@nylorun/runtime 0.38.0-beta → 0.39.0-beta

package/dist/api/http/routes/agents.js

@@ -378,7 +378,7 @@ export function agentRoutes(api) {
         path: "/v1/agents/{agentId}/secrets/{name}",
         tags: ["Agents"],
         summary: "Write an Agent's secret",
-        description: "Creates or replaces one credential of the Agent's vault: an `environment_secret` (the variable `name` reads the sentinel `nylorun_managed` in the sandbox, and egress-gate sets the value as a header on requests to `allowedHosts`), an `environment_variable` (a plain variable), or a `bearer` token or `headers` map for the MCP servers and HTTP tools at `url`. The same name and type re-seals the value and binding; another type replaces it. A rotated value is used from the next request. A second credential for a host or a URL is `409 credential_conflict`. When the Agent's manifest declares secret slots (while it moves to another version, that version's), send only the value (`{ value }`, or `{ headers }` for a `headers` slot): the type and binding come from the slot, and a name it does not declare is `409 secret_not_in_manifest`.",
+        description: "Creates or replaces one credential of the Agent's vault: an `environment_secret` (the variable `name` reads the sentinel `nylorun_managed` in the sandbox, and egress-gate sets the value as a header on requests to `allowedHosts`), an `environment_variable` (a plain variable), or a `bearer` token or `headers` map for the MCP servers and HTTP tools at `url`. The same name and type re-seals the value and binding; another type replaces it. A rotated value is used from the next request. A second credential for a host or a URL is `409 credential_conflict`. When the Agent's manifest declares secret slots (while it moves to another version, that version's), send only the value (`{ value }`, or `{ headers }` for a `headers` slot): the type and binding come from the slot, and a name it does not declare is `409 secret_not_in_manifest`. A `bearer` or `headers` slot's write may add `via`, where this installation sends the credential's requests (it wins over the slot's `via`; the slot's `url` still picks the credential), and the gateway's `toolPrefix`, which needs a `via` and gives way to the slot's.",
         request: {
             params: secretPath,
             body: {
@@ -395,8 +395,8 @@ export function agentRoutes(api) {
         const scope = c.get("scope");
         assertReaches(scope, id);
         const name = c.req.param("name") ?? "";
-        const body = await secretRequestFor(c.env.tenant, id, name, await readJson(c));
-        const secret = await c.env.tenant.keys.putEnvironmentSecret(id, name, body, actorOf(scope));
+        const write = await secretRequestFor(c.env.tenant, id, name, await readJson(c));
+        const secret = await c.env.tenant.keys.putEnvironmentSecret(id, name, write.request, actorOf(scope), ...(write.viaFromSlot ? [{ viaFromSlot: true }] : []));
         // A move that waited for this secret goes on (track T3).
         await secretWritten(c.env.tenant, id);
         return jsonResponse(200, secret);

package/dist/core/turn-manifest.d.ts

@@ -31,6 +31,29 @@ export declare function resolveMessageManifest(args: {
     readonly messageManifest?: unknown;
     readonly store: TurnManifestStore;
 }): TurnManifestOk | TurnManifestErr;
+/** What a message asks of its turn's manifest: a variant, and the tools it may not use. */
+export interface TurnManifestRequest {
+    readonly manifest?: unknown;
+    readonly removeTools?: readonly string[];
+}
+/**
+ * The manifest a turn runs on `pinned`: the message's variant when it named one (validated as a
+ * variant of `pinned`), else `pinned`, without the tools `removeTools` names (`withoutTools`; names
+ * `pinned` does not have are ignored). Stores nothing: the caller keeps a manifest whose hash is
+ * not the pin's (`variantStore`).
+ */
+export declare function turnManifestFor(args: {
+    readonly pinned: AgentManifest;
+    readonly pinnedHash: string;
+    readonly request: TurnManifestRequest;
+}): (TurnManifestOk & {
+    readonly variant?: AgentManifest;
+}) | TurnManifestErr;
+/** A message's request of its turn's manifest, or undefined when it asks for none. */
+export declare function turnManifestRequestOf(command: {
+    readonly manifest?: unknown;
+    readonly removeTools?: readonly string[];
+}): TurnManifestRequest | undefined;
 /**
  * At turn start: if state's hash differs from the turn's, set `state.manifestHash`
  * to the turn's when both are the pin or validated variants (`loops.md` §4.2).

package/dist/core/turn-manifest.js

@@ -1,6 +1,6 @@
 import { AgentManifestSchema, } from "@nylorun/core/contracts";
 import { hashManifest } from "@nylorun/core/compatibility";
-import { isVariantOf } from "@nylorun/core/define";
+import { isVariantOf, withoutTools } from "@nylorun/core/define";
 /**
  * Parse `message.manifest`, require it to be a variant of the session pin, and store the
  * manifest the turn runs with, by its hash. Applies to that turn only (caller must not latch).
@@ -41,6 +41,41 @@ export function resolveMessageManifest(args) {
         store: args.store,
     });
 }
+/**
+ * The manifest a turn runs on `pinned`: the message's variant when it named one (validated as a
+ * variant of `pinned`), else `pinned`, without the tools `removeTools` names (`withoutTools`; names
+ * `pinned` does not have are ignored). Stores nothing: the caller keeps a manifest whose hash is
+ * not the pin's (`variantStore`).
+ */
+export function turnManifestFor(args) {
+    const scratch = new Map();
+    const resolved = resolveMessageManifest({
+        pinned: args.pinned,
+        pinnedHash: args.pinnedHash,
+        messageManifest: args.request.manifest,
+        store: { get: (hash) => scratch.get(hash), put: (hash, manifest) => void scratch.set(hash, manifest) },
+    });
+    if (!resolved.ok)
+        return resolved;
+    // The message's variant as validated, which a re-pin validates again against the new version.
+    const variant = args.request.manifest === undefined ? {} : { variant: resolved.manifest };
+    const manifest = args.request.removeTools?.length
+        ? withoutTools(resolved.manifest, args.request.removeTools)
+        : resolved.manifest;
+    if (manifest === resolved.manifest)
+        return { ...resolved, ...variant };
+    return { ok: true, manifest, hash: hashManifest(manifest), ...variant };
+}
+/** A message's request of its turn's manifest, or undefined when it asks for none. */
+export function turnManifestRequestOf(command) {
+    const removeTools = command.removeTools?.length ? [...new Set(command.removeTools)] : undefined;
+    if (command.manifest === undefined && removeTools === undefined)
+        return undefined;
+    return {
+        ...(command.manifest === undefined ? {} : { manifest: command.manifest }),
+        ...(removeTools === undefined ? {} : { removeTools }),
+    };
+}
 /**
  * At turn start: if state's hash differs from the turn's, set `state.manifestHash`
  * to the turn's when both are the pin or validated variants (`loops.md` §4.2).

package/dist/gates/policy.d.ts

@@ -11,6 +11,10 @@
  * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
  * the approval it was opened with. A policy that cannot be read refuses every call.
  *
+ * A rule's `agent` matches the agent that calls: the session's root agent by its manifest's name,
+ * an agent it uses as a tool by its id, and that subagent's calls by the root's name too, so a rule
+ * for an agent covers the agents it uses as tools.
+ *
  * A rule's `tool` matches the tool's identity (protocol 15): an MCP tool's own name on its
  * server (`server` names the server), an HTTP tool's declared name, a flow stage's key. The name
  * a harness gave the model never matches. A stored rule whose `tool` has `__` in it (an MCP tool
@@ -37,6 +41,11 @@ export interface PolicyCall {
     readonly server?: string;
     /** The agent that calls it: its manifest's id (an agent manifest's name), never an Agent's id. */
     readonly agent: string;
+    /**
+     * The session's root agent (its loop manifest's id), when `agent` is an agent it uses as a
+     * tool: a rule whose `agent` names the root matches its subagents' calls too.
+     */
+    readonly root?: string;
     readonly input: unknown;
     /** The name the model called it by, for display only: no rule matches it. */
     readonly name?: string;
@@ -63,9 +72,10 @@ export declare function readToolPolicy(t: Pick<Tx, "getSetting">): Promise<ToolP
 export declare function toolCallDecision(t: Pick<Tx, "getSetting">, s: Session, request: HostEffect, kind: "mcp" | "http"): Promise<PolicyDecision>;
 /**
  * `request` as the policy reads it: by its target's identity (protocol 15), and by the agent that
- * calls it: an agent used as a tool by its id, the session's root agent by its loop manifest's id
- * (protocol 16: the agent manifest's name). Never the session's Agent id (`s.agentId`), which
- * protocol 16 made the Agent the session runs on (`users/ada/desk` for the manifest `desk`).
+ * calls it: an agent used as a tool by its id, with the session's root agent as its `root`, and
+ * the root agent by its loop manifest's id (protocol 16: the agent manifest's name). Never the
+ * session's Agent id (`s.agentId`), which protocol 16 made the Agent the session runs on
+ * (`users/ada/desk` for the manifest `desk`).
  */
 export declare function policyCallOf(s: Pick<Session, "manifest">, request: HostEffect, kind: "mcp" | "http"): PolicyCall;
 /** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */

package/dist/gates/policy.js

@@ -11,6 +11,10 @@
  * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
  * the approval it was opened with. A policy that cannot be read refuses every call.
  *
+ * A rule's `agent` matches the agent that calls: the session's root agent by its manifest's name,
+ * an agent it uses as a tool by its id, and that subagent's calls by the root's name too, so a rule
+ * for an agent covers the agents it uses as tools.
+ *
  * A rule's `tool` matches the tool's identity (protocol 15): an MCP tool's own name on its
  * server (`server` names the server), an HTTP tool's declared name, a flow stage's key. The name
  * a harness gave the model never matches. A stored rule whose `tool` has `__` in it (an MCP tool
@@ -70,9 +74,10 @@ export async function toolCallDecision(t, s, request, kind) {
 }
 /**
  * `request` as the policy reads it: by its target's identity (protocol 15), and by the agent that
- * calls it: an agent used as a tool by its id, the session's root agent by its loop manifest's id
- * (protocol 16: the agent manifest's name). Never the session's Agent id (`s.agentId`), which
- * protocol 16 made the Agent the session runs on (`users/ada/desk` for the manifest `desk`).
+ * calls it: an agent used as a tool by its id, with the session's root agent as its `root`, and
+ * the root agent by its loop manifest's id (protocol 16: the agent manifest's name). Never the
+ * session's Agent id (`s.agentId`), which protocol 16 made the Agent the session runs on
+ * (`users/ada/desk` for the manifest `desk`).
  */
 export function policyCallOf(s, request, kind) {
     const target = request.target;
@@ -83,6 +88,7 @@ export function policyCallOf(s, request, kind) {
             : (request.key ?? request.effectId),
         ...(target?.kind === "mcp" ? { server: target.server } : {}),
         agent: request.agent?.id ?? s.manifest.id,
+        ...(request.agent === undefined ? {} : { root: s.manifest.id }),
         input: request.input,
         ...(request.toolName === undefined ? {} : { name: request.toolName }),
     };
@@ -125,13 +131,20 @@ function matches(rule, call) {
         return false;
     if (rule.server !== undefined && (call.server === undefined || !glob(rule.server).test(call.server)))
         return false;
-    if (rule.agent !== undefined && !glob(rule.agent).test(call.agent))
+    if (rule.agent !== undefined && !agentMatches(glob(rule.agent), call))
         return false;
     for (const [path, condition] of Object.entries(rule.when ?? {}))
         if (!holds(condition, fieldOf(call.input, path)))
             return false;
     return true;
 }
+/**
+ * A rule's `agent` matches the agent that calls (an agent used as a tool by its id), and the
+ * session's root agent for its subagents' calls: a rule for the agent covers the agents it uses.
+ */
+function agentMatches(pattern, call) {
+    return pattern.test(call.agent) || (call.root !== undefined && pattern.test(call.root));
+}
 /** A pattern where `*` is any run of characters, matched whole. */
 function glob(pattern) {
     return new RegExp(`^${pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`);

package/dist/harness/executors.d.ts

@@ -21,8 +21,10 @@ export declare function harnessExecutors(options: HarnessExecutorsOptions): Harn
 /**
  * Readies the run's MCP servers (§10.5 step 3): a run without MCP facts (`turn.start.mcp`, the
  * session's first) discovers their tools and records the snapshot (the first recorded wins);
- * later ones reconnect the snapshot's servers and record what failed. Answers the facts the run
- * goes on with. Nothing for a session without MCP servers.
+ * later ones reconnect the snapshot's servers and record what failed. A turn's first segment also
+ * discovers again each declared server the snapshot lacks (one that failed or was refused before),
+ * and records the ones that answer now: they join the snapshot, and the turn offers their tools.
+ * Answers the facts the run goes on with. Nothing for a session without MCP servers.
  */
 export declare function prepareMcp(pool: McpPool, run: HarnessRun, record: McpRecorder): Promise<PreparedRun | undefined>;
 /** A run's routing, as the call helpers take it. Its sandbox events are claimed for the run. */

package/dist/harness/executors.js

@@ -91,8 +91,10 @@ async function withSandbox(run, use) {
 /**
  * Readies the run's MCP servers (§10.5 step 3): a run without MCP facts (`turn.start.mcp`, the
  * session's first) discovers their tools and records the snapshot (the first recorded wins);
- * later ones reconnect the snapshot's servers and record what failed. Answers the facts the run
- * goes on with. Nothing for a session without MCP servers.
+ * later ones reconnect the snapshot's servers and record what failed. A turn's first segment also
+ * discovers again each declared server the snapshot lacks (one that failed or was refused before),
+ * and records the ones that answer now: they join the snapshot, and the turn offers their tools.
+ * Answers the facts the run goes on with. Nothing for a session without MCP servers.
  */
 export async function prepareMcp(pool, run, record) {
     const routing = routingOf(run);
@@ -114,9 +116,29 @@ export async function prepareMcp(pool, run, record) {
     }
     else {
         const diagnostics = await pool.reconnect({ sessionId, manifest, servers: facts.servers, signal: run.signal });
-        if (diagnostics.length === 0)
+        // Not mid-turn: a turn's tools stay what its first segment offered.
+        const first = run.start.checkpoint?.segment === 0;
+        const known = new Set(facts.servers.map((server) => JSON.stringify([server.agentId ?? null, server.name])));
+        const missing = first
+            ? serversOf(manifest).filter((item) => !known.has(JSON.stringify([item.agentId ?? null, item.server.name])))
+            : [];
+        const found = missing.length === 0
+            ? undefined
+            : await pool.discover({
+                sessionId,
+                manifest,
+                manifestHash: hashManifest(manifest),
+                maxInstructionBytes: run.start.limits.recordEntryBytes,
+                signal: run.signal,
+                servers: missing,
+            });
+        const all = [...diagnostics, ...(found?.diagnostics ?? [])];
+        if (all.length === 0)
             return undefined;
-        answer = await record({ diagnostics });
+        answer = await record({
+            ...(found && found.snapshot.servers.length > 0 ? { snapshot: found.snapshot } : {}),
+            diagnostics: all,
+        });
     }
     return answer.mcp === undefined ? undefined : { mcp: answer.mcp };
 }

package/dist/harness-api/record.js

@@ -195,7 +195,8 @@ export async function recordIntent(scope, effect, requestHash) {
  * - `mcp`: the tool `{server, tool}` of an MCP server its agent declares, as the session
  *   discovered it (`tool.unknown` otherwise), left enabled by the turn's manifest (R2b C9,
  *   `tool.disabled`);
- * - `http`: an HTTP tool its agent declares under that name (R2 M3), which crosses the Tool Gate;
+ * - `http`: an HTTP tool its agent declares under that name in the turn's manifest (R2 M3), which
+ *   crosses the Tool Gate;
  * - `sandbox`: one of the sandbox operations, in a session with a sandbox;
  * - `harness`: a tool the harness runs in its own process; its egress gate is its only control.
  * - `runtime`: served by `recordIntent` itself, before this (`schedule_wake`, track T4).
@@ -222,7 +223,8 @@ function refusal(s, request) {
             return undefined;
         }
         case "http":
-            return isHttpToolCall(s.manifest, request) ? undefined : unrunnableTool(request);
+            // Declared in the turn's manifest: a variant or `removeTools` may have removed it.
+            return isHttpToolCall(turnManifestOf(s), request) ? undefined : unrunnableTool(request);
         case "sandbox":
             return sessionSandboxSpec(s) !== undefined &&
                 request.toolName !== undefined &&

package/dist/harness-api/server.js

@@ -266,9 +266,11 @@ export function createHarnessApiServer(ctx, options = {}) {
     /**
      * What a harness found readying the run's MCP servers: the first snapshot recorded for the
      * session wins, pinned as it is within the Tenant's Runtime limit `mcpSnapshotBytes` (a server
-     * past it is left out, with a diagnostic: `fitSnapshot`), with `mcp.discovered` in its log;
-     * diagnostics replace those of the same server. Answers the session's facts as the run's turn
-     * sees them (protocol 15).
+     * past it is left out, with a diagnostic: `fitSnapshot`), with `mcp.discovered` in its log.
+     * A later snapshot adds only servers the session's lacks (servers that failed at its first
+     * discovery and answer now, `prepareMcp`), within the limit, with `mcp.discovered` naming them
+     * (`rejoined`). Diagnostics replace those of the same server. Answers the session's facts as the
+     * run's turn sees them (protocol 15).
      */
     const recordMcp = async (run, params) => {
         const snapshot = params.snapshot;
@@ -286,17 +288,39 @@ export function createHarnessApiServer(ctx, options = {}) {
                 await t.put("sessions", current.id, current);
                 await t.event(current.id, run.grant.turnId, "mcp.discovered", mcpDiscovered(current.mcpSnapshot, diagnostics, current.manifest), run.connection ? writerOf(run.connection, run.grant.runId) : undefined);
             }
-            else if (diagnostics.length > 0) {
-                const prior = [...(current.mcpDiagnostics ?? [])];
-                for (const item of diagnostics) {
-                    const index = prior.findIndex((existing) => (existing.agentId ?? null) === (item.agentId ?? null) && existing.serverName === item.serverName);
-                    if (index >= 0)
-                        prior[index] = item;
-                    else
-                        prior.push(item);
+            else {
+                const key = (agentId, name) => JSON.stringify([agentId ?? null, name]);
+                // Servers the session's snapshot lacks, which answered now: they join it.
+                let added = new Set();
+                if (snapshot && current.mcpSnapshot) {
+                    const pinned = current.mcpSnapshot.servers;
+                    const has = new Set(pinned.map((server) => key(server.agentId, server.name)));
+                    const fresh = snapshot.servers.filter((server) => !has.has(key(server.agentId, server.name)));
+                    if (fresh.length > 0) {
+                        const fitted = fitSnapshot({ ...current.mcpSnapshot, servers: [...pinned, ...fresh] }, diagnostics, (await readRuntimeLimits(t)).mcpSnapshotBytes, pinned.length);
+                        diagnostics = fitted.diagnostics;
+                        current.mcpSnapshot = fitted.snapshot;
+                        added = new Set(fitted.snapshot.servers.slice(pinned.length).map((server) => key(server.agentId, server.name)));
+                    }
                 }
-                current.mcpDiagnostics = prior;
-                await t.put("sessions", current.id, current);
+                if (diagnostics.length > 0) {
+                    const prior = [...(current.mcpDiagnostics ?? [])];
+                    for (const item of diagnostics) {
+                        const index = prior.findIndex((existing) => key(existing.agentId, existing.serverName) === key(item.agentId, item.serverName));
+                        if (index >= 0)
+                            prior[index] = item;
+                        else
+                            prior.push(item);
+                    }
+                    current.mcpDiagnostics = prior;
+                }
+                if (diagnostics.length > 0 || added.size > 0)
+                    await t.put("sessions", current.id, current);
+                if (added.size > 0 && current.mcpSnapshot)
+                    await t.event(current.id, run.grant.turnId, "mcp.discovered", {
+                        ...mcpDiscovered(current.mcpSnapshot, diagnostics.filter((item) => added.has(key(item.agentId, item.serverName))), current.manifest),
+                        rejoined: true,
+                    }, run.connection ? writerOf(run.connection, run.grant.runId) : undefined);
             }
             // The turn's manifest: a variant may have disabled tools.
             return current.mcpSnapshot ? { mcp: mcpFactsOf(current.mcpSnapshot, turnManifestOf(current)) } : {};

package/dist/harness-api/start.js

@@ -18,6 +18,7 @@ import { sandboxWorkspaceOf } from "../sandbox/share.js";
 import { ownedTx } from "../store/ownership.js";
 import { harnessOf } from "../tenant/context.js";
 import { repinTurn } from "../tenant/agent-versions.js";
+import { noteSessionModel, sessionModelRecordOf } from "../tenant/session-model.js";
 import { HARNESS_ID } from "../sandbox/placement.js";
 import { checkParity, foldTranscriptWithCursor, leanState, transcriptOf, transcriptUpdates, withTranscript, } from "../tenant/history.js";
 import { usesFixtureModel } from "../tenant/model-setting.js";
@@ -45,6 +46,11 @@ options = {}) {
         // A turn's first segment runs the version its Agent runs now (T3, D73).
         if (options.harness && (await repinTurn(t, current)))
             await t.put("sessions", id, current);
+        // The model the segment's calls use, and why: `session.model` when it changed since.
+        if (options.harness &&
+            !isWorkflowManifest(current.manifest) &&
+            (await noteSessionModel(t, current, await sessionModelRecordOf(t, current))))
+            await t.put("sessions", id, current);
         // A transcript left on our engine's state by an older Runtime is recorded once; another
         // harness's state is its own (R4.2).
         const limits = await readRuntimeLimits(t);
@@ -70,7 +76,10 @@ options = {}) {
             ...(current.sandbox === undefined ? {} : { spec: current.sandbox }),
         };
         const turnId = current.activeTurnId;
+        const noted = current.memoryIndex;
         const memory = isWorkflowManifest(current.manifest) ? undefined : await turnMemoryOf(t, current, limits);
+        if (current.memoryIndex !== noted)
+            await t.put("sessions", id, current);
         return {
             current,
             fixtureModel,
@@ -170,19 +179,48 @@ export function buildTurnStart(ctx, segment) {
 /**
  * The Agent's memory as the segment starts (track T5, D72), when the version the session runs sets
  * `harness.memory`: its access (the same in every turn), the agent's instructions, and the index of
- * its memories, newest first, within the Tenant's index limits.
+ * its memories, newest first, within the Tenant's index limits; no index when it sets
+ * `harness.memory.index: false`. `refresh` at a turn's first segment when someone other than the
+ * session wrote the memory since its last turn started (`memoryRefreshOf`); the harness then pins
+ * this index in place of the one it pinned before. Only our harness is sent it: another v5
+ * harness's schema may not know the field.
  */
 async function turnMemoryOf(t, s, limits) {
     const settings = await memorySettingsOf(t, s);
     if (!settings)
         return undefined;
-    const { index, truncated } = await renderMemoryIndex(t, s.agentId, limits);
-    return {
+    const base = {
         access: settings.access ?? "read_write",
         ...(settings.instructions === undefined ? {} : { instructions: settings.instructions }),
-        index,
-        truncated,
     };
+    // A version that sets `harness.memory.index: false` (ADR-100) pins no index: none is rendered.
+    if (settings.index === false)
+        return { ...base, truncated: false };
+    const { index, truncated } = await renderMemoryIndex(t, s.agentId, limits);
+    // Within Harness API 5 only our harness, the Runtime's own version, is sent `refresh`.
+    const refresh = (await memoryRefreshOf(t, s)) && harnessOf(s) === HARNESS_ID;
+    return { ...base, index, truncated, ...(refresh ? { refresh: true } : {}) };
+}
+/**
+ * Whether the harness pins the memory index again at this segment: only at a turn's first segment
+ * (never mid-turn), when a memory version newer than the one the session's last turn saw was
+ * written other than by this session (another session of the Agent, or the API). Notes the newest
+ * version on the session (`Session.memoryIndex`; the caller saves it), and answers a first segment
+ * that runs again as it was answered. The session's first turn pins the index anyway.
+ */
+async function memoryRefreshOf(t, s) {
+    const checkpoint = s.checkpoint;
+    const turnId = s.activeTurnId;
+    if (turnId === null || checkpoint?.segment !== 0 || checkpoint.turnId !== turnId)
+        return false;
+    const before = s.memoryIndex;
+    if (before?.turnId === turnId)
+        return before.refresh;
+    const writes = await t.memoryWritesSince(s.agentId, before?.seen, s.id);
+    const refresh = before !== undefined && writes.others;
+    const seen = writes.newest ?? before?.seen;
+    s.memoryIndex = { turnId, ...(seen === undefined ? {} : { seen }), refresh };
+    return refresh;
 }
 /**
  * The facts of the Agent a session runs on (Harness API 5): its id and kind, and, with the

package/dist/keys/keys.d.ts

@@ -2,7 +2,7 @@ import type { AgentSecretView, HostModelView, McpPreview, McpPreviewRequest, Put
 import type { SessionStore } from "../store/types.js";
 import type { OutboundPolicy } from "../tenant/outbound.js";
 import { type SigningKeys } from "../tenant/signing-keys.js";
-import type { SealedSecretCopies, VaultService } from "../vault/service.js";
+import type { SealedSecretCopies, SecretWriteOptions, VaultService } from "../vault/service.js";
 /** One JWT to sign: its `typ` and every claim, `iss`, `aud`, `sub`, `iat`, `exp` and `jti` included. */
 export interface SignRequest {
     readonly typ: string;
@@ -15,8 +15,11 @@ export interface Signed {
 }
 import { type SealedWebhookSecret, type WebhookDelivery } from "./webhooks.js";
 export interface Keys {
-    /** `PUT /v1/agents/{id}/secrets/{name}` (`VaultService.putEnvironmentSecret`). */
-    putEnvironmentSecret(environmentId: string, name: string, body: PutAgentSecretRequest, actor: string): Promise<AgentSecretView>;
+    /**
+     * `PUT /v1/agents/{id}/secrets/{name}` (`VaultService.putEnvironmentSecret`); `options.viaFromSlot`
+     * when `body.via` is the slot's, not the write's own (`secret-routing`).
+     */
+    putEnvironmentSecret(environmentId: string, name: string, body: PutAgentSecretRequest, actor: string, options?: SecretWriteOptions | null): Promise<AgentSecretView>;
     putHostModel(body: PutHostModelRequest): Promise<HostModelView>;
     selectHostModel(body: SelectHostModelRequest): Promise<HostModelView>;
     /**

package/dist/keys/keys.js

@@ -39,7 +39,7 @@ export function inProcessKeys(options) {
     const { store, vault, signingKeys, kek } = options;
     const egress = new EgressAuthority(store, kek);
     return {
-        putEnvironmentSecret: (environmentId, name, body, actor) => vault.putEnvironmentSecret(environmentId, name, body, actor),
+        putEnvironmentSecret: (environmentId, name, body, actor, options) => vault.putEnvironmentSecret(environmentId, name, body, actor, options),
         putHostModel: (body) => vault.putHostModel(body),
         selectHostModel: (body) => vault.selectHostModel(body),
         sealEnvironmentSecretCopies: (from, vaultId, slots) => vault.sealEnvironmentSecretCopies(from, vaultId, slots),

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.38.0-beta",
+    "version": "0.39.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -40,7 +40,9 @@
         "model-host-identity",
         "credential-provider",
         "turns",
-        "agent-model"
+        "agent-model",
+        "secret-routing",
+        "remove-tools"
       ]
     },
     "description": "For operators: the Tenant's models, vaults, signing keys, settings and application keys, at `/v1/tenant/*` on the Tenant's URL, through `@nylorun/admin`. Every operation takes a management key, acting as itself: never for a subject and never from a browser. Management keys are issued only on the Tenant's machine (`nylorun tenant keys put <id> --management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`."
@@ -2565,7 +2567,7 @@
                 "agent": {
                   "type": "string",
                   "minLength": 1,
-                  "description": "The agent that calls the tool: the agent manifest's name, or the id of an agent used as a tool or of a flow's agent, never an Agent's id. `*` matches any run of characters"
+                  "description": "The agent that calls the tool: the agent manifest's name, or the id of an agent used as a tool or of a flow's agent, never an Agent's id. The session's root agent's name also matches the calls of the agents it uses as tools. `*` matches any run of characters"
                 },
                 "when": {
                   "type": "object",
@@ -2667,7 +2669,7 @@
                 "agent": {
                   "type": "string",
                   "minLength": 1,
-                  "description": "The agent that calls the tool: the agent manifest's name, or the id of an agent used as a tool or of a flow's agent, never an Agent's id. `*` matches any run of characters"
+                  "description": "The agent that calls the tool: the agent manifest's name, or the id of an agent used as a tool or of a flow's agent, never an Agent's id. The session's root agent's name also matches the calls of the agents it uses as tools. `*` matches any run of characters"
                 },
                 "when": {
                   "type": "object",

package/dist/mcp/pool.d.ts

@@ -34,6 +34,11 @@ export declare class McpPool {
         manifestHash: string;
         maxInstructionBytes: number;
         signal?: AbortSignal;
+        /**
+         * Only these of its declared servers (default all): the ones a later turn tries again because
+         * they are not in the session's snapshot (`prepareMcp`).
+         */
+        servers?: readonly DeclaredServer[];
     }): Promise<{
         snapshot: McpSnapshot;
         diagnostics: McpDiagnostic[];

package/dist/mcp/pool.js

@@ -22,7 +22,7 @@ export class McpPool {
     async discover(input) {
         const servers = [];
         const diagnostics = [];
-        for (const declared of serversOf(input.manifest)) {
+        for (const declared of input.servers ?? serversOf(input.manifest)) {
             input.signal?.throwIfAborted();
             const opened = await this.connectDeclared(input, declared);
             if (!opened.ok) {

package/dist/mcp/snapshot.d.ts

@@ -49,7 +49,9 @@ export declare function manifestFor(manifest: AgentManifest, agent: HostEffect["
  * out, so the session never offers its tools, and its diagnostic says so (`failed`, replacing
  * the one it had). Unchanged when the whole snapshot fits.
  */
-export declare function fitSnapshot(snapshot: McpSnapshot, diagnostics: readonly McpDiagnostic[], limitBytes: number): {
+export declare function fitSnapshot(snapshot: McpSnapshot, diagnostics: readonly McpDiagnostic[], limitBytes: number, 
+/** How many of its first servers stay whatever their size: those the session pinned already. */
+keep?: number): {
     snapshot: McpSnapshot;
     diagnostics: McpDiagnostic[];
 };

package/dist/mcp/snapshot.js

@@ -86,17 +86,19 @@ export function manifestFor(manifest, agent) {
  * out, so the session never offers its tools, and its diagnostic says so (`failed`, replacing
  * the one it had). Unchanged when the whole snapshot fits.
  */
-export function fitSnapshot(snapshot, diagnostics, limitBytes) {
+export function fitSnapshot(snapshot, diagnostics, limitBytes, 
+/** How many of its first servers stay whatever their size: those the session pinned already. */
+keep = 0) {
     const bytes = (value) => Buffer.byteLength(JSON.stringify(value));
     if (bytes(snapshot) <= limitBytes)
         return { snapshot, diagnostics: [...diagnostics] };
     const kept = [];
     const dropped = new Map();
     const key = (agentId, serverName) => JSON.stringify([agentId ?? null, serverName]);
-    for (const server of snapshot.servers) {
+    for (const [index, server] of snapshot.servers.entries()) {
         const next = { ...snapshot, servers: [...kept, server] };
         const size = bytes(next);
-        if (size <= limitBytes)
+        if (index < keep || size <= limitBytes)
             kept.push(server);
         else
             dropped.set(key(server.agentId, server.name), bytes(server));