §11).
+            const hello = await clientHello(client, head, options.helloMs ?? 15_000);
+            if (hello.serverName !== host.toLowerCase()) {
+                const reason = hello.serverName === undefined ? `sni_${hello.problem ?? "missing"}` : "sni_mismatch";
+                logger.warn("egress_refused", { status: 403, reason, sandboxId, host, port, ...(hello.serverName ? { serverName: hello.serverName } : {}) });
+                record.refused(403, reason);
+                close();
+                return;
+            }
+            upstream.write(hello.bytes);
+        }
+        else if (head.length > 0)
             upstream.write(head);
         upstream.pipe(client);
         client.pipe(upstream);
     }
+    /**
+     * The client's first bytes on a tunnel, up to the end of its ClientHello, and the server name in
+     * it. The client is paused afterwards, so the bytes stay in order for the pipe.
+     */
+    function clientHello(client, head, timeoutMs) {
+        return new Promise((resolve) => {
+            let bytes = head;
+            let done = false;
+            const finish = (result) => {
+                if (done)
+                    return;
+                done = true;
+                clearTimeout(timer);
+                client.off("data", onData);
+                client.off("close", onClose);
+                client.pause();
+                resolve({ bytes, ...result });
+            };
+            const check = () => {
+                const read = readClientHello(bytes);
+                if (read.status === "complete")
+                    finish(read.serverName ? { serverName: read.serverName } : { problem: "missing" });
+                else if (read.status === "invalid")
+                    finish({ problem: "invalid" });
+                else if (bytes.length > MAX_HELLO_BYTES)
+                    finish({ problem: "invalid" });
+            };
+            const onData = (chunk) => {
+                bytes = Buffer.concat([bytes, chunk]);
+                check();
+            };
+            const onClose = () => finish({ problem: "missing" });
+            const timer = setTimeout(() => finish({ problem: "timeout" }), timeoutMs);
+            timer.unref?.();
+            client.on("data", onData);
+            client.once("close", onClose);
+            if (bytes.length > 0)
+                check();
+        });
+    }
     /** Connects to the first of `addresses` that answers within the connect timeout. */
     async function dialFirst(addresses, port) {
         for (const address of addresses) {

package/dist/harness/pod.js

@@ -160,6 +160,9 @@ export function podHost(config, logger, options = {}) {
                 http_proxy: proxy,
                 NO_PROXY: "localhost,127.0.0.1",
                 no_proxy: "localhost,127.0.0.1",
+                // Node's fetch (and corepack's pnpm and yarn) use the proxy only with this set; the engine
+                // drops `*_PROXY` names from the image's own environment, so it comes from here (ADR-92 §10).
+                NODE_USE_ENV_PROXY: "1",
             };
         },
         get epoch() {

package/dist/host/harness-entry.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/host/harness-entry.js

@@ -0,0 +1,26 @@
+/**
+ * The pod's engine (`--service harness` in a sandbox pod), on its own: what `main()` does for that
+ * service, without importing the rest of the Host. `scripts/bundle-harness.mjs` bundles this file
+ * into one script, which the Runtime image ships as `/engine/harness.mjs` and the sandboxes service
+ * copies into each pod instead of `/app` (ADR-92 §5: 12 files instead of about 30,000).
+ */
+import { baselineEnvironment } from "./environment.js";
+import { parseStackConfig } from "./stack-config.js";
+import { runHarness } from "../harness/main.js";
+import { useHostTuning } from "../tuning.js";
+import { useHostIdentity } from "../vault/host-identity.js";
+import { useWorkloadToken } from "../vault/workload-token.js";
+async function start() {
+    const stack = parseStackConfig(process.env, process.argv.slice(2));
+    if (!stack.services.has("harness"))
+        throw new Error("This entry runs only --service harness");
+    if (stack.tuning)
+        useHostTuning(stack.tuning.values, stack.tuning.overrides);
+    useWorkloadToken(stack.workloadToken ?? {});
+    useHostIdentity(stack.modelHostIdentity ?? []);
+    await runHarness(stack, baselineEnvironment(process.env));
+}
+void start().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+});

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.35.0-beta",
+    "version": "0.36.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.35.0-beta",
+    "version": "0.36.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/sandbox/policy.d.ts

@@ -6,7 +6,7 @@ export declare const DEFAULT_SANDBOX_CPUS = 2;
 export declare const DEFAULT_SANDBOX_MEMORY_MIB = 1024;
 /** The default of the Tenant's Environment setting `limits.idle` (`environments.config`, D36). */
 export declare const DEFAULT_SANDBOX_IDLE = "15m";
-/** Package registries and code hosts. Concrete names so every backend can express them. */
+/** Package registries, toolchain downloads and code hosts. Concrete names so every backend can express them. */
 export declare const DEV_PRESET_HOSTS: readonly string[];
 export declare function resolveNetwork(manifest: SandboxManifest | undefined): ResolvedNetwork;
 /**

package/dist/sandbox/policy.js

@@ -6,21 +6,29 @@ export const DEFAULT_SANDBOX_CPUS = 2;
 export const DEFAULT_SANDBOX_MEMORY_MIB = 1024;
 /** The default of the Tenant's Environment setting `limits.idle` (`environments.config`, D36). */
 export const DEFAULT_SANDBOX_IDLE = "15m";
-/** Package registries and code hosts. Concrete names so every backend can express them. */
+/** Package registries, toolchain downloads and code hosts. Concrete names so every backend can express them. */
 export const DEV_PRESET_HOSTS = Object.freeze([
-    // npm and yarn
+    // npm and yarn; Node's own downloads, including node-gyp's headers for native modules
     "registry.npmjs.org",
     "registry.yarnpkg.com",
-    // Python
+    "nodejs.org",
+    // Python; uv's Python builds
     "pypi.org",
     "files.pythonhosted.org",
-    // Rust
+    "releases.astral.sh",
+    // Rust and rustup
     "crates.io",
     "index.crates.io",
     "static.crates.io",
-    // Go
+    "static.rust-lang.org",
+    "sh.rustup.rs",
+    // Go, and Go's toolchain downloads
     "proxy.golang.org",
     "sum.golang.org",
+    "dl.google.com",
+    // mise: its version lists, and the signatures it checks on GitHub releases
+    "mise-versions.jdx.dev",
+    "tuf-repo-cdn.sigstore.dev",
     // Debian and Ubuntu package mirrors
     "deb.debian.org",
     "security.debian.org",
@@ -32,6 +40,8 @@ export const DEV_PRESET_HOSTS = Object.freeze([
     "api.github.com",
     "codeload.github.com",
     "objects.githubusercontent.com",
+    // GitHub's release downloads redirect here
+    "release-assets.githubusercontent.com",
     "raw.githubusercontent.com",
     "gitlab.com",
 ]);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.35.0-beta";
+export declare const RUNTIME_VERSION = "0.36.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.35.0-beta";
+export const RUNTIME_VERSION = "0.36.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.35.0-beta",
+  "version": "0.36.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -92,6 +92,7 @@
     "@types/ws": "^8.18.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "drizzle-kit": "^0.31.11",
+    "esbuild": "^0.28.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vitest": "^5.0.4"
   }