@nylorun/runtime 0.41.0-beta → 0.43.0-beta

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## 0.43.0-beta
+
+### Minor Changes
+
+- c649f33: A message can steer a running turn (D85). `delivery: "steer"` on a `message` command, behind the
+  optional Host feature `steer`: to a busy agent session it waits in the session queue marked
+  `steer`, and our engine takes it into the running turn before its next step, after the tool
+  results, through a new effect kind, `inputs`, which core answers in the transaction that journals
+  it (Harness API 5, `harness-api/v5.4.json`). Each taken message's `command.message` is written
+  under the running turn, then `queue.taken` with the `step`. The queued answer and
+  `message.queued` say which delivery applied; a workflow session queues. A steer the turn doesn't
+  take starts the next turn like any queued message, and D76's defaults never choose steer.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [c649f33]
+- Updated dependencies
+  - @nylorun/core@0.37.0-beta
+  - @nylorun/harness@0.34.0-beta
+
+## 0.42.0-beta
+
+### Minor Changes
+
+- 2afa44d: The Runtime's primitives as its own Agent Plugins (ADR-106, D84). An `agent-folder/3` folder lists them under `plugins:` (`nylorun-memory`, `nylorun-triggers`, `nylorun-plan`, `nylorun-interactions`, `nylorun-artifacts`, `nylorun-sandbox`, which needs a computer), with no versions, and turns one of their tools off with `mcpServers.nylorun.tools.<tool>.enabled: false`. The compiler reads them as the `agent-folder/2` declarations they stand for (`memory`, `loop`, `engine.sandbox`, `engine.artifacts`, `engine.triggers`, which v3 refuses) and records them in `harness.engine.plugins`, each with its tools and the hash of its files. The engine presents their tools as the reserved server `nylorun`: the model reads `nylorun__memory` and the declared plugins' words as one text, with their skills (`memory`, `triggers`) in the catalog, served from the bundle; every effect keeps its target and `toolName`, so the record, tool policy (`kind: "runtime"` rules) and dispatch are unchanged. New: `ask` (`nylorun-interactions`, `harness.loop.ask`), a question that pauses the turn as an A2A `question`; `removeTools` takes `nylorun__<tool>`; `triggers` answers carry `now`; under `nylorun-triggers`, an agent-made trigger's run starts with a `[trigger <id> · <title> · nobody is watching]` line, and a turn a trigger started may set a one-off follow-up (`in` or `at`, `session: "this"`); the sandbox's instructions name the hosts `runtime.json` allows. `nylorun migrate folder <dir> --to 3` writes the plugins that keep an agent's tools and features, and `nylorun check --explain` names the plugin behind each. The JSON Schemas are republished as `agent-manifest/v8.4`, `harness-manifest/v1.4` and `agent-folder/v1/agent-md.4`.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [2afa44d]
+- Updated dependencies
+  - @nylorun/core@0.36.0-beta
+  - @nylorun/harness@0.33.0-beta
+
 ## 0.41.0-beta
 
 ### Minor Changes

package/dist/api/components.d.ts

@@ -2214,6 +2214,7 @@ export declare const SessionCommand: z.ZodUnion<readonly [z.ZodUnion<readonly [z
     delivery: z.ZodOptional<z.ZodEnum<{
         queue: "queue";
         reject: "reject";
+        steer: "steer";
     }>>;
     content: z.ZodString;
 }, z.core.$strict>, z.ZodObject<{
@@ -2225,6 +2226,7 @@ export declare const SessionCommand: z.ZodUnion<readonly [z.ZodUnion<readonly [z
     delivery: z.ZodOptional<z.ZodEnum<{
         queue: "queue";
         reject: "reject";
+        steer: "steer";
     }>>;
     data: z.ZodType<import("@nylorun/core/define").JsonValue, unknown, z.core.$ZodTypeInternals<import("@nylorun/core/define").JsonValue, unknown>>;
 }, z.core.$strict>, z.ZodObject<{
@@ -2236,6 +2238,7 @@ export declare const SessionCommand: z.ZodUnion<readonly [z.ZodUnion<readonly [z
     delivery: z.ZodOptional<z.ZodEnum<{
         queue: "queue";
         reject: "reject";
+        steer: "steer";
     }>>;
     parts: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         type: z.ZodLiteral<"text">;
@@ -2273,6 +2276,10 @@ export declare const QueuedResponse: z.ZodObject<{
     status: z.ZodLiteral<"queued">;
     queuedMessageId: z.ZodString;
     position: z.ZodNumber;
+    delivery: z.ZodOptional<z.ZodEnum<{
+        queue: "queue";
+        steer: "steer";
+    }>>;
     cursor: z.ZodNullable<z.ZodString>;
     requestId: z.ZodString;
 }, z.core.$strip>;
@@ -3309,6 +3316,7 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
         delivery: z.ZodOptional<z.ZodEnum<{
             queue: "queue";
             reject: "reject";
+            steer: "steer";
         }>>;
         queuedMessageId: z.ZodOptional<z.ZodString>;
         cause: z.ZodOptional<z.ZodObject<{
@@ -4431,6 +4439,10 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
         queuedMessageId: z.ZodString;
         position: z.ZodNumber;
         requestId: z.ZodString;
+        delivery: z.ZodOptional<z.ZodEnum<{
+            queue: "queue";
+            steer: "steer";
+        }>>;
     }, z.core.$loose>;
 }, z.core.$strip> | z.ZodObject<{
     schema: z.ZodLiteral<"nylorun.event/2">;
@@ -4904,6 +4916,7 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
     payload: z.ZodObject<{
         turnId: z.ZodString;
         queuedMessageIds: z.ZodArray<z.ZodString>;
+        step: z.ZodOptional<z.ZodNumber>;
     }, z.core.$loose>;
 }, z.core.$strip> | z.ZodObject<{
     schema: z.ZodLiteral<"nylorun.event/2">;
@@ -6388,6 +6401,7 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
         delivery: z.ZodOptional<z.ZodEnum<{
             queue: "queue";
             reject: "reject";
+            steer: "steer";
         }>>;
         queuedMessageId: z.ZodOptional<z.ZodString>;
         cause: z.ZodOptional<z.ZodObject<{
@@ -7510,6 +7524,10 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
         queuedMessageId: z.ZodString;
         position: z.ZodNumber;
         requestId: z.ZodString;
+        delivery: z.ZodOptional<z.ZodEnum<{
+            queue: "queue";
+            steer: "steer";
+        }>>;
     }, z.core.$loose>;
 }, z.core.$strip> | z.ZodObject<{
     schema: z.ZodLiteral<"nylorun.event/2">;
@@ -7983,6 +8001,7 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
     payload: z.ZodObject<{
         turnId: z.ZodString;
         queuedMessageIds: z.ZodArray<z.ZodString>;
+        step: z.ZodOptional<z.ZodNumber>;
     }, z.core.$loose>;
 }, z.core.$strip> | z.ZodObject<{
     schema: z.ZodLiteral<"nylorun.event/2">;
@@ -9470,6 +9489,7 @@ export declare const SessionItemsResponse: z.ZodObject<{
             delivery: z.ZodOptional<z.ZodEnum<{
                 queue: "queue";
                 reject: "reject";
+                steer: "steer";
             }>>;
             queuedMessageId: z.ZodOptional<z.ZodString>;
             cause: z.ZodOptional<z.ZodObject<{
@@ -10592,6 +10612,10 @@ export declare const SessionItemsResponse: z.ZodObject<{
             queuedMessageId: z.ZodString;
             position: z.ZodNumber;
             requestId: z.ZodString;
+            delivery: z.ZodOptional<z.ZodEnum<{
+                queue: "queue";
+                steer: "steer";
+            }>>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
         schema: z.ZodLiteral<"nylorun.event/2">;
@@ -11065,6 +11089,7 @@ export declare const SessionItemsResponse: z.ZodObject<{
         payload: z.ZodObject<{
             turnId: z.ZodString;
             queuedMessageIds: z.ZodArray<z.ZodString>;
+            step: z.ZodOptional<z.ZodNumber>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
         schema: z.ZodLiteral<"nylorun.event/2">;
@@ -12549,6 +12574,7 @@ export declare const SessionItemsResponse: z.ZodObject<{
             delivery: z.ZodOptional<z.ZodEnum<{
                 queue: "queue";
                 reject: "reject";
+                steer: "steer";
             }>>;
             queuedMessageId: z.ZodOptional<z.ZodString>;
             cause: z.ZodOptional<z.ZodObject<{
@@ -13671,6 +13697,10 @@ export declare const SessionItemsResponse: z.ZodObject<{
             queuedMessageId: z.ZodString;
             position: z.ZodNumber;
             requestId: z.ZodString;
+            delivery: z.ZodOptional<z.ZodEnum<{
+                queue: "queue";
+                steer: "steer";
+            }>>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
         schema: z.ZodLiteral<"nylorun.event/2">;
@@ -14144,6 +14174,7 @@ export declare const SessionItemsResponse: z.ZodObject<{
         payload: z.ZodObject<{
             turnId: z.ZodString;
             queuedMessageIds: z.ZodArray<z.ZodString>;
+            step: z.ZodOptional<z.ZodNumber>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
         schema: z.ZodLiteral<"nylorun.event/2">;
@@ -16546,6 +16577,7 @@ export declare const HistoryPage: z.ZodObject<{
             delivery: z.ZodOptional<z.ZodEnum<{
                 queue: "queue";
                 reject: "reject";
+                steer: "steer";
             }>>;
             queuedMessageId: z.ZodOptional<z.ZodString>;
             cause: z.ZodOptional<z.ZodObject<{
@@ -17668,6 +17700,10 @@ export declare const HistoryPage: z.ZodObject<{
             queuedMessageId: z.ZodString;
             position: z.ZodNumber;
             requestId: z.ZodString;
+            delivery: z.ZodOptional<z.ZodEnum<{
+                queue: "queue";
+                steer: "steer";
+            }>>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
         schema: z.ZodLiteral<"nylorun.event/2">;
@@ -18141,6 +18177,7 @@ export declare const HistoryPage: z.ZodObject<{
         payload: z.ZodObject<{
             turnId: z.ZodString;
             queuedMessageIds: z.ZodArray<z.ZodString>;
+            step: z.ZodOptional<z.ZodNumber>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
         schema: z.ZodLiteral<"nylorun.event/2">;
@@ -19625,6 +19662,7 @@ export declare const HistoryPage: z.ZodObject<{
             delivery: z.ZodOptional<z.ZodEnum<{
                 queue: "queue";
                 reject: "reject";
+                steer: "steer";
             }>>;
             queuedMessageId: z.ZodOptional<z.ZodString>;
             cause: z.ZodOptional<z.ZodObject<{
@@ -20747,6 +20785,10 @@ export declare const HistoryPage: z.ZodObject<{
             queuedMessageId: z.ZodString;
             position: z.ZodNumber;
             requestId: z.ZodString;
+            delivery: z.ZodOptional<z.ZodEnum<{
+                queue: "queue";
+                steer: "steer";
+            }>>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
         schema: z.ZodLiteral<"nylorun.event/2">;
@@ -21220,6 +21262,7 @@ export declare const HistoryPage: z.ZodObject<{
         payload: z.ZodObject<{
             turnId: z.ZodString;
             queuedMessageIds: z.ZodArray<z.ZodString>;
+            step: z.ZodOptional<z.ZodNumber>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
         schema: z.ZodLiteral<"nylorun.event/2">;

package/dist/harness-api/record.js

@@ -28,6 +28,7 @@ import { sessionSandboxSpec } from "../sandbox/share.js";
 import { readRuntimeLimits } from "../tenant/runtime-limits.js";
 import { checkEntry } from "../record/index.js";
 import { turnManifestOf } from "../tenant/session.js";
+import { takeSteeredMessages } from "../tenant/commands.js";
 import { isEnabledIn, manifestFor, mcpToolIn } from "../mcp/snapshot.js";
 import { findServer } from "../mcp/pool.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
@@ -127,6 +128,25 @@ export async function recordIntent(scope, effect, requestHash) {
             await t.put("effects", request.effectId, row);
             return { status: "execute", traceparent: row.traceparent };
         }
+        if (request.kind === "inputs") {
+            // The messages steered into the running turn (D85), taken before a step: journaled with
+            // what was taken, empty or not, so a replay takes the same messages at the same step.
+            const step = Number(request.input?.step);
+            const events = await takeSteeredMessages(t, s, s.id, Number.isInteger(step) && step > 0 ? step : 1);
+            if (events.length > 0)
+                await t.put("sessions", s.id, s);
+            const outcome = { value: { events } };
+            const at = new Date().toISOString();
+            await t.put("effects", request.effectId, {
+                request,
+                requestHash,
+                status: "completed",
+                outcome,
+                startedAt: at,
+                settledAt: at,
+            });
+            return { status: "completed", outcome };
+        }
         if (request.kind === "delegation") {
             // Lifecycle points of an agent used as a tool: journaled once, so replays never re-emit.
             const outcome = { value: null };

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.41.0-beta",
+    "version": "0.43.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -43,7 +43,8 @@
         "agent-model",
         "secret-routing",
         "remove-tools",
-        "agent-triggers"
+        "agent-triggers",
+        "steer"
       ]
     },
     "description": "For operators: the Tenant's models, vaults, signing keys, settings and application keys, at `/v1/tenant/*` on the Tenant's URL, through `@nylorun/admin`. Every operation takes a management key, acting as itself: never for a subject and never from a browser. Management keys are issued only on the Tenant's machine (`nylorun tenant keys put <id> --management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`."

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.41.0-beta",
+    "version": "0.43.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -43,7 +43,8 @@
         "agent-model",
         "secret-routing",
         "remove-tools",
-        "agent-triggers"
+        "agent-triggers",
+        "steer"
       ]
     },
     "description": "For developers: agent manifests, Agents, sessions (with AG-UI and A2A) and artifacts, through `@nylorun/agents`. Every Tenant serves it on its one URL, beside the Management API (`/openapi/management.json`). Every request sends `Nylorun-Protocol`. Who may call each operation is its `security` and its `x-nylorun-credentials` and `x-nylorun-scopes` (the subject scopes that reach it) fields: an application key (servers) or a trusted issuer's token (browsers and apps)."
@@ -6336,6 +6337,13 @@
             "type": "integer",
             "exclusiveMinimum": 0
           },
+          "delivery": {
+            "type": "string",
+            "enum": [
+              "queue",
+              "steer"
+            ]
+          },
           "cursor": {
             "type": [
               "string",
@@ -6788,7 +6796,8 @@
                 "type": "string",
                 "enum": [
                   "queue",
-                  "reject"
+                  "reject",
+                  "steer"
                 ]
               },
               "content": {
@@ -7116,7 +7125,8 @@
                 "type": "string",
                 "enum": [
                   "queue",
-                  "reject"
+                  "reject",
+                  "steer"
                 ]
               },
               "data": {
@@ -7443,7 +7453,8 @@
                 "type": "string",
                 "enum": [
                   "queue",
-                  "reject"
+                  "reject",
+                  "steer"
                 ]
               },
               "parts": {
@@ -8726,6 +8737,50 @@
               "additionalProperties": false
             },
             "description": "The engine text blocks the agent gets, with their hashes"
+          },
+          "plugins": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "enum": [
+                    "nylorun-memory",
+                    "nylorun-triggers",
+                    "nylorun-plan",
+                    "nylorun-interactions",
+                    "nylorun-artifacts",
+                    "nylorun-sandbox"
+                  ]
+                },
+                "tools": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "sha256": {
+                  "type": "string",
+                  "pattern": "^sha256:[0-9a-f]{64}$"
+                },
+                "hosts": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                }
+              },
+              "required": [
+                "name",
+                "tools",
+                "sha256"
+              ],
+              "additionalProperties": false
+            },
+            "description": "The Runtime's plugins the agent declares (agent-folder/3, ADR-106): each with the tools left on and the hash of its files"
           }
         },
         "additionalProperties": false
@@ -9656,7 +9711,8 @@
                 "type": "string",
                 "enum": [
                   "queue",
-                  "reject"
+                  "reject",
+                  "steer"
                 ]
               },
               "queuedMessageId": {
@@ -11812,6 +11868,13 @@
               },
               "requestId": {
                 "type": "string"
+              },
+              "delivery": {
+                "type": "string",
+                "enum": [
+                  "queue",
+                  "steer"
+                ]
               }
             },
             "required": [
@@ -12013,6 +12076,10 @@
                   "type": "string"
                 },
                 "minItems": 1
+              },
+              "step": {
+                "type": "integer",
+                "exclusiveMinimum": 0
               }
             },
             "required": [

package/dist/store/postgres/drizzle/0045_session_queue_delivery.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "nylorun"."session_queue" ADD COLUMN "delivery" text DEFAULT 'queue' NOT NULL;--> statement-breakpoint
+ALTER TABLE "nylorun"."session_queue" ADD CONSTRAINT "session_queue_delivery_check" CHECK ("nylorun"."session_queue"."delivery" IN ('queue', 'steer'));

package/dist/store/postgres/drizzle/meta/_journal.json

@@ -316,6 +316,13 @@
       "when": 1793548858191,
       "tag": "0044_agent_triggers_origin_backfill",
       "breakpoints": true
+    },
+    {
+      "idx": 45,
+      "version": "7",
+      "when": 1793954783377,
+      "tag": "0045_session_queue_delivery",
+      "breakpoints": true
     }
   ]
 }

package/dist/store/postgres/schema.d.ts

@@ -4484,7 +4484,8 @@ export declare const turns: import("drizzle-orm/pg-core").PgTableWithColumns<{
 }>;
 /**
  * Each session's queue (protocol 17, D76): messages that arrived while its turn ran or waited, in
- * order (`seq`), until a turn takes them. A row holds the command as sent, the turn input its
+ * order (`seq`), until a turn takes them: the next turn, or the running one before a step for a
+ * steered message (D85). A row holds the command as sent, the turn input its
  * message gives the engine (file parts pinned when it was queued), and who sent it.
  */
 export declare const sessionQueue: import("drizzle-orm/pg-core").PgTableWithColumns<{
@@ -4679,6 +4680,23 @@ export declare const sessionQueue: import("drizzle-orm/pg-core").PgTableWithColu
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
+        delivery: import("drizzle-orm/pg-core").PgColumn<{
+            name: "delivery";
+            tableName: "session_queue";
+            dataType: "string";
+            columnType: "PgText";
+            data: "queue" | "steer";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["queue", "steer"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: 'pg';
 }>;

package/dist/store/postgres/schema.js

@@ -560,7 +560,8 @@ export const turns = nylorun.table("turns", {
 ]);
 /**
  * Each session's queue (protocol 17, D76): messages that arrived while its turn ran or waited, in
- * order (`seq`), until a turn takes them. A row holds the command as sent, the turn input its
+ * order (`seq`), until a turn takes them: the next turn, or the running one before a step for a
+ * steered message (D85). A row holds the command as sent, the turn input its
  * message gives the engine (file parts pinned when it was queued), and who sent it.
  */
 export const sessionQueue = nylorun.table("session_queue", {
@@ -580,7 +581,15 @@ export const sessionQueue = nylorun.table("session_queue", {
     /** What sent it when not a client (track T4): a trigger's run, or the session's own wake. */
     cause: jsonText(),
     createdAt: textC().notNull(),
-}, (t) => [uniqueIndex("session_queue_order").on(t.sessionId, t.seq)]);
+    /**
+     * `steer` (D85): the running turn may take it before a step (the `inputs` effect); `queue`:
+     * it waits for the turn to end. Either starts the next turn if the running one didn't take it.
+     */
+    delivery: text({ enum: ["queue", "steer"] }).notNull().default("queue"),
+}, (t) => [
+    uniqueIndex("session_queue_order").on(t.sessionId, t.seq),
+    check("session_queue_delivery_check", sql `${t.delivery} IN ('queue', 'steer')`),
+]);
 /**
  * The Tool Gate's keyed MCP calls (F4.1 G3): one row per call, written by the gates service
  * before it calls the server and given the answer after. A re-send whose row has an answer

package/dist/tenant/agent-triggers.js

@@ -45,6 +45,14 @@ function reaches(row, sessionId) {
         return false;
     return row.createdSessionId === sessionId || row.definition?.session === sessionId;
 }
+/** Whether the version session `s` runs declares the Runtime's `nylorun-triggers` plugin (ADR-106). */
+async function declaresTriggersPlugin(t, s) {
+    if (!s.definition)
+        return false;
+    const body = (await t.agentManifest(s.definition.name, s.definition.version))?.body;
+    const plugins = body?.harness?.engine?.plugins;
+    return Array.isArray(plugins) && plugins.some((plugin) => plugin?.name === "nylorun-triggers");
+}
 /** Whether the version session `s` runs declares `harness.engine.triggers`. */
 async function declaresTriggers(t, s) {
     if (!s.definition)
@@ -86,6 +94,7 @@ export async function serveTriggersTool(t, s, request) {
     if (input.command === "list") {
         const rows = (await t.agentTriggers(s.agentId)).filter((row) => reaches(row, s.id));
         return completed({
+            now: new Date().toISOString(),
             triggers: rows.map((row) => {
                 const trigger = row.definition;
                 return {
@@ -109,9 +118,17 @@ export async function serveTriggersTool(t, s, request) {
         await t.agentEvent(s.agentId, "agent.trigger_deleted", { triggerId: input.id, sessionId: s.id });
         return completed({ id: input.id, deleted: true });
     }
-    // create: never from a turn a trigger or a booked wake started.
-    if (s.turnCause !== undefined)
-        return failed("tool.forbidden", "A run can't create triggers: this turn was started by a trigger. It may list and delete them.");
+    // create: never from a turn a trigger or a booked wake started. Under the `nylorun-triggers`
+    // plugin (ADR-106) such a turn may still set a one-off follow-up in its own session, as a woken
+    // turn books the next wake: never a schedule, never a session of its own.
+    if (s.turnCause !== undefined) {
+        const plugin = await declaresTriggersPlugin(t, s);
+        const followUp = plugin && input.schedule === undefined && input.session === "this";
+        if (!followUp)
+            return failed("tool.forbidden", plugin
+                ? "A run can't create triggers other than a one-off follow-up here (in or at, with session: this): this turn was started by a trigger. It may list and delete them."
+                : "A run can't create triggers: this turn was started by a trigger. It may list and delete them.");
+    }
     const now = new Date();
     const stamp = now.toISOString();
     const session = triggerSessionOf(s.id, input.id, input.session);
@@ -175,5 +192,5 @@ export async function serveTriggersTool(t, s, request) {
         ...(row.title === null ? {} : { title: row.title }),
         nextRunAt: row.nextFireAt,
     });
-    return completed({ id: input.id, status: row.status, nextRunAt: row.nextFireAt, session }, [row]);
+    return completed({ id: input.id, status: row.status, nextRunAt: row.nextFireAt, session, now: stamp }, [row]);
 }

package/dist/tenant/commands.d.ts

@@ -37,7 +37,10 @@ export interface MessageCause {
     triggerId: string;
     runId: string;
 }
-/** How a message was taken: it started a turn, or waits in the session's queue. */
+/**
+ * How a message was taken: it started a turn, or waits in the session's queue, marked with the
+ * delivery that applied (D85): `steer` when the running turn may take it before a step.
+ */
 export type MessageAnswer = {
     status: "accepted";
     turnId: string;
@@ -47,15 +50,28 @@ export type MessageAnswer = {
     queuedMessageId: string;
     position: number;
     cursor: string;
+    delivery: "queue" | "steer";
 };
 /**
  * Takes a resolved message on session `s` (locked) in transaction `t`: it starts a turn when the
  * session takes messages and none wait, else it waits in the queue behind them (protocol 17), and
  * an idle session whose queue was left waiting (its Agent was unavailable when the last turn
  * ended) starts a turn with all of them, this one last. Past `sessionQueuedMessages` it is
- * `429 queue_full`. `waiting` is the queue's length, read under the session's lock.
+ * `429 queue_full`. `waiting` is the queue's length, read under the session's lock. `asked`
+ * `steer` (D85) marks a waiting message so the running turn may take it before a step; a
+ * workflow session can't, so it waits as `queue`.
+ */
+export declare function acceptMessage(ctx: TenantContext, t: Tx, s: Session, id: string, message: TurnMessage, waiting?: number, asked?: "queue" | "steer"): Promise<MessageAnswer>;
+/**
+ * Takes the messages steered into session `s`'s running turn (D85), before step `step`: the
+ * `inputs` effect, in the transaction that journals it (`harness-api/record.ts`). Only `steer`
+ * rows whose turn request (variant, `removeTools`) is the running turn's join it; the rest wait
+ * for the turn's end. Writes each one's `command.message` under the turn, then one `queue.taken`
+ * with the step, adds their file artifacts to the session's, and returns their inputs (each as its
+ * message gave it, which the engine reads as a user message) in order. A workflow session takes
+ * none.
  */
-export declare function acceptMessage(ctx: TenantContext, t: Tx, s: Session, id: string, message: TurnMessage, waiting?: number): Promise<MessageAnswer>;
+export declare function takeSteeredMessages(t: Tx, s: Session, id: string, step: number): Promise<unknown[]>;
 /** Who checks a queued message's turn start: core, since the sender's grants were checked when it was queued. */
 export declare const QUEUE_SCOPE: AuthScope;
 /**

package/dist/tenant/commands.js

@@ -19,7 +19,10 @@
  * (`session_queue`, `message.queued`) unless it asks `delivery: "reject"`, which is
  * `409 session_busy`. A turn that ends takes every queued message in the same transaction
  * (`startQueuedTurn`): client messages and queued ones start a turn through one door,
- * `beginMessageTurn`, which writes each one's `command.message`.
+ * `beginMessageTurn`, which writes each one's `command.message`. A message that asks
+ * `delivery: "steer"` (D85) waits marked `steer`, and the running turn takes it before a step
+ * (`takeSteeredMessages`, the `inputs` effect); one it doesn't take starts the next turn like
+ * any other.
  */
 import { randomUUID } from "node:crypto";
 import { createDurableCheckpoint, createFlowCheckpoint, resumeFlowCheckpoint, } from "@nylorun/harness/run";
@@ -157,7 +160,7 @@ options = {}) {
                 // Every turn start on a sandbox: it exists, the token's grants reach it, and no other
                 // session's turn holds it. A queued message is checked when it is queued, too.
                 await checkAgentTurn(t, s, scope, ctx);
-                answer = await acceptMessage(ctx, t, s, id, await turnMessage(t, s, id, command, scope, options.trace), waiting);
+                answer = await acceptMessage(ctx, t, s, id, await turnMessage(t, s, id, command, scope, options.trace), waiting, delivery === "steer" ? "steer" : "queue");
             }
             else if (command.type === "approve" &&
                 (held = await heldCall(t, s, command.interactionId)) !== undefined) {
@@ -299,9 +302,11 @@ export const takesMessages = (s) => TAKES_MESSAGES.includes(s.status);
  * session takes messages and none wait, else it waits in the queue behind them (protocol 17), and
  * an idle session whose queue was left waiting (its Agent was unavailable when the last turn
  * ended) starts a turn with all of them, this one last. Past `sessionQueuedMessages` it is
- * `429 queue_full`. `waiting` is the queue's length, read under the session's lock.
+ * `429 queue_full`. `waiting` is the queue's length, read under the session's lock. `asked`
+ * `steer` (D85) marks a waiting message so the running turn may take it before a step; a
+ * workflow session can't, so it waits as `queue`.
  */
-export async function acceptMessage(ctx, t, s, id, message, waiting) {
+export async function acceptMessage(ctx, t, s, id, message, waiting, asked = "queue") {
     const queued = waiting ?? (await t.countQueuedMessages(id));
     const takes = takesMessages(s);
     if (takes && queued === 0) {
@@ -313,6 +318,7 @@ export async function acceptMessage(ctx, t, s, id, message, waiting) {
     if (queued >= sessionQueuedMessages)
         fail(429, `Session ${id} already holds ${queued} queued messages, the Runtime limit sessionQueuedMessages (PUT /v1/tenant/limits); they start a turn when the running one ends.`, { code: "queue_full" });
     const queuedMessageId = randomUUID();
+    const delivery = asked === "steer" && !isWorkflowManifest(s.manifest) ? "steer" : "queue";
     await t.enqueueMessage({
         id: queuedMessageId,
         sessionId: id,
@@ -323,13 +329,56 @@ export async function acceptMessage(ctx, t, s, id, message, waiting) {
         trace: message.trace ?? null,
         cause: message.cause ?? null,
         createdAt: new Date().toISOString(),
+        delivery,
     });
     const position = queued + 1;
-    const event = await t.event(id, s.activeTurnId, "message.queued", { queuedMessageId, position, requestId: message.command.requestId }, message.writer);
+    const event = await t.event(id, s.activeTurnId, "message.queued", { queuedMessageId, position, requestId: message.command.requestId, delivery }, message.writer);
     const started = takes ? await startQueuedTurn(ctx, t, s, id) : undefined;
     if (started?.taken.includes(queuedMessageId))
         return { status: "accepted", turnId: started.turnId, cursor: started.cursor };
-    return { status: "queued", queuedMessageId, position, cursor: event.cursor };
+    return { status: "queued", queuedMessageId, position, cursor: event.cursor, delivery };
+}
+/**
+ * Takes the messages steered into session `s`'s running turn (D85), before step `step`: the
+ * `inputs` effect, in the transaction that journals it (`harness-api/record.ts`). Only `steer`
+ * rows whose turn request (variant, `removeTools`) is the running turn's join it; the rest wait
+ * for the turn's end. Writes each one's `command.message` under the turn, then one `queue.taken`
+ * with the step, adds their file artifacts to the session's, and returns their inputs (each as its
+ * message gave it, which the engine reads as a user message) in order. A workflow session takes
+ * none.
+ */
+export async function takeSteeredMessages(t, s, id, step) {
+    const turnId = s.activeTurnId;
+    if (turnId === null || isWorkflowManifest(s.manifest))
+        return [];
+    const running = s.turnRequest?.turnId === turnId ? s.turnRequest : undefined;
+    if (running?.manifest !== undefined)
+        return [];
+    const runningTools = canonical([...new Set(running?.removeTools ?? [])].sort());
+    const rows = (await t.queuedMessages(id)).filter((row) => {
+        if (row.delivery !== "steer")
+            return false;
+        const request = turnManifestRequestOf(row.command);
+        if (request?.manifest !== undefined)
+            return false;
+        return canonical([...(request?.removeTools ?? [])].sort()) === runningTools;
+    });
+    if (rows.length === 0)
+        return [];
+    const taken = rows.map((row) => row.id);
+    await t.deleteQueuedMessages(taken);
+    const named = rows.flatMap((row) => row.fileArtifacts);
+    if (named.length > 0)
+        s.fileArtifacts = [...new Set([...(s.fileArtifacts ?? []), ...named])];
+    for (const row of rows)
+        await t.event(id, turnId, "command.message", {
+            ...row.command,
+            queuedMessageId: row.id,
+            ...(row.trace ? { trace: row.trace } : {}),
+            ...(row.cause ? { cause: row.cause } : {}),
+        }, row.writer);
+    await t.event(id, turnId, "queue.taken", { turnId, queuedMessageIds: taken, step });
+    return rows.map((row) => row.input);
 }
 /**
  * Resolves a message for a turn, now or when it leaves the queue: file parts name artifacts the

package/dist/tenant/triggers.d.ts

@@ -31,6 +31,11 @@ export declare function nextFireAt(agentId: string, triggerId: string, trigger:
 export declare function triggerIssues(triggers: Readonly<Record<string, Trigger>> | undefined, limits: RuntimeLimits, now?: Date, 
 /** How an issue names trigger `id`: its place in the manifest by default. */
 label?: (id: string) => string): string[];
+/**
+ * The line an agent-made trigger's run starts with under the `nylorun-triggers` plugin (ADR-106):
+ * which trigger woke the turn, and that nobody is watching.
+ */
+export declare function triggerFrame(triggerId: string, title: string | null | undefined): string;
 /** Where a row's definition comes from (D83): its origin, or `wake` for a booked wake written before origins. */
 export declare function originOf(row: Pick<AgentTriggerRow, "origin" | "kind">): AgentTriggerRow["origin"];
 /**

package/dist/tenant/triggers.js

@@ -152,7 +152,20 @@ async function triggersOf(t, agent) {
 async function pinnedOf(t, agent) {
     const body = (await t.agentManifest(agent.manifestName, agent.manifestVersion))?.body;
     const harness = body?.harness;
-    return { triggers: (body?.runtime?.triggers ?? {}), declared: harness?.engine?.triggers === true };
+    const plugins = harness?.engine?.plugins;
+    return {
+        triggers: (body?.runtime?.triggers ?? {}),
+        declared: harness?.engine?.triggers === true,
+        // The version declares the Runtime's `nylorun-triggers` plugin (ADR-106).
+        plugin: Array.isArray(plugins) && plugins.some((item) => item?.name === "nylorun-triggers"),
+    };
+}
+/**
+ * The line an agent-made trigger's run starts with under the `nylorun-triggers` plugin (ADR-106):
+ * which trigger woke the turn, and that nobody is watching.
+ */
+export function triggerFrame(triggerId, title) {
+    return `[trigger ${triggerId}${title ? ` · ${title}` : ""} · nobody is watching]`;
 }
 /** Where a row's definition comes from (D83): its origin, or `wake` for a booked wake written before origins. */
 export function originOf(row) {
@@ -431,7 +444,9 @@ export async function deliverRun(ctx, t, agent, triggerId, trigger, row, cause)
         title: row.title ?? null,
         streamedAt: null,
     };
-    const outcome = await runOutcome(ctx, t, agent, triggerId, trigger, row.kind, id, firedAt, cause.payload, row.createdSessionId ?? null);
+    // Under the `nylorun-triggers` plugin, an agent-made trigger's run is framed (ADR-106).
+    const framed = origin === "agent" && (await pinnedOf(t, agent)).plugin ? { ...trigger, prompt: `${triggerFrame(triggerId, row.title)}\n${trigger.prompt}` } : trigger;
+    const outcome = await runOutcome(ctx, t, agent, triggerId, framed, row.kind, id, firedAt, cause.payload, row.createdSessionId ?? null);
     Object.assign(run, outcome);
     await t.insertTriggerRun(run);
     await t.agentEvent(agent.id, "agent.run", {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.41.0-beta";
+export declare const RUNTIME_VERSION = "0.43.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.41.0-beta";
+export const RUNTIME_VERSION = "0.43.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.41.0-beta",
+  "version": "0.43.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.5",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.35.0-beta",
-    "@nylorun/harness": "0.32.0-beta",
+    "@nylorun/core": "0.37.0-beta",
+    "@nylorun/harness": "0.34.0-beta",
     "@restatedev/restate-sdk": "1.17.3",
     "@restatedev/restate-sdk-clients": "1.17.3",
     "@s2-dev/streamstore": "0.28.0",