@nylorun/runtime 0.40.0-beta → 0.42.0-beta

package/dist/harness-api/record.js

@@ -38,7 +38,8 @@ import { abortKind } from "../tenant/worker.js";
 import { redactTokens } from "./redact.js";
 import { toolCallDecision } from "../gates/policy.js";
 import { traceKey } from "../traces/key.js";
-import { serveRuntimeTool } from "../tenant/triggers.js";
+import { armTrigger, serveRuntimeTool } from "../tenant/triggers.js";
+import { serveTriggersTool, triggersRefusal } from "../tenant/agent-triggers.js";
 import { serveMemoryTool } from "../memory/tool.js";
 import { effectSpanOf, traceparentOf, turnTraceIdOf } from "../traces/ids.js";
 import { firstSend, interrupted, settleToolRow, toolKindOf, } from "./tool-journal.js";
@@ -63,7 +64,10 @@ export async function recordIntent(scope, effect, requestHash) {
     const request = effect;
     // Read before the transaction: the first read of the Tenant may create the key.
     const key = await traceKey(ctx.store);
+    /** Triggers a `triggers` call wrote (D83): armed once the transaction commits. */
+    const toArm = [];
     const answer = await ctx.store.tx(async (t) => {
+        toArm.length = 0;
         const s = await ownedSession(t, lease, request.sessionId);
         if (s.status === "cancelled" || s.activeTurnId !== request.turnId)
             throw TURN_CANCELLED();
@@ -81,6 +85,13 @@ export async function recordIntent(scope, effect, requestHash) {
             // to join it or collect its outcome (P1.2).
             if (existing.status === "invoking" && request.kind === "model" && recoversModelCalls(ctx))
                 return { status: "execute", rejoin: true };
+            // An operation the Runtime serves that a person approved while it was held (D83): served
+            // now, as the turn resumes, in this transaction; never resent.
+            if (existing.status === "invoking" &&
+                existing.request.kind === "tool" &&
+                existing.request.target?.kind === "runtime" &&
+                existing.approval?.approved === true)
+                return { status: "completed", outcome: await serveRuntimeRow(t, s, existing, scope, toArm) };
             // A tool call a crash, a shutdown or a lost gate hop interrupted (R5.3, R5.4).
             if (existing.status === "invoking" && existing.request.kind === "tool")
                 return resend(t, s, existing, recoversToolCalls(ctx));
@@ -141,12 +152,20 @@ export async function recordIntent(scope, effect, requestHash) {
         if (!agentManifest)
             throw new Error(`Agent '${request.agent?.id ?? ""}' is not used as a tool`);
         // An operation the Runtime serves itself (track T4): settled here, in the call's own
-        // transaction, keyed by its effect id, so a replay finds it completed.
+        // transaction, keyed by its effect id, so a replay finds it completed. The Tenant's tool
+        // policy decides it first (D83): a rule of kind `runtime` may deny it or hold it for a person.
         if (request.kind === "tool" && request.target?.kind === "runtime") {
             const row = { request, requestHash, status: "invoking", ...firstSend(toolKindOf(s, agentManifest, request)) };
-            const served = request.target.operation === "memory" ? await serveMemoryTool(t, s, request) : await serveRuntimeTool(t, s, request);
-            const outcome = await settleToolRow(t, s, row, served, { writer: coreIn(scope) });
-            return { status: "completed", outcome };
+            // Off means off (ADR-100): a call the session's agent cannot make is refused unasked.
+            const unavailable = request.target.operation === "triggers" ? await triggersRefusal(t, s, request) : undefined;
+            if (unavailable) {
+                row.attempts = 0;
+                return { status: "completed", outcome: await settleToolRow(t, s, row, unavailable, { writer: coreIn(scope) }) };
+            }
+            const decided = await bypolicy(t, s, row, "runtime");
+            if (decided)
+                return decided;
+            return { status: "completed", outcome: await serveRuntimeRow(t, s, row, scope, toArm) };
         }
         const refused = request.kind === "tool" ? refusal(s, request) : undefined;
         if (refused) {
@@ -182,12 +201,37 @@ export async function recordIntent(scope, effect, requestHash) {
         await t.put("effects", request.effectId, row);
         return { status: "execute", ...(row.traceparent ? { traceparent: row.traceparent } : {}) };
     });
+    // No I/O in the transaction: the triggers it wrote are armed now; the sweep arms what this misses.
+    for (const row of toArm)
+        await armTrigger(ctx, row).catch((error) => ctx.config.logger.warn("trigger not armed after its call; the sweep arms it", {
+            triggerId: row.triggerId,
+            message: error instanceof Error ? error.message : String(error),
+        }));
     if (answer !== "flow")
         return answer;
     if (!isFlowEffect(request))
         return { status: "pending" };
     return resolveNewFlowEffect(ctx, request, signal, lease);
 }
+/**
+ * Serves the `runtime` effect of tool row `row` in `t` and settles the row (track T4, D72, D83):
+ * `memory`, `schedule_wake` or `triggers`. Rows a `triggers` call wrote go on `toArm`.
+ */
+async function serveRuntimeRow(t, s, row, scope, toArm) {
+    const request = row.request;
+    const operation = request.target?.kind === "runtime" ? request.target.operation : undefined;
+    let served;
+    if (operation === "memory")
+        served = await serveMemoryTool(t, s, request);
+    else if (operation === "triggers") {
+        const result = await serveTriggersTool(t, s, request);
+        toArm.push(...result.arm);
+        served = result.outcome;
+    }
+    else
+        served = await serveRuntimeTool(t, s, request);
+    return settleToolRow(t, s, row, served, { writer: coreIn(scope) });
+}
 /**
  * Why an agent's tool call cannot run, by what it names as its target (protocol 15), or
  * undefined when it can:
@@ -199,7 +243,8 @@ export async function recordIntent(scope, effect, requestHash) {
  *   crosses the Tool Gate;
  * - `sandbox`: one of the sandbox operations, in a session with a sandbox;
  * - `harness`: a tool the harness runs in its own process; its egress gate is its only control.
- * - `runtime`: served by `recordIntent` itself, before this (`schedule_wake`, track T4).
+ * - `runtime`: served by `recordIntent` itself, before this (`schedule_wake`, track T4; `memory`,
+ *   track T5; `triggers`, D83), after the Tenant's tool policy.
  *
  * No target, and anything else, runs nothing (`tool.unavailable`).
  */

package/dist/harness-api/start.js

@@ -87,7 +87,7 @@ options = {}) {
             ...(memory ? { memory } : {}),
             outcomes: current.checkpoint ? await bulkOutcomes(t, current, current.checkpoint) : [],
             sandbox,
-            ...(resource ? { agent: agentOf(resource, current.sandbox, await selfWakeOf(t, current)) } : {}),
+            ...(resource ? { agent: agentOf(resource, current.sandbox, await pinnedEngineFacts(t, current)) } : {}),
             ...(key && turnId ? { trace: turnContextOf(key, ctx.store.tenantId, current, turnId) } : {}),
             ...(resource?.pod
                 ? {
@@ -224,22 +224,28 @@ async function memoryRefreshOf(t, s) {
 }
 /**
  * The facts of the Agent a session runs on (Harness API 5): its id and kind, and, with the
- * session's sandbox, the workspace its commands start in. The harness words them.
+ * session's sandbox, the workspace its commands start in; whether the version it runs books its
+ * own wakes and declares the triggers capability. The harness words them.
  */
-function agentOf(resource, spec, selfWake) {
+function agentOf(resource, spec, facts) {
     return {
         id: resource.id,
         kind: resource.kind,
         ...(spec === undefined ? {} : { sandbox: { workspace: SANDBOX_WORKSPACE } }),
-        ...(selfWake ? { selfWake: true } : {}),
+        ...(facts.selfWake ? { selfWake: true } : {}),
+        ...(facts.triggers ? { triggers: true } : {}),
     };
 }
-/** Whether the manifest version the session runs sets `runtime.selfWake` (track T4, D77). */
-async function selfWakeOf(t, s) {
+/**
+ * Whether the manifest version the session runs sets `runtime.selfWake` (track T4, D77) and
+ * declares `harness.engine.triggers` (D83).
+ */
+async function pinnedEngineFacts(t, s) {
     if (!s.definition)
-        return false;
-    const version = await t.agentManifest(s.definition.name, s.definition.version);
-    return version?.body.runtime?.selfWake === true;
+        return { selfWake: false, triggers: false };
+    const body = (await t.agentManifest(s.definition.name, s.definition.version))?.body;
+    const harness = body?.harness;
+    return { selfWake: body?.runtime?.selfWake === true, triggers: harness?.engine?.triggers === true };
 }
 /**
  * The context of turn `turnId`'s span (R7.4): its trace (the caller's when its message carried a

package/dist/harness-api/tool-journal.js

@@ -25,6 +25,9 @@ export function toolKindOf(s, agentManifest, request) {
         const host = httpHostOf(declaredHttpTool(s.manifest, request.agent?.id, target.tool)?.http.url);
         return { toolKind: "http", ...(host === undefined ? {} : { server: host }), tool: target.tool };
     }
+    // An operation the Runtime serves (D83): its identity is the operation, as the policy names it.
+    if (target?.kind === "runtime")
+        return { toolKind: "runtime", tool: target.operation };
     const skill = request.skill !== undefined && agentManifest?.skills?.[request.skill] !== undefined
         ? request.skill
         : undefined;

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.40.0-beta",
+    "version": "0.42.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -42,7 +42,8 @@
         "turns",
         "agent-model",
         "secret-routing",
-        "remove-tools"
+        "remove-tools",
+        "agent-triggers"
       ]
     },
     "description": "For operators: the Tenant's models, vaults, signing keys, settings and application keys, at `/v1/tenant/*` on the Tenant's URL, through `@nylorun/admin`. Every operation takes a management key, acting as itself: never for a subject and never from a browser. Management keys are issued only on the Tenant's machine (`nylorun tenant keys put <id> --management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`."
@@ -2561,8 +2562,10 @@
                   "type": "string",
                   "enum": [
                     "mcp",
-                    "http"
-                  ]
+                    "http",
+                    "runtime"
+                  ],
+                  "description": "mcp, http, or runtime: an operation the Runtime serves itself (triggers, memory, schedule_wake), which only a rule naming it matches"
                 },
                 "agent": {
                   "type": "string",
@@ -2663,8 +2666,10 @@
                   "type": "string",
                   "enum": [
                     "mcp",
-                    "http"
-                  ]
+                    "http",
+                    "runtime"
+                  ],
+                  "description": "mcp, http, or runtime: an operation the Runtime serves itself (triggers, memory, schedule_wake), which only a rule naming it matches"
                 },
                 "agent": {
                   "type": "string",