@nylorun/runtime 0.37.0-beta → 0.39.0-beta

package/dist/api/http/routes/agents.js

@@ -378,7 +378,7 @@ export function agentRoutes(api) {
         path: "/v1/agents/{agentId}/secrets/{name}",
         tags: ["Agents"],
         summary: "Write an Agent's secret",
-        description: "Creates or replaces one credential of the Agent's vault: an `environment_secret` (the variable `name` reads the sentinel `nylorun_managed` in the sandbox, and egress-gate sets the value as a header on requests to `allowedHosts`), an `environment_variable` (a plain variable), or a `bearer` token or `headers` map for the MCP servers and HTTP tools at `url`. The same name and type re-seals the value and binding; another type replaces it. A rotated value is used from the next request. A second credential for a host or a URL is `409 credential_conflict`. When the Agent's manifest declares secret slots (while it moves to another version, that version's), send only the value (`{ value }`, or `{ headers }` for a `headers` slot): the type and binding come from the slot, and a name it does not declare is `409 secret_not_in_manifest`.",
+        description: "Creates or replaces one credential of the Agent's vault: an `environment_secret` (the variable `name` reads the sentinel `nylorun_managed` in the sandbox, and egress-gate sets the value as a header on requests to `allowedHosts`), an `environment_variable` (a plain variable), or a `bearer` token or `headers` map for the MCP servers and HTTP tools at `url`. The same name and type re-seals the value and binding; another type replaces it. A rotated value is used from the next request. A second credential for a host or a URL is `409 credential_conflict`. When the Agent's manifest declares secret slots (while it moves to another version, that version's), send only the value (`{ value }`, or `{ headers }` for a `headers` slot): the type and binding come from the slot, and a name it does not declare is `409 secret_not_in_manifest`. A `bearer` or `headers` slot's write may add `via`, where this installation sends the credential's requests (it wins over the slot's `via`; the slot's `url` still picks the credential), and the gateway's `toolPrefix`, which needs a `via` and gives way to the slot's.",
         request: {
             params: secretPath,
             body: {
@@ -395,8 +395,8 @@ export function agentRoutes(api) {
         const scope = c.get("scope");
         assertReaches(scope, id);
         const name = c.req.param("name") ?? "";
-        const body = await secretRequestFor(c.env.tenant, id, name, await readJson(c));
-        const secret = await c.env.tenant.keys.putEnvironmentSecret(id, name, body, actorOf(scope));
+        const write = await secretRequestFor(c.env.tenant, id, name, await readJson(c));
+        const secret = await c.env.tenant.keys.putEnvironmentSecret(id, name, write.request, actorOf(scope), ...(write.viaFromSlot ? [{ viaFromSlot: true }] : []));
         // A move that waited for this secret goes on (track T3).
         await secretWritten(c.env.tenant, id);
         return jsonResponse(200, secret);

package/dist/core/turn-manifest.d.ts

@@ -31,6 +31,29 @@ export declare function resolveMessageManifest(args: {
     readonly messageManifest?: unknown;
     readonly store: TurnManifestStore;
 }): TurnManifestOk | TurnManifestErr;
+/** What a message asks of its turn's manifest: a variant, and the tools it may not use. */
+export interface TurnManifestRequest {
+    readonly manifest?: unknown;
+    readonly removeTools?: readonly string[];
+}
+/**
+ * The manifest a turn runs on `pinned`: the message's variant when it named one (validated as a
+ * variant of `pinned`), else `pinned`, without the tools `removeTools` names (`withoutTools`; names
+ * `pinned` does not have are ignored). Stores nothing: the caller keeps a manifest whose hash is
+ * not the pin's (`variantStore`).
+ */
+export declare function turnManifestFor(args: {
+    readonly pinned: AgentManifest;
+    readonly pinnedHash: string;
+    readonly request: TurnManifestRequest;
+}): (TurnManifestOk & {
+    readonly variant?: AgentManifest;
+}) | TurnManifestErr;
+/** A message's request of its turn's manifest, or undefined when it asks for none. */
+export declare function turnManifestRequestOf(command: {
+    readonly manifest?: unknown;
+    readonly removeTools?: readonly string[];
+}): TurnManifestRequest | undefined;
 /**
  * At turn start: if state's hash differs from the turn's, set `state.manifestHash`
  * to the turn's when both are the pin or validated variants (`loops.md` §4.2).

package/dist/core/turn-manifest.js

@@ -1,6 +1,6 @@
 import { AgentManifestSchema, } from "@nylorun/core/contracts";
 import { hashManifest } from "@nylorun/core/compatibility";
-import { isVariantOf } from "@nylorun/core/define";
+import { isVariantOf, withoutTools } from "@nylorun/core/define";
 /**
  * Parse `message.manifest`, require it to be a variant of the session pin, and store the
  * manifest the turn runs with, by its hash. Applies to that turn only (caller must not latch).
@@ -41,6 +41,41 @@ export function resolveMessageManifest(args) {
         store: args.store,
     });
 }
+/**
+ * The manifest a turn runs on `pinned`: the message's variant when it named one (validated as a
+ * variant of `pinned`), else `pinned`, without the tools `removeTools` names (`withoutTools`; names
+ * `pinned` does not have are ignored). Stores nothing: the caller keeps a manifest whose hash is
+ * not the pin's (`variantStore`).
+ */
+export function turnManifestFor(args) {
+    const scratch = new Map();
+    const resolved = resolveMessageManifest({
+        pinned: args.pinned,
+        pinnedHash: args.pinnedHash,
+        messageManifest: args.request.manifest,
+        store: { get: (hash) => scratch.get(hash), put: (hash, manifest) => void scratch.set(hash, manifest) },
+    });
+    if (!resolved.ok)
+        return resolved;
+    // The message's variant as validated, which a re-pin validates again against the new version.
+    const variant = args.request.manifest === undefined ? {} : { variant: resolved.manifest };
+    const manifest = args.request.removeTools?.length
+        ? withoutTools(resolved.manifest, args.request.removeTools)
+        : resolved.manifest;
+    if (manifest === resolved.manifest)
+        return { ...resolved, ...variant };
+    return { ok: true, manifest, hash: hashManifest(manifest), ...variant };
+}
+/** A message's request of its turn's manifest, or undefined when it asks for none. */
+export function turnManifestRequestOf(command) {
+    const removeTools = command.removeTools?.length ? [...new Set(command.removeTools)] : undefined;
+    if (command.manifest === undefined && removeTools === undefined)
+        return undefined;
+    return {
+        ...(command.manifest === undefined ? {} : { manifest: command.manifest }),
+        ...(removeTools === undefined ? {} : { removeTools }),
+    };
+}
 /**
  * At turn start: if state's hash differs from the turn's, set `state.manifestHash`
  * to the turn's when both are the pin or validated variants (`loops.md` §4.2).

package/dist/gates/policy.d.ts

@@ -11,6 +11,10 @@
  * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
  * the approval it was opened with. A policy that cannot be read refuses every call.
  *
+ * A rule's `agent` matches the agent that calls: the session's root agent by its manifest's name,
+ * an agent it uses as a tool by its id, and that subagent's calls by the root's name too, so a rule
+ * for an agent covers the agents it uses as tools.
+ *
  * A rule's `tool` matches the tool's identity (protocol 15): an MCP tool's own name on its
  * server (`server` names the server), an HTTP tool's declared name, a flow stage's key. The name
  * a harness gave the model never matches. A stored rule whose `tool` has `__` in it (an MCP tool
@@ -37,6 +41,11 @@ export interface PolicyCall {
     readonly server?: string;
     /** The agent that calls it: its manifest's id (an agent manifest's name), never an Agent's id. */
     readonly agent: string;
+    /**
+     * The session's root agent (its loop manifest's id), when `agent` is an agent it uses as a
+     * tool: a rule whose `agent` names the root matches its subagents' calls too.
+     */
+    readonly root?: string;
     readonly input: unknown;
     /** The name the model called it by, for display only: no rule matches it. */
     readonly name?: string;
@@ -63,9 +72,10 @@ export declare function readToolPolicy(t: Pick<Tx, "getSetting">): Promise<ToolP
 export declare function toolCallDecision(t: Pick<Tx, "getSetting">, s: Session, request: HostEffect, kind: "mcp" | "http"): Promise<PolicyDecision>;
 /**
  * `request` as the policy reads it: by its target's identity (protocol 15), and by the agent that
- * calls it: an agent used as a tool by its id, the session's root agent by its loop manifest's id
- * (protocol 16: the agent manifest's name). Never the session's Agent id (`s.agentId`), which
- * protocol 16 made the Agent the session runs on (`users/ada/desk` for the manifest `desk`).
+ * calls it: an agent used as a tool by its id, with the session's root agent as its `root`, and
+ * the root agent by its loop manifest's id (protocol 16: the agent manifest's name). Never the
+ * session's Agent id (`s.agentId`), which protocol 16 made the Agent the session runs on
+ * (`users/ada/desk` for the manifest `desk`).
  */
 export declare function policyCallOf(s: Pick<Session, "manifest">, request: HostEffect, kind: "mcp" | "http"): PolicyCall;
 /** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */

package/dist/gates/policy.js

@@ -11,6 +11,10 @@
  * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
  * the approval it was opened with. A policy that cannot be read refuses every call.
  *
+ * A rule's `agent` matches the agent that calls: the session's root agent by its manifest's name,
+ * an agent it uses as a tool by its id, and that subagent's calls by the root's name too, so a rule
+ * for an agent covers the agents it uses as tools.
+ *
  * A rule's `tool` matches the tool's identity (protocol 15): an MCP tool's own name on its
  * server (`server` names the server), an HTTP tool's declared name, a flow stage's key. The name
  * a harness gave the model never matches. A stored rule whose `tool` has `__` in it (an MCP tool
@@ -70,9 +74,10 @@ export async function toolCallDecision(t, s, request, kind) {
 }
 /**
  * `request` as the policy reads it: by its target's identity (protocol 15), and by the agent that
- * calls it: an agent used as a tool by its id, the session's root agent by its loop manifest's id
- * (protocol 16: the agent manifest's name). Never the session's Agent id (`s.agentId`), which
- * protocol 16 made the Agent the session runs on (`users/ada/desk` for the manifest `desk`).
+ * calls it: an agent used as a tool by its id, with the session's root agent as its `root`, and
+ * the root agent by its loop manifest's id (protocol 16: the agent manifest's name). Never the
+ * session's Agent id (`s.agentId`), which protocol 16 made the Agent the session runs on
+ * (`users/ada/desk` for the manifest `desk`).
  */
 export function policyCallOf(s, request, kind) {
     const target = request.target;
@@ -83,6 +88,7 @@ export function policyCallOf(s, request, kind) {
             : (request.key ?? request.effectId),
         ...(target?.kind === "mcp" ? { server: target.server } : {}),
         agent: request.agent?.id ?? s.manifest.id,
+        ...(request.agent === undefined ? {} : { root: s.manifest.id }),
         input: request.input,
         ...(request.toolName === undefined ? {} : { name: request.toolName }),
     };
@@ -125,13 +131,20 @@ function matches(rule, call) {
         return false;
     if (rule.server !== undefined && (call.server === undefined || !glob(rule.server).test(call.server)))
         return false;
-    if (rule.agent !== undefined && !glob(rule.agent).test(call.agent))
+    if (rule.agent !== undefined && !agentMatches(glob(rule.agent), call))
         return false;
     for (const [path, condition] of Object.entries(rule.when ?? {}))
         if (!holds(condition, fieldOf(call.input, path)))
             return false;
     return true;
 }
+/**
+ * A rule's `agent` matches the agent that calls (an agent used as a tool by its id), and the
+ * session's root agent for its subagents' calls: a rule for the agent covers the agents it uses.
+ */
+function agentMatches(pattern, call) {
+    return pattern.test(call.agent) || (call.root !== undefined && pattern.test(call.root));
+}
 /** A pattern where `*` is any run of characters, matched whole. */
 function glob(pattern) {
     return new RegExp(`^${pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`);

package/dist/harness/executors.d.ts

@@ -21,8 +21,10 @@ export declare function harnessExecutors(options: HarnessExecutorsOptions): Harn
 /**
  * Readies the run's MCP servers (§10.5 step 3): a run without MCP facts (`turn.start.mcp`, the
  * session's first) discovers their tools and records the snapshot (the first recorded wins);
- * later ones reconnect the snapshot's servers and record what failed. Answers the facts the run
- * goes on with. Nothing for a session without MCP servers.
+ * later ones reconnect the snapshot's servers and record what failed. A turn's first segment also
+ * discovers again each declared server the snapshot lacks (one that failed or was refused before),
+ * and records the ones that answer now: they join the snapshot, and the turn offers their tools.
+ * Answers the facts the run goes on with. Nothing for a session without MCP servers.
  */
 export declare function prepareMcp(pool: McpPool, run: HarnessRun, record: McpRecorder): Promise<PreparedRun | undefined>;
 /** A run's routing, as the call helpers take it. Its sandbox events are claimed for the run. */

package/dist/harness/executors.js

@@ -91,8 +91,10 @@ async function withSandbox(run, use) {
 /**
  * Readies the run's MCP servers (§10.5 step 3): a run without MCP facts (`turn.start.mcp`, the
  * session's first) discovers their tools and records the snapshot (the first recorded wins);
- * later ones reconnect the snapshot's servers and record what failed. Answers the facts the run
- * goes on with. Nothing for a session without MCP servers.
+ * later ones reconnect the snapshot's servers and record what failed. A turn's first segment also
+ * discovers again each declared server the snapshot lacks (one that failed or was refused before),
+ * and records the ones that answer now: they join the snapshot, and the turn offers their tools.
+ * Answers the facts the run goes on with. Nothing for a session without MCP servers.
  */
 export async function prepareMcp(pool, run, record) {
     const routing = routingOf(run);
@@ -114,9 +116,29 @@ export async function prepareMcp(pool, run, record) {
     }
     else {
         const diagnostics = await pool.reconnect({ sessionId, manifest, servers: facts.servers, signal: run.signal });
-        if (diagnostics.length === 0)
+        // Not mid-turn: a turn's tools stay what its first segment offered.
+        const first = run.start.checkpoint?.segment === 0;
+        const known = new Set(facts.servers.map((server) => JSON.stringify([server.agentId ?? null, server.name])));
+        const missing = first
+            ? serversOf(manifest).filter((item) => !known.has(JSON.stringify([item.agentId ?? null, item.server.name])))
+            : [];
+        const found = missing.length === 0
+            ? undefined
+            : await pool.discover({
+                sessionId,
+                manifest,
+                manifestHash: hashManifest(manifest),
+                maxInstructionBytes: run.start.limits.recordEntryBytes,
+                signal: run.signal,
+                servers: missing,
+            });
+        const all = [...diagnostics, ...(found?.diagnostics ?? [])];
+        if (all.length === 0)
             return undefined;
-        answer = await record({ diagnostics });
+        answer = await record({
+            ...(found && found.snapshot.servers.length > 0 ? { snapshot: found.snapshot } : {}),
+            diagnostics: all,
+        });
     }
     return answer.mcp === undefined ? undefined : { mcp: answer.mcp };
 }

package/dist/harness/image-engine.d.ts

@@ -0,0 +1,14 @@
+/**
+ * An engine the workload image carries (ADR-99): the Runtime image's tini, node and bundled engine
+ * under `/opt/nylorun`, run by the sandboxes service with `entrypoint: "builtin"`. Such an engine is
+ * the Runtime version the image was built from, so it says which at `host/join`; the Runtime decides
+ * from it whether the next pod runs it or copies its own in (`sandbox/pods/builtin.ts`).
+ */
+/** Where an image keeps the engine it carries. */
+export declare const BUILTIN_ENGINE_ROOT = "/opt/nylorun";
+/** Sent at `host/join` only by an engine running from `BUILTIN_ENGINE_ROOT`: its Runtime version. */
+export declare const IMAGE_ENGINE_HEADER = "nylorun-image-engine";
+/** A Runtime version, as the header carries it. */
+export declare const ENGINE_VERSION_PATTERN: RegExp;
+/** Whether code at `moduleUrl` runs from an image's engine (the engine passes its own URL). */
+export declare function isBuiltinEngine(moduleUrl: string): boolean;

package/dist/harness/image-engine.js

@@ -0,0 +1,16 @@
+/**
+ * An engine the workload image carries (ADR-99): the Runtime image's tini, node and bundled engine
+ * under `/opt/nylorun`, run by the sandboxes service with `entrypoint: "builtin"`. Such an engine is
+ * the Runtime version the image was built from, so it says which at `host/join`; the Runtime decides
+ * from it whether the next pod runs it or copies its own in (`sandbox/pods/builtin.ts`).
+ */
+/** Where an image keeps the engine it carries. */
+export const BUILTIN_ENGINE_ROOT = "/opt/nylorun";
+/** Sent at `host/join` only by an engine running from `BUILTIN_ENGINE_ROOT`: its Runtime version. */
+export const IMAGE_ENGINE_HEADER = "nylorun-image-engine";
+/** A Runtime version, as the header carries it. */
+export const ENGINE_VERSION_PATTERN = /^[0-9A-Za-z.+-]{1,64}$/;
+/** Whether code at `moduleUrl` runs from an image's engine (the engine passes its own URL). */
+export function isBuiltinEngine(moduleUrl) {
+    return moduleUrl.startsWith(`file://${BUILTIN_ENGINE_ROOT}/`);
+}

package/dist/harness/pod.d.ts

@@ -59,4 +59,6 @@ export declare function podHost(config: PodHostConfig, logger: {
     volumeFile?: string;
     /** Where the engine writes the trust bundle: the public roots and the egress CA (R2c). */
     caBundleFile?: string;
+    /** Whether this engine runs from the workload image (default: from where its code is). */
+    imageEngine?: boolean;
 }): PodHost;

package/dist/harness/pod.js

@@ -16,6 +16,8 @@ import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { rootCertificates } from "node:tls";
 import { dirname } from "node:path";
 import { hostTuning } from "../tuning.js";
+import { RUNTIME_VERSION } from "../version.js";
+import { IMAGE_ENGINE_HEADER, isBuiltinEngine } from "./image-engine.js";
 /** The variables CLIs read their trust bundle from: OpenSSL, Node, Python, curl, git, AWS. */
 const TRUST_VARIABLES = [
     "SSL_CERT_FILE",
@@ -29,6 +31,7 @@ class Refused extends Error {
 }
 export function podHost(config, logger, options = {}) {
     const call = options.fetch ?? fetch;
+    const imageEngine = options.imageEngine ?? isBuiltinEngine(import.meta.url);
     let held;
     let setup;
     let seeded = false;
@@ -41,6 +44,8 @@ export function podHost(config, logger, options = {}) {
             headers: {
                 ...(init.body === undefined ? {} : { "content-type": "application/json" }),
                 ...(init.bearer ? { authorization: `Bearer ${init.bearer}` } : {}),
+                // An engine the workload image carries says which Runtime it came from (ADR-99).
+                ...(path === "join" && imageEngine ? { [IMAGE_ENGINE_HEADER]: RUNTIME_VERSION } : {}),
             },
             ...(init.body === undefined ? {} : { body: JSON.stringify(init.body) }),
             signal: AbortSignal.timeout(hostTuning().harness.podJoinTimeoutMs),

package/dist/harness-api/record.js

@@ -195,7 +195,8 @@ export async function recordIntent(scope, effect, requestHash) {
  * - `mcp`: the tool `{server, tool}` of an MCP server its agent declares, as the session
  *   discovered it (`tool.unknown` otherwise), left enabled by the turn's manifest (R2b C9,
  *   `tool.disabled`);
- * - `http`: an HTTP tool its agent declares under that name (R2 M3), which crosses the Tool Gate;
+ * - `http`: an HTTP tool its agent declares under that name in the turn's manifest (R2 M3), which
+ *   crosses the Tool Gate;
  * - `sandbox`: one of the sandbox operations, in a session with a sandbox;
  * - `harness`: a tool the harness runs in its own process; its egress gate is its only control.
  * - `runtime`: served by `recordIntent` itself, before this (`schedule_wake`, track T4).
@@ -222,7 +223,8 @@ function refusal(s, request) {
             return undefined;
         }
         case "http":
-            return isHttpToolCall(s.manifest, request) ? undefined : unrunnableTool(request);
+            // Declared in the turn's manifest: a variant or `removeTools` may have removed it.
+            return isHttpToolCall(turnManifestOf(s), request) ? undefined : unrunnableTool(request);
         case "sandbox":
             return sessionSandboxSpec(s) !== undefined &&
                 request.toolName !== undefined &&

package/dist/harness-api/server.js

@@ -266,9 +266,11 @@ export function createHarnessApiServer(ctx, options = {}) {
     /**
      * What a harness found readying the run's MCP servers: the first snapshot recorded for the
      * session wins, pinned as it is within the Tenant's Runtime limit `mcpSnapshotBytes` (a server
-     * past it is left out, with a diagnostic: `fitSnapshot`), with `mcp.discovered` in its log;
-     * diagnostics replace those of the same server. Answers the session's facts as the run's turn
-     * sees them (protocol 15).
+     * past it is left out, with a diagnostic: `fitSnapshot`), with `mcp.discovered` in its log.
+     * A later snapshot adds only servers the session's lacks (servers that failed at its first
+     * discovery and answer now, `prepareMcp`), within the limit, with `mcp.discovered` naming them
+     * (`rejoined`). Diagnostics replace those of the same server. Answers the session's facts as the
+     * run's turn sees them (protocol 15).
      */
     const recordMcp = async (run, params) => {
         const snapshot = params.snapshot;
@@ -286,17 +288,39 @@ export function createHarnessApiServer(ctx, options = {}) {
                 await t.put("sessions", current.id, current);
                 await t.event(current.id, run.grant.turnId, "mcp.discovered", mcpDiscovered(current.mcpSnapshot, diagnostics, current.manifest), run.connection ? writerOf(run.connection, run.grant.runId) : undefined);
             }
-            else if (diagnostics.length > 0) {
-                const prior = [...(current.mcpDiagnostics ?? [])];
-                for (const item of diagnostics) {
-                    const index = prior.findIndex((existing) => (existing.agentId ?? null) === (item.agentId ?? null) && existing.serverName === item.serverName);
-                    if (index >= 0)
-                        prior[index] = item;
-                    else
-                        prior.push(item);
+            else {
+                const key = (agentId, name) => JSON.stringify([agentId ?? null, name]);
+                // Servers the session's snapshot lacks, which answered now: they join it.
+                let added = new Set();
+                if (snapshot && current.mcpSnapshot) {
+                    const pinned = current.mcpSnapshot.servers;
+                    const has = new Set(pinned.map((server) => key(server.agentId, server.name)));
+                    const fresh = snapshot.servers.filter((server) => !has.has(key(server.agentId, server.name)));
+                    if (fresh.length > 0) {
+                        const fitted = fitSnapshot({ ...current.mcpSnapshot, servers: [...pinned, ...fresh] }, diagnostics, (await readRuntimeLimits(t)).mcpSnapshotBytes, pinned.length);
+                        diagnostics = fitted.diagnostics;
+                        current.mcpSnapshot = fitted.snapshot;
+                        added = new Set(fitted.snapshot.servers.slice(pinned.length).map((server) => key(server.agentId, server.name)));
+                    }
                 }
-                current.mcpDiagnostics = prior;
-                await t.put("sessions", current.id, current);
+                if (diagnostics.length > 0) {
+                    const prior = [...(current.mcpDiagnostics ?? [])];
+                    for (const item of diagnostics) {
+                        const index = prior.findIndex((existing) => key(existing.agentId, existing.serverName) === key(item.agentId, item.serverName));
+                        if (index >= 0)
+                            prior[index] = item;
+                        else
+                            prior.push(item);
+                    }
+                    current.mcpDiagnostics = prior;
+                }
+                if (diagnostics.length > 0 || added.size > 0)
+                    await t.put("sessions", current.id, current);
+                if (added.size > 0 && current.mcpSnapshot)
+                    await t.event(current.id, run.grant.turnId, "mcp.discovered", {
+                        ...mcpDiscovered(current.mcpSnapshot, diagnostics.filter((item) => added.has(key(item.agentId, item.serverName))), current.manifest),
+                        rejoined: true,
+                    }, run.connection ? writerOf(run.connection, run.grant.runId) : undefined);
             }
             // The turn's manifest: a variant may have disabled tools.
             return current.mcpSnapshot ? { mcp: mcpFactsOf(current.mcpSnapshot, turnManifestOf(current)) } : {};

package/dist/harness-api/start.js

@@ -18,6 +18,7 @@ import { sandboxWorkspaceOf } from "../sandbox/share.js";
 import { ownedTx } from "../store/ownership.js";
 import { harnessOf } from "../tenant/context.js";
 import { repinTurn } from "../tenant/agent-versions.js";
+import { noteSessionModel, sessionModelRecordOf } from "../tenant/session-model.js";
 import { HARNESS_ID } from "../sandbox/placement.js";
 import { checkParity, foldTranscriptWithCursor, leanState, transcriptOf, transcriptUpdates, withTranscript, } from "../tenant/history.js";
 import { usesFixtureModel } from "../tenant/model-setting.js";
@@ -45,6 +46,11 @@ options = {}) {
         // A turn's first segment runs the version its Agent runs now (T3, D73).
         if (options.harness && (await repinTurn(t, current)))
             await t.put("sessions", id, current);
+        // The model the segment's calls use, and why: `session.model` when it changed since.
+        if (options.harness &&
+            !isWorkflowManifest(current.manifest) &&
+            (await noteSessionModel(t, current, await sessionModelRecordOf(t, current))))
+            await t.put("sessions", id, current);
         // A transcript left on our engine's state by an older Runtime is recorded once; another
         // harness's state is its own (R4.2).
         const limits = await readRuntimeLimits(t);
@@ -70,7 +76,10 @@ options = {}) {
             ...(current.sandbox === undefined ? {} : { spec: current.sandbox }),
         };
         const turnId = current.activeTurnId;
+        const noted = current.memoryIndex;
         const memory = isWorkflowManifest(current.manifest) ? undefined : await turnMemoryOf(t, current, limits);
+        if (current.memoryIndex !== noted)
+            await t.put("sessions", id, current);
         return {
             current,
             fixtureModel,
@@ -170,19 +179,48 @@ export function buildTurnStart(ctx, segment) {
 /**
  * The Agent's memory as the segment starts (track T5, D72), when the version the session runs sets
  * `harness.memory`: its access (the same in every turn), the agent's instructions, and the index of
- * its memories, newest first, within the Tenant's index limits.
+ * its memories, newest first, within the Tenant's index limits; no index when it sets
+ * `harness.memory.index: false`. `refresh` at a turn's first segment when someone other than the
+ * session wrote the memory since its last turn started (`memoryRefreshOf`); the harness then pins
+ * this index in place of the one it pinned before. Only our harness is sent it: another v5
+ * harness's schema may not know the field.
  */
 async function turnMemoryOf(t, s, limits) {
     const settings = await memorySettingsOf(t, s);
     if (!settings)
         return undefined;
-    const { index, truncated } = await renderMemoryIndex(t, s.agentId, limits);
-    return {
+    const base = {
         access: settings.access ?? "read_write",
         ...(settings.instructions === undefined ? {} : { instructions: settings.instructions }),
-        index,
-        truncated,
     };
+    // A version that sets `harness.memory.index: false` (ADR-100) pins no index: none is rendered.
+    if (settings.index === false)
+        return { ...base, truncated: false };
+    const { index, truncated } = await renderMemoryIndex(t, s.agentId, limits);
+    // Within Harness API 5 only our harness, the Runtime's own version, is sent `refresh`.
+    const refresh = (await memoryRefreshOf(t, s)) && harnessOf(s) === HARNESS_ID;
+    return { ...base, index, truncated, ...(refresh ? { refresh: true } : {}) };
+}
+/**
+ * Whether the harness pins the memory index again at this segment: only at a turn's first segment
+ * (never mid-turn), when a memory version newer than the one the session's last turn saw was
+ * written other than by this session (another session of the Agent, or the API). Notes the newest
+ * version on the session (`Session.memoryIndex`; the caller saves it), and answers a first segment
+ * that runs again as it was answered. The session's first turn pins the index anyway.
+ */
+async function memoryRefreshOf(t, s) {
+    const checkpoint = s.checkpoint;
+    const turnId = s.activeTurnId;
+    if (turnId === null || checkpoint?.segment !== 0 || checkpoint.turnId !== turnId)
+        return false;
+    const before = s.memoryIndex;
+    if (before?.turnId === turnId)
+        return before.refresh;
+    const writes = await t.memoryWritesSince(s.agentId, before?.seen, s.id);
+    const refresh = before !== undefined && writes.others;
+    const seen = writes.newest ?? before?.seen;
+    s.memoryIndex = { turnId, ...(seen === undefined ? {} : { seen }), refresh };
+    return refresh;
 }
 /**
  * The facts of the Agent a session runs on (Harness API 5): its id and kind, and, with the

package/dist/harness-api/ws-server.js

@@ -31,6 +31,7 @@ import { HOST_TOKEN_TYP } from "../tenant/host-token.js";
 import { HostAuthError } from "../sandbox/join.js";
 import { parseSetupReport } from "../sandbox/setup.js";
 import { hostTuning } from "../tuning.js";
+import { ENGINE_VERSION_PATTERN, IMAGE_ENGINE_HEADER } from "../harness/image-engine.js";
 export { HOST_JOIN_PATH, HOST_RENEW_PATH };
 /** Where a pod's engine reads its setup and reports it (R2d step 2, `sandbox/setup.ts`). */
 export const HOST_SETUP_PATH = `${HARNESS_API_PATH}/host/setup`;
@@ -45,6 +46,11 @@ function refuse(socket, status, text, headers = {}) {
     ];
     socket.end(`${lines.join("\r\n")}\r\n\r\n`);
 }
+/** The Runtime version an engine built into the image reports at join (ADR-99), when well formed. */
+function imageEngineOf(request) {
+    const value = request.headers[IMAGE_ENGINE_HEADER];
+    return typeof value === "string" && ENGINE_VERSION_PATTERN.test(value) ? value : undefined;
+}
 function bearerOf(header) {
     return /^Bearer\s+(\S+)$/i.exec(header?.trim() ?? "")?.[1];
 }
@@ -110,7 +116,7 @@ export async function startHarnessListener(options) {
             return reply(response, 503, { error: { code: "unavailable", message: "Try again" } });
         try {
             const answer = path === HOST_JOIN_PATH
-                ? await authority.join(parseJoin(await readBody(request)))
+                ? await authority.join(parseJoin(await readBody(request)), { imageEngine: imageEngineOf(request) })
                 : await authority.renew(bearerOf(request.headers.authorization) ?? "");
             return reply(response, 200, answer);
         }

package/dist/keys/keys.d.ts

@@ -2,7 +2,7 @@ import type { AgentSecretView, HostModelView, McpPreview, McpPreviewRequest, Put
 import type { SessionStore } from "../store/types.js";
 import type { OutboundPolicy } from "../tenant/outbound.js";
 import { type SigningKeys } from "../tenant/signing-keys.js";
-import type { SealedSecretCopies, VaultService } from "../vault/service.js";
+import type { SealedSecretCopies, SecretWriteOptions, VaultService } from "../vault/service.js";
 /** One JWT to sign: its `typ` and every claim, `iss`, `aud`, `sub`, `iat`, `exp` and `jti` included. */
 export interface SignRequest {
     readonly typ: string;
@@ -15,8 +15,11 @@ export interface Signed {
 }
 import { type SealedWebhookSecret, type WebhookDelivery } from "./webhooks.js";
 export interface Keys {
-    /** `PUT /v1/agents/{id}/secrets/{name}` (`VaultService.putEnvironmentSecret`). */
-    putEnvironmentSecret(environmentId: string, name: string, body: PutAgentSecretRequest, actor: string): Promise<AgentSecretView>;
+    /**
+     * `PUT /v1/agents/{id}/secrets/{name}` (`VaultService.putEnvironmentSecret`); `options.viaFromSlot`
+     * when `body.via` is the slot's, not the write's own (`secret-routing`).
+     */
+    putEnvironmentSecret(environmentId: string, name: string, body: PutAgentSecretRequest, actor: string, options?: SecretWriteOptions | null): Promise<AgentSecretView>;
     putHostModel(body: PutHostModelRequest): Promise<HostModelView>;
     selectHostModel(body: SelectHostModelRequest): Promise<HostModelView>;
     /**

package/dist/keys/keys.js

@@ -39,7 +39,7 @@ export function inProcessKeys(options) {
     const { store, vault, signingKeys, kek } = options;
     const egress = new EgressAuthority(store, kek);
     return {
-        putEnvironmentSecret: (environmentId, name, body, actor) => vault.putEnvironmentSecret(environmentId, name, body, actor),
+        putEnvironmentSecret: (environmentId, name, body, actor, options) => vault.putEnvironmentSecret(environmentId, name, body, actor, options),
         putHostModel: (body) => vault.putHostModel(body),
         selectHostModel: (body) => vault.selectHostModel(body),
         sealEnvironmentSecretCopies: (from, vaultId, slots) => vault.sealEnvironmentSecretCopies(from, vaultId, slots),