@nylorun/runtime 0.38.0-beta → 0.40.0-beta

package/CHANGELOG.md

@@ -1,5 +1,81 @@
 # Changelog
 
+## 0.40.0-beta
+
+### Minor Changes
+
+- 78787e2: A2A `SendMessage` takes `message.metadata.removeTools` (Host feature `remove-tools`): the tools a new message's turn may not use, by name, as a session message's `removeTools`. `createA2aClient`'s `send` takes `removeTools`.
+
+## 0.39.0-beta
+
+### Minor Changes
+
+- 67ed2ea: A version that sets `harness.memory.index: false` (`agent-folder/2`, ADR-100) gets no memory index
+  rendered: `turn.start.memory` comes without `index`. The harness may claim `engine.diagnostic`,
+  which the OpenAPI document lists.
+- 67ed2ea: An MCP server that failed at a session's first discovery is tried again at each later turn's first
+  segment, and joins the session's snapshot once it answers: its tools are offered from that turn on,
+  its diagnostic is replaced, and `mcp.discovered` names it again with `rejoined: true`. `session.mcp`
+  takes a later snapshot of servers the session lacks and merges them within `mcpSnapshotBytes`.
+- 67ed2ea: The memory index a session pinned is refreshed at its next turn's first segment (never mid-turn)
+  when another session of the Agent, or the API, wrote the Agent's memory since its last turn started:
+  `turn.start.memory.refresh` (Harness API), and our engine pins the index again (`runDurable`'s
+  `refreshPinned`). The Runtime keeps the newest memory version a turn saw on the session
+  (`Session.memoryIndex`, `memoryWritesSince`). A session's own writes leave its index as pinned.
+- 67ed2ea: A tool policy rule whose `agent` names the session's root agent (its manifest's name) also matches
+  the MCP and HTTP calls of the agents it uses as tools; a rule naming the subagent's id still matches
+  them. `PolicyCall.root` carries the root for a subagent's call. The `agent` selector's contract
+  comments say so.
+- 67ed2ea: A message's `removeTools` (Host feature `remove-tools`): the tools its turn may not use, by name. A
+  declared tool or an agent used as a tool by its name (in the agent and the agents it uses as tools),
+  an MCP server's tool as `<server>__<tool>`, a whole server by its name. The Runtime applies it to the
+  version the turn runs, after the turn's first segment re-pins the session to its Agent's version, so
+  a session that always sends it still moves to new versions; names that version lacks are ignored.
+  A message's turn manifest is validated again against the version a re-pin moves to; one that is no
+  variant of it keeps the turn on the version it pinned (`turn.version_kept`). A variant may narrow an
+  agent it uses as a tool (`isVariantOf`; `withoutTools` in `@nylorun/core/define`). An HTTP tool call
+  is checked against the turn's manifest. `session.input` and `session.inputParts` take
+  `removeTools`.
+- 67ed2ea: Secret routing: the agent folder names, the installation routes (Host feature `secret-routing`, no
+  protocol change). A `bearer` or `headers` secret slot (`runtime.json`, `runtime.secrets`) takes the
+  gateway's `toolPrefix`, with or without `via`, and a slot's value write
+  (`PUT /v1/agents/{id}/secrets/{name}` with `{ value }` or `{ headers }`) takes `via`, with the same
+  URL rules as a slot's. At each request the secret's `via` wins, else the slot's in the version the
+  Agent runs, else none (the slot's `url`); the slot's `toolPrefix` wins over the secret's and
+  applies only with a `via`; the slot's `url` still picks the credential, for MCP servers and HTTP
+  tools alike, and an HTTP tool whose URL has `{field}` parameters still fails behind a `via`. A
+  write whose `toolPrefix` differs from its slot's is accepted, with a warning in the log. A `via` a
+  write copied from its slot follows the slot when the Agent moves, and a fork keeps a secret's own
+  `via`. Secret views show the `via` and `toolPrefix` in force, never a value.
+  `client.agents.secrets.put` takes `{ value | headers, via?, toolPrefix? }` (`AgentSecretRouting`),
+  and `nylorun agents secrets put` takes `--via` and `--tool-prefix`, and a slot's JSON without a
+  `type`. The JSON Schemas that gained the slot's `toolPrefix` are published as
+  `agent-manifest/v8.2`, `runtime-manifest/v1.1` and `agent-folder/v1/runtime.1`, which `nylorun init`
+  maps; the old `$schema` URLs are still read.
+- 67ed2ea: A session records the model its turns call and why (`SessionModelRecord`): `model` on `GET
+/v1/sessions/{id}` is `{provider, model, source: "manifest" | "session" | "tenant", reason?,
+requested?}`, with the fallback's `reason` (`provider_not_connected`, `not_in_catalog`,
+  `invalid_model`) and the model `requested` by the manifest or the session. It is set when the
+  session opens, chooses or clears its model, and again at each segment's start, and each change
+  writes the new `session.model` event with the `previous` record. `SessionView.model` in
+  `@nylorun/agents`.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+- Updated dependencies [67ed2ea]
+- Updated dependencies
+  - @nylorun/core@0.34.0-beta
+  - @nylorun/harness@0.31.0-beta
+
 ## 0.38.0-beta
 
 ### Minor Changes

package/dist/api/a2a/endpoint.js

@@ -72,7 +72,7 @@ export function a2aRoutes(api) {
         path: "/v1/a2a/agents/{agentId}",
         tags: TAGS,
         summary: "Call an agent over A2A",
-        description: "A2A 1.0 JSON-RPC, for a subject, under the Nylorun profile v2 (Host feature `a2a-profile-v2`). `SendMessage` blocks up to the Runtime limit `a2aWaitMs` (5 minutes by default; then the task is answered still `WORKING`) unless `returnImmediately`; `GetTask` (with `historyLength`), `CancelTask` and `ListTasks`; and the four push notification config methods, plus `configuration.taskPushNotificationConfig` in `SendMessage`: each update is POSTed as one `StreamResponse`, signed with Standard Webhooks (`webhook-id`, `webhook-timestamp`, `webhook-signature` with the Runtime's `a2a.push.secret`) and `X-A2A-Notification-Token`, at least once, retried for up to 24 hours, to hosts the Runtime allows (`a2a.push.allowHosts` for private ones). A message to a busy context is queued and answered with the task that will take it (`TASK_STATE_SUBMITTED`); `message.metadata.delivery: \"reject\"` asks for `UnsupportedOperationError` (reason `CONTEXT_BUSY`) instead. A message is text, one data part, or text with `raw` files (stored as artifacts of the context's session) and `url` files (fetched by the Runtime), each at most the Runtime limit `inlineFileBytes` (20 MiB by default). An approval, question or connection the task waits for (`AUTH_REQUIRED` or `INPUT_REQUIRED`) is shown under `interactions/v1` and answered on the same task with `{ interactionId, approved }` or `{ interactionId, value }` under that URI in the message's `metadata`; text never approves. Artifacts carry the turn's output and the files it wrote, as `url` parts at `/v1/a2a/files/…` with `files/v1`; the task's metadata carries `progress/v1`, `telemetry/v1` and `effects/v1`. Extension data is answered only for the extensions activated with `A2A-Extensions`. A context is one session per subject, agent and `contextId`; a task is one turn. JSON-RPC errors are answered with 200; limits, scopes and unavailable streams stay HTTP errors. Not served: streaming, `GetExtendedAgentCard`.",
+        description: "A2A 1.0 JSON-RPC, for a subject, under the Nylorun profile v2 (Host feature `a2a-profile-v2`). `SendMessage` blocks up to the Runtime limit `a2aWaitMs` (5 minutes by default; then the task is answered still `WORKING`) unless `returnImmediately`; `GetTask` (with `historyLength`), `CancelTask` and `ListTasks`; and the four push notification config methods, plus `configuration.taskPushNotificationConfig` in `SendMessage`: each update is POSTed as one `StreamResponse`, signed with Standard Webhooks (`webhook-id`, `webhook-timestamp`, `webhook-signature` with the Runtime's `a2a.push.secret`) and `X-A2A-Notification-Token`, at least once, retried for up to 24 hours, to hosts the Runtime allows (`a2a.push.allowHosts` for private ones). A message to a busy context is queued and answered with the task that will take it (`TASK_STATE_SUBMITTED`); `message.metadata.delivery: \"reject\"` asks for `UnsupportedOperationError` (reason `CONTEXT_BUSY`) instead. `message.metadata.removeTools` (Host feature `remove-tools`) names the tools a new message's turn may not use, as a session message's `removeTools`. A message is text, one data part, or text with `raw` files (stored as artifacts of the context's session) and `url` files (fetched by the Runtime), each at most the Runtime limit `inlineFileBytes` (20 MiB by default). An approval, question or connection the task waits for (`AUTH_REQUIRED` or `INPUT_REQUIRED`) is shown under `interactions/v1` and answered on the same task with `{ interactionId, approved }` or `{ interactionId, value }` under that URI in the message's `metadata`; text never approves. Artifacts carry the turn's output and the files it wrote, as `url` parts at `/v1/a2a/files/…` with `files/v1`; the task's metadata carries `progress/v1`, `telemetry/v1` and `effects/v1`. Extension data is answered only for the extensions activated with `A2A-Extensions`. A context is one session per subject, agent and `contextId`; a task is one turn. JSON-RPC errors are answered with 200; limits, scopes and unavailable streams stay HTTP errors. Not served: streaming, `GetExtendedAgentCard`.",
         externalDocs: A2A_SPECIFICATION,
         request: {
             params: agentId,

package/dist/api/a2a/protocol.d.ts

@@ -226,6 +226,12 @@ export interface SendParams {
     push?: PushConfigInput;
     /** `metadata.delivery`; default `queue`. */
     delivery: Delivery;
+    /**
+     * `metadata.removeTools` (Host feature `remove-tools`): the tools the message's turn may not
+     * use, by name, as a session message's `removeTools`. A new message only: a reply answers an
+     * interaction of a turn already running.
+     */
+    removeTools?: readonly string[];
     /** The answer the message carries under `interactions/v1`. */
     answer?: InteractionAnswer;
 }

package/dist/api/a2a/protocol.js

@@ -223,6 +223,17 @@ export function parsePushConfig(value, field) {
         ...(authentication ? { authentication } : {}),
     };
 }
+/** `metadata.removeTools`: at most 256 names of 1 to 256 characters (a session message's `removeTools`). */
+function parseRemoveTools(metadata) {
+    const value = metadata.removeTools;
+    if (value === undefined || value === null)
+        return undefined;
+    if (!Array.isArray(value) ||
+        value.length > 256 ||
+        !value.every((name) => typeof name === "string" && name.length >= 1 && name.length <= 256))
+        return a2aFail("invalidParams", "message.metadata.removeTools must be at most 256 tool names of 1 to 256 characters", {}, "message.metadata.removeTools");
+    return value;
+}
 /** `metadata.delivery`: `queue` (the default) or `reject`. */
 function parseDelivery(metadata) {
     const delivery = metadata.delivery;
@@ -272,6 +283,7 @@ export function parseSendParams(params) {
     // On the message (the profile's place), or on the request's own metadata.
     const delivery = parseDelivery(metadata.delivery === undefined && isObject(params.metadata) ? params.metadata : metadata);
     const answer = parseAnswer(metadata);
+    const removeTools = parseRemoveTools(metadata.removeTools === undefined && isObject(params.metadata) ? params.metadata : metadata);
     const configuration = params.configuration;
     if (configuration !== undefined && configuration !== null && !isObject(configuration))
         a2aFail("invalidParams", "configuration must be an object", {}, "configuration");
@@ -315,6 +327,7 @@ export function parseSendParams(params) {
         ...(historyLength !== undefined ? { historyLength } : {}),
         ...(push ? { push } : {}),
         delivery,
+        ...(removeTools ? { removeTools } : {}),
         ...(answer ? { answer } : {}),
     };
 }

package/dist/api/a2a/routes.js

@@ -335,6 +335,7 @@ async function sendMessage(caller, params, signal) {
             requestId: randomUUID(),
             idempotencyKey,
             ...body,
+            ...(send.removeTools ? { removeTools: [...send.removeTools] } : {}),
         }, async () => {
             const active = (await contextSession(caller, sessionId))?.activeTurnId;
             const taskId = active ? taskIdOf(context, active) : undefined;