@nylorun/runtime 0.51.2-beta → 0.53.0-beta

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 0.53.0-beta
+
+### Minor Changes
+
+- 5b49361: A pod Agent on an Agent Substrate cluster can be a computer (ADR-149, ADR-150): with `NYLORUN_SANDBOX_GATEWAY_URL` and `NYLORUN_COMPUTER_TICKET_KEY_FILE` set (the Runtime's Helm chart sets both), its sessions' runs go to the harness container, and their sandbox tools, file reads and writes, skill folders and disk versions reach the Agent's actor through the sandbox gateway and `atenet-router`, with a ticket core signs (Ed25519). The engine's `--service computer` runs no loop: it serves commands (a start and attaches, each under 50 s) and files on port 8080, checks each ticket against the key its template carries, and answers the wake-up probe on `/ready`. A harness opens a computer with `computer.open`; core wakes it, waits until it is ready, writes a seed onto a new disk, runs the disk's setup through it and passes a version's start check. The tools, `runtime.json` and every other backend are unchanged.
+
+  - `@nylorun/core`: Harness API 5.6 (`harness-api/v5.6.json`): `routing.sandbox.computer` and the request `computer.open`.
+  - `@nylorun/runtime`: `--service computer`; the `computer` sandbox backend; `NYLORUN_SANDBOX_GATEWAY_URL` and `NYLORUN_COMPUTER_TICKET_KEY_FILE`.
+
+- 0cb752d: The Runtime's Helm chart, `charts/nylorun-runtime` (ADR-147, the Runtime on Kubernetes plan): the Runtime on an Agent Substrate cluster, with computers. It installs core, the gateway, the harness, Studio, the sandboxes service in the cluster, the sandbox gateway (atenet-router's client), Restate on a disk and s2-lite with its streams in the object store; Postgres and the object store are an external URL and S3 endpoint, or bundled (Postgres, RustFS). It makes the Runtime's secrets once and keeps them, and optionally pre-pulls images on worker nodes and makes the Tenant's atespace. Its README says what Substrate needs (the router's allowlist, the atespace) and has a GCP example.
+- f2ef233: The sandboxes service runs in the cluster it drives, and Agent Substrate sandboxes can be computers (ADR-149, the Runtime on Kubernetes plan). `cluster.json`'s `inCluster: true` uses the pod's ServiceAccount and reaches Substrate's API by its Service with a projected token; `substrate.computer` renders every sandbox as a computer: its engine runs `--service computer`, with no join token, edge or edge rule, a wake-up probe on `/ready`, and the ticket key's public half. `sandboxes gateway` is the sandbox gateway (ADR-148): it checks a computer ticket and proxies to the computer through an mTLS CONNECT tunnel to `atenet-router`.
+
+### Patch Changes
+
+- becf6a2: A computer runs our engine whatever harness drives its Agent: an Agent with a custom harness runs it through the Harness API, and its image is its computer. The chart sets numeric users for `runAsNonRoot`, uses the sandboxes service's `/health` for readiness (its `/ready` waits for the atespace the post-install Job makes), and says that Substrate's API admits only namespaces labelled `ate.dev/api-access=true`. Docs: Harness API §9b (computers), Kubernetes in SELF_HOSTING.md, and a MIGRATION entry.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [5b49361]
+- Updated dependencies
+  - @nylorun/core@0.46.0-beta
+  - @nylorun/harness@0.36.6-beta
+
+## 0.52.0-beta
+
+### Minor Changes
+
+- 17951fe: A client can give one Agent a trigger over the API (D88, ADR-145; Host feature `api-triggers`). `PUT /v1/agents/{agentId}/triggers/{triggerId}` creates or replaces the Agent's trigger of a fourth origin, `api`: the body is a `Trigger` exactly as a definition's `runtime.triggers` entry holds it (one of `schedule` with `timezone`, `at` or `webhook`; `session`; `prompt`) and an optional `title`. A new one is active with its next time; a replaced one gets its next time again and keeps its status; the same body again changes nothing and records no event. An id the definition declares, or one an agent's trigger or a booked wake holds, is `409 trigger_conflict`. The checks and limits are a definition's, and `runtime.limits.triggers.count` now counts the triggers an Agent's agents made and those clients put together (`422 trigger_limit`). Upgrades and moves never touch an `api` trigger, `DELETE` removes it, and pause, resume, run and a webhook's secret work as for any trigger.
+
+  - `@nylorun/core`: `TRIGGER_ORIGINS` adds `api`; `TriggerPutSchema`; `TriggerView.principal`; `agent.trigger_created` and `agent.trigger_updated` carry `origin`, `principal`, the timing and `changed` (their `sessionId` is now optional, set for `agent` only; `kind` adds `webhook`), and `agent.trigger_deleted` carries `origin`; Host feature `api-triggers`.
+  - `@nylorun/runtime`: the route; `agent_triggers.principal` and the `api` origin (store migration 0049, run at start).
+  - `@nylorun/agents`: `agents.putTrigger(agentId, triggerId, trigger)`; `deleteTrigger` deletes `api` triggers too.
+  - `nylorun`: `nylorun agents triggers put <id> <trigger>` with `--schedule`, `--timezone`, `--at`, `--webhook`, `--session`, `--prompt` and `--title`, or a JSON file; `rm` deletes `api` triggers.
+  - `@nylorun/studio`: the Triggers tab shows where each trigger came from (the definition's version, the agent that made it, or the principal that put it), its prompt and time zone for every origin, and deletes one an agent made or a client put; Activity words trigger changes and filters them.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [17951fe]
+- Updated dependencies
+  - @nylorun/core@0.45.0-beta
+  - @nylorun/harness@0.36.5-beta
+
 ## 0.51.2-beta
 
 ### Patch Changes

package/dist/adapters/sandbox/computer.d.ts

@@ -0,0 +1,28 @@
+import { type SandboxBackend } from "../../sandbox/types.js";
+/** What `open` answers: where this computer is, and the ticket for it. */
+export interface ComputerAccess {
+    /** The gateway's URL for this computer, `<gateway>/<sandbox>`. */
+    readonly url: string;
+    readonly ticket: string;
+    /** When the ticket expires (ms since the epoch). */
+    readonly expiresAt: number;
+}
+export interface ComputerBackendOptions {
+    readonly open: (signal?: AbortSignal) => Promise<ComputerAccess>;
+    readonly fetch?: typeof fetch;
+    readonly now?: () => number;
+    /** How long a dropped request is asked again for, past the command's own timeout. */
+    readonly retryMs?: number;
+}
+/** A computer refused or failed an operation. */
+export declare class ComputerError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/** The disk roots of every computer (R9, ADR-150). */
+export declare const COMPUTER_DISK_ROOTS: {
+    readonly workspace: "/workspace";
+    readonly harness: "/harness";
+};
+export declare function computerBackend(options: ComputerBackendOptions): SandboxBackend;

package/dist/adapters/sandbox/computer.js

@@ -0,0 +1,184 @@
+/**
+ * Computer backend (ADR-149, ADR-150): a pod Agent's sandbox on Agent Substrate, reached through
+ * the sandbox gateway and Substrate's router (ADR-148). Its handle sends each operation to the
+ * computer's engine (`harness/computer.ts`) with a ticket core signs: `open` (a harness asks core
+ * with `computer.open`; core in process) wakes the computer, runs its disk's setup, and answers
+ * the gateway URL for this computer, the ticket and when it expires. A ticket is asked for again
+ * a minute before it expires.
+ *
+ * A command is a start and attaches, each answered within 50 s, under the command's own timeout:
+ * a gateway or router that drops a request (a rollout, a drain) is asked again with the same id,
+ * and the computer joins the command it already runs. One the computer no longer knows (lost with
+ * a crash or a revert) fails the call, saying so.
+ *
+ * One computer holds one sandbox: every key opens the same handle. Removing it is the Agent's reset
+ * or delete (core's pod lifecycle), so `remove` and `list` do nothing here; `stop` does nothing
+ * either, as core suspends an idle computer.
+ */
+import { randomUUID } from "node:crypto";
+import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
+import { SandboxFileTooLargeError, wholeBytes, } from "../../sandbox/types.js";
+/** A computer refused or failed an operation. */
+export class ComputerError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "ComputerError";
+    }
+}
+const WAIT_MS = 50_000;
+const RENEW_MS = 60_000;
+/** The disk roots of every computer (R9, ADR-150). */
+export const COMPUTER_DISK_ROOTS = { workspace: SANDBOX_WORKSPACE, harness: "/harness" };
+export function computerBackend(options) {
+    const http = options.fetch ?? fetch;
+    const now = options.now ?? Date.now;
+    const retryMs = options.retryMs ?? 3 * 60_000;
+    let access;
+    let opening;
+    const current = async (signal) => {
+        if (access && access.expiresAt - now() > RENEW_MS)
+            return access;
+        opening ??= options.open(signal).finally(() => (opening = undefined));
+        access = await opening;
+        return access;
+    };
+    const call = async (method, path, init = {}) => {
+        const at = await current(init.signal);
+        const headers = { "x-nylorun-ticket": at.ticket };
+        let body = init.body;
+        if (init.json !== undefined) {
+            headers["content-type"] = "application/json";
+            body = JSON.stringify(init.json);
+        }
+        const response = await http(`${at.url}${path}`, {
+            method,
+            headers,
+            ...(body === undefined ? {} : { body }),
+            ...(body !== undefined && typeof body !== "string" && !(body instanceof Uint8Array) ? { duplex: "half" } : {}),
+            ...(init.signal ? { signal: init.signal } : {}),
+        });
+        if (response.status === 401)
+            access = undefined; // a new ticket next time
+        return response;
+    };
+    const failed = async (response) => {
+        let code = "computer_error";
+        let message = `The computer answered ${response.status}`;
+        try {
+            const parsed = (await response.json());
+            code = parsed.error?.code ?? code;
+            message = parsed.error?.message ?? message;
+        }
+        catch {
+            // not JSON
+        }
+        return new ComputerError(response.status, code, message);
+    };
+    /** Whether a failure is the way's (gateway, router, a computer moving), worth asking again. */
+    const transient = (error) => error instanceof ComputerError ? error.status === 401 || error.status >= 500 : !(error instanceof DOMException && error.name === "AbortError");
+    const exec = async (request, signal) => {
+        const id = randomUUID();
+        const deadline = now() + request.timeoutMs + retryMs;
+        let started = false;
+        const cancel = () => void call("POST", `/v1/exec/${encodeURIComponent(id)}/cancel`).catch(() => undefined);
+        signal.addEventListener("abort", cancel, { once: true });
+        try {
+            for (let attempt = 0;; attempt++) {
+                if (signal.aborted)
+                    throw signal.reason ?? new Error("Turn cancelled");
+                try {
+                    const response = started
+                        ? await call("POST", `/v1/exec/${encodeURIComponent(id)}/attach`, { json: { waitMs: WAIT_MS }, signal })
+                        : await call("POST", "/v1/exec", {
+                            json: { id, command: request.command, cwd: request.cwd, timeoutMs: request.timeoutMs, env: request.env ?? {}, waitMs: WAIT_MS },
+                            signal,
+                        });
+                    if (response.status === 404 && started)
+                        return {
+                            exitCode: 1,
+                            stdout: "",
+                            stderr: "The computer lost this command (it was restarted from its last snapshot).",
+                            killed: true,
+                            timedOut: false,
+                        };
+                    if (!response.ok)
+                        throw await failed(response);
+                    started = true;
+                    attempt = 0;
+                    const answer = (await response.json());
+                    if (answer.state === "done")
+                        return answer.result;
+                    if (answer.state === "failed")
+                        throw new ComputerError(500, "command_failed", answer.message);
+                }
+                catch (error) {
+                    if (!transient(error) || now() > deadline)
+                        throw error;
+                    await new Promise((resolve) => setTimeout(resolve, Math.min(5_000, 250 * 2 ** attempt)));
+                }
+            }
+        }
+        finally {
+            signal.removeEventListener("abort", cancel);
+        }
+    };
+    const readBytes = async (path, maxBytes) => {
+        const response = await call("GET", `/v1/files?path=${encodeURIComponent(path)}&maxBytes=${maxBytes}`);
+        if (response.status === 404)
+            return undefined;
+        if (response.status === 413) {
+            const error = await failed(response);
+            const size = Number(/is (\d+) bytes/.exec(error.message)?.[1] ?? maxBytes + 1);
+            throw new SandboxFileTooLargeError(path, size, maxBytes);
+        }
+        if (!response.ok)
+            throw await failed(response);
+        return new Uint8Array(await response.arrayBuffer());
+    };
+    const handle = {
+        workspace: SANDBOX_WORKSPACE,
+        diskRoots: COMPUTER_DISK_ROOTS,
+        exec,
+        async readFile(path) {
+            const bytes = await readBytes(path, Number.MAX_SAFE_INTEGER);
+            return bytes === undefined ? undefined : Buffer.from(bytes).toString("utf8");
+        },
+        readBytes,
+        async listFiles(dir, maxEntries) {
+            const response = await call("GET", `/v1/list?dir=${encodeURIComponent(dir)}&maxEntries=${maxEntries}`);
+            if (response.status === 404)
+                return undefined;
+            if (!response.ok)
+                throw await failed(response);
+            return (await response.json());
+        },
+        async writeFile(path, content) {
+            // A file's chunks are gathered: a skill's file is at most a few megabytes.
+            const body = (typeof content === "string" ? content : Buffer.from(await wholeBytes(content)));
+            const response = await call("PUT", `/v1/files?path=${encodeURIComponent(path)}`, { body });
+            if (!response.ok)
+                throw await failed(response);
+        },
+        async stop() { },
+    };
+    return {
+        name: "computer",
+        isolation: "container",
+        async probe() {
+            return { name: "computer", isolation: "container", available: true, reason: "an Agent Substrate computer" };
+        },
+        unmet: () => undefined,
+        open: async () => {
+            await current();
+            return handle;
+        },
+        async remove() { },
+        async list() {
+            return [];
+        },
+    };
+}

package/dist/api/components.d.ts

@@ -2301,11 +2301,13 @@ export declare const TriggerList: z.ZodObject<{
         }>;
         origin: z.ZodEnum<{
             agent: "agent";
+            api: "api";
             manifest: "manifest";
             wake: "wake";
         }>;
         title: z.ZodNullable<z.ZodString>;
         createdSessionId: z.ZodNullable<z.ZodString>;
+        principal: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         status: z.ZodEnum<{
             active: "active";
             completed: "completed";
@@ -2323,6 +2325,50 @@ export declare const TriggerList: z.ZodObject<{
         prompt: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
+export declare const TriggerView: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        at: "at";
+        schedule: "schedule";
+        wake: "wake";
+        webhook: "webhook";
+    }>;
+    origin: z.ZodEnum<{
+        agent: "agent";
+        api: "api";
+        manifest: "manifest";
+        wake: "wake";
+    }>;
+    title: z.ZodNullable<z.ZodString>;
+    createdSessionId: z.ZodNullable<z.ZodString>;
+    principal: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    status: z.ZodEnum<{
+        active: "active";
+        completed: "completed";
+        paused: "paused";
+    }>;
+    pausedReason: z.ZodNullable<z.ZodString>;
+    schedule: z.ZodOptional<z.ZodString>;
+    timezone: z.ZodOptional<z.ZodString>;
+    at: z.ZodOptional<z.ZodString>;
+    session: z.ZodString;
+    nextRunAt: z.ZodNullable<z.ZodString>;
+    lastRunAt: z.ZodNullable<z.ZodString>;
+    webhookUrl: z.ZodOptional<z.ZodString>;
+    secretSet: z.ZodOptional<z.ZodBoolean>;
+    prompt: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const PutTriggerRequest: z.ZodObject<{
+    schedule: z.ZodOptional<z.ZodString>;
+    timezone: z.ZodOptional<z.ZodString>;
+    at: z.ZodOptional<z.ZodISODateTime>;
+    webhook: z.ZodOptional<z.ZodEnum<{
+        "standard-webhooks": "standard-webhooks";
+    }>>;
+    session: z.ZodString;
+    prompt: z.ZodString;
+    title: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
 export declare const MemoryList: z.ZodObject<{
     memories: z.ZodArray<z.ZodObject<{
         path: z.ZodString;
@@ -2440,6 +2486,7 @@ export declare const TenantRun: z.ZodObject<{
     late: z.ZodBoolean;
     origin: z.ZodEnum<{
         agent: "agent";
+        api: "api";
         manifest: "manifest";
         wake: "wake";
     }>;
@@ -2472,6 +2519,7 @@ export declare const TenantRunEvent: z.ZodObject<{
         late: z.ZodBoolean;
         origin: z.ZodEnum<{
             agent: "agent";
+            api: "api";
             manifest: "manifest";
             wake: "wake";
         }>;

package/dist/api/components.js

@@ -5,7 +5,7 @@
  * global registry.
  */
 import { z } from "zod";
-import { PutSessionModelRequestSchema, SessionModelViewSchema, QueuedResponseSchema, TriggerListSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentFolderRequestSchema, AgentManifestSourceSchema, AgentManifestSourceDiffSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, TurnChangesPageSchema, TurnSummarySchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, TenantRunEventSchema, TenantRunSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+import { PutSessionModelRequestSchema, SessionModelViewSchema, QueuedResponseSchema, TriggerListSchema, TriggerPutSchema, TriggerViewSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentFolderRequestSchema, AgentManifestSourceSchema, AgentManifestSourceDiffSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, TurnChangesPageSchema, TurnSummarySchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, TenantRunEventSchema, TenantRunSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
 function named(id, schema) {
     return schema.meta({ id });
 }
@@ -65,6 +65,8 @@ export const SessionCommand = named("SessionCommand", SessionCommandSchema);
 export const AcceptedResponse = named("AcceptedResponse", AcceptedResponseSchema);
 export const QueuedResponse = named("QueuedResponse", QueuedResponseSchema);
 export const TriggerList = named("TriggerList", TriggerListSchema);
+export const TriggerView = named("TriggerView", TriggerViewSchema);
+export const PutTriggerRequest = named("PutTriggerRequest", TriggerPutSchema);
 export const MemoryList = named("MemoryList", MemoryListSchema);
 export const MemoryView = named("Memory", MemorySchema);
 export const PutMemoryRequest = named("PutMemoryRequest", PutMemoryRequestSchema);

package/dist/api/http/routes/triggers.js

@@ -1,11 +1,12 @@
 import { z } from "zod";
-import { isAgentId } from "@nylorun/core/contracts";
-import { DeletedResponse, RunTriggerResponse, TriggerList, TriggerRunPage, WebhookAcceptedResponse, WebhookSecretResponse, } from "../../components.js";
+import { isAgentId, TriggerIdSchema, TriggerPutSchema } from "@nylorun/core/contracts";
+import { DeletedResponse, PutTriggerRequest, RunTriggerResponse, TriggerList, TriggerRunPage, TriggerView, WebhookAcceptedResponse, WebhookSecretResponse, } from "../../components.js";
 import { assertReaches } from "../../../tenant/agents.js";
 import { fail } from "../../../tenant/http.js";
 import { deleteTrigger, listRuns, listTriggers, receiveWebhook, rotateWebhookSecret, runTriggerNow, setTriggerStatus, } from "../../../tenant/triggers.js";
 import { readRuntimeLimits } from "../../../tenant/runtime-limits.js";
-import { readBytes } from "../body.js";
+import { readBytes, readJson } from "../body.js";
+import { putTrigger } from "../../../tenant/api-triggers.js";
 import { tenantRoute } from "../define.js";
 import { pageQuery, pageSize, parseQuery } from "./reads.js";
 import { jsonResponse } from "../respond.js";
@@ -46,7 +47,7 @@ export function triggerRoutes(api) {
         path: "/v1/agents/{agentId}/triggers",
         tags: ["Triggers"],
         summary: "List an Agent's triggers",
-        description: "Each trigger its manifest declares, and each its agents made with the `triggers` tool (`origin: agent`, with the title and the session that made it), with what the Agent holds of it: its status (`active`, `paused` with a reason, `completed` for an `at` that ran), its prompt, when it runs next and last ran. A session's booked wake is not listed.",
+        description: "Each trigger its manifest declares, each its agents made with the `triggers` tool (`origin: agent`, with the title and the session that made it), and each a client put over the API (`origin: api`, with the title and the `principal` that put it), with what the Agent holds of it: its status (`active`, `paused` with a reason, `completed` for an `at` that ran), its prompt, when it runs next and last ran. A session's booked wake is not listed.",
         request: { params: agentId },
         responses: { 200: json(TriggerList, "The triggers") },
     }, async (c) => {
@@ -73,12 +74,43 @@ export function triggerRoutes(api) {
             assertReaches(c.get("scope"), id);
             return jsonResponse(200, await setTriggerStatus(c.env.tenant, id, c.req.param("triggerId"), action, originOf(c)));
         });
+    tenantRoute(api, WRITE, {
+        method: "put",
+        path: "/v1/agents/{agentId}/triggers/{triggerId}",
+        tags: ["Triggers"],
+        summary: "Put a trigger on an Agent",
+        description: "Creates or replaces the Agent's trigger `triggerId` of origin `api`: a `Trigger` exactly as a definition's `runtime.triggers` entry holds it (one of `schedule` with `timezone`, `at` or `webhook`; `session`; `prompt`), and an optional `title`. A new one is active with its next time; a replaced one gets its next time again and keeps its status, so a paused one stays paused. The same body again changes nothing and records no event. The checks and limits are a definition's; `runtime.limits.triggers.count` covers the triggers the Agent's agents made and those put here. Upgrades never touch it; `DELETE` removes it. Records `agent.trigger_created` or `agent.trigger_updated` (with `changed`) on the Agent's events. Host feature `api-triggers`.",
+        request: {
+            params: triggerPath,
+            body: { required: true, content: { "application/json": { schema: PutTriggerRequest } } },
+        },
+        responses: {
+            200: json(TriggerView, "The trigger, as the list shows it"),
+            400: { description: "Not a trigger, or one the checks refuse: a bad cron or time zone, runs closer than the minimum interval, an `at` not in the future, a prompt too long" },
+            404: { description: "No such Agent" },
+            409: { description: "The definition declares this id, or an agent's trigger or a booked wake holds it (`trigger_conflict`)" },
+            422: { description: "The Agent holds as many triggers its agents or clients made as `limits.triggers.count` allows (`trigger_limit`)" },
+        },
+    }, async (c) => {
+        const id = idOf(c.req.param("agentId"));
+        const scope = c.get("scope");
+        assertReaches(scope, id);
+        const triggerId = TriggerIdSchema.safeParse(c.req.param("triggerId"));
+        if (!triggerId.success)
+            fail(400, triggerId.error.issues[0]?.message ?? "Not a trigger id");
+        const body = TriggerPutSchema.safeParse(await readJson(c));
+        if (!body.success)
+            fail(400, body.error.issues.map((issue) => `${issue.path.join(".") || "body"}: ${issue.message}`).join("; "), {
+                code: "invalid_request",
+            });
+        return jsonResponse(200, await putTrigger(c.env.tenant, id, triggerId.data, body.data, principalOf(scope), originOf(c)));
+    });
     tenantRoute(api, WRITE, {
         method: "delete",
         path: "/v1/agents/{agentId}/triggers/{triggerId}",
         tags: ["Triggers"],
-        summary: "Delete a trigger an agent made",
-        description: "Deletes a trigger one of the Agent's agents made with the `triggers` tool (`origin: agent`), with `agent.trigger_deleted` on the Agent's events; its runs stay. A trigger its manifest declares is refused (`trigger_from_manifest`): save a version without it, or pause it.",
+        summary: "Delete a trigger an agent made or a client put",
+        description: "Deletes a trigger one of the Agent's agents made with the `triggers` tool (`origin: agent`) or a client put (`origin: api`), with `agent.trigger_deleted` on the Agent's events; its runs stay. A trigger its manifest declares is refused (`trigger_from_manifest`): save a version without it, or pause it.",
         request: { params: triggerPath },
         responses: {
             200: json(DeletedResponse, "Deleted"),

package/dist/api/openapi.js

@@ -161,6 +161,7 @@ const RUNTIME_TAGS = [
         description: "What starts an Agent's turns with no client connected: the schedules, one-shot times and webhook endpoints its manifest's `runtime.triggers` declare, and the schedules and follow-ups its agents set up with the `triggers` tool (`engine.triggers`). Each trigger's status is the Agent's: pause and resume it, run it now, delete one an agent made, make a webhook trigger's signing secret, and read its runs (`started`, `queued`, `skipped` or `failed`, with a reason), an Agent's or the whole Tenant's as a stream. In `@nylorun/agents` and `nylorun agents triggers`.",
         operations: [
             "GET /v1/agents/{agentId}/triggers",
+            "PUT /v1/agents/{agentId}/triggers/{triggerId}",
             "POST /v1/agents/{agentId}/triggers/{triggerId}/pause",
             "POST /v1/agents/{agentId}/triggers/{triggerId}/resume",
             "POST /v1/agents/{agentId}/triggers/{triggerId}/run",

package/dist/artifacts/disk.js

@@ -20,6 +20,7 @@
  * Nothing here runs inside a transaction but the lease and the commit. No event type is new:
  * a restore or recovery is `agent.reset` with `reason` and `from`.
  */
+import { computerAccess } from "../sandbox/computer.js";
 import { createHash, randomUUID } from "node:crypto";
 import { newArtifactId } from "@nylorun/core/compatibility";
 import { FOLDER_CONTENT_TYPE, FOLDER_MANIFEST_FORMAT_V2, } from "@nylorun/core/contracts";
@@ -137,6 +138,11 @@ function heartbeat(ctx, id, limits, ms = limits.leaseMs) {
 }
 /** Waits until the engine of pod Environment `id` is connected, starting the pod when it is stopped. */
 async function awaitEngine(ctx, id, waitMs) {
+    // A computer (ADR-149) has no engine connection: it is ready once it answers through the gateway.
+    if (ctx.pods?.computer) {
+        await computerAccess(ctx, id);
+        return;
+    }
     await wakePod(ctx, id);
     const deadline = Date.now() + waitMs;
     while (!ctx.harness.hosting(id)) {
@@ -459,7 +465,9 @@ export async function runPendingSeed(ctx, id) {
         if (!environment || !seed || seed.written)
             return;
         const limits = await copyLimits(ctx, environment);
-        if (environment.kind === "pod") {
+        if (environment.kind === "pod" && ctx.pods?.computer)
+            await computerAccess(ctx, id);
+        else if (environment.kind === "pod") {
             const deadline = Date.now() + limits.podWaitMs;
             // The engine on the new volume: the old one's connection may still be open.
             while (!ctx.harness.hosting(id, environment.pod?.hostEpoch)) {
@@ -494,7 +502,7 @@ export async function runPendingSeed(ctx, id) {
 export async function sweepPendingSeeds(ctx) {
     const pending = (await ctx.store.tx((t) => t.listEnvironments())).filter((environment) => environment.diskSeed !== undefined && !environment.diskSeed.written && environment.pod?.desired !== "deleted");
     for (const environment of pending)
-        if (environment.kind !== "pod" || ctx.harness.hosting(environment.id, environment.pod?.hostEpoch))
+        if (environment.kind !== "pod" || ctx.pods?.computer || ctx.harness.hosting(environment.id, environment.pod?.hostEpoch))
             void runPendingSeed(ctx, environment.id);
 }
 /**

package/dist/harness/computer.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The computer (`--service computer`, ADR-149): the engine in an Agent Substrate actor when every
+ * harness runs outside the sandbox. It runs no loop, joins nothing and dials nothing to the
+ * Runtime. It serves the sandbox handle (`SandboxHandle`: commands, files, listings) on
+ * `NYLORUN_COMPUTER_PORT` (8080), which the sandbox gateway reaches through Substrate's router
+ * (ADR-148), and runs each command as the `local` backend does: the image's shell in `/workspace`,
+ * its own process group, the trust variables pointing at a bundle with Substrate's egress CA.
+ *
+ * Every route but `GET /ready` (the template's wake-up probe) needs `x-nylorun-ticket`: a compact
+ * JWS core signs with Ed25519, checked against `NYLORUN_COMPUTER_TICKET_KEY` (the public half the
+ * template carries), with `aud: "nylorun-computer"`, `exp` ahead, and `sub` this actor's name
+ * (`NYLORUN_COMPUTER_NAME_FILE`), so a router client other than the gateway can't command it.
+ *
+ * Commands are a start and attaches (ADR-148 decision 5): `POST /v1/exec` starts command `id`, or
+ * joins it while it runs, and answers within `waitMs` (at most 50 s) with `{state: "running"}` or
+ * `{state: "done", result}`; `POST /v1/exec/{id}/attach` waits again. A command's result is kept 10
+ * minutes after it ends. After a drain, the next attach reaches this process on the new worker, its
+ * commands moved with the memory snapshot. SIGTERM on Substrate means the worker is stopping: the
+ * engine keeps running, so the sandboxes service can suspend it.
+ */
+import { type KeyObject } from "node:crypto";
+import { type IncomingMessage, type ServerResponse } from "node:http";
+import { type ExecResult, type SandboxHandle } from "../sandbox/types.js";
+export interface ComputerServiceConfig {
+    readonly port: number;
+    /** The ticket key's public half, SPKI PEM. */
+    readonly ticketKey: string;
+    /** The file holding this actor's name (Substrate's actorMetadata). */
+    readonly nameFile: string;
+    /** The engine's own dir on the durable disk (`/harness`). */
+    readonly root: string;
+    /** Substrate's egress CA, which commands trust for hosts whose keys the egress adds. */
+    readonly egressCaFile?: string;
+    /** On Agent Substrate: SIGTERM means the worker is stopping, not that the engine should. */
+    readonly substrate: boolean;
+}
+/** The ticket audience. */
+export declare const COMPUTER_AUDIENCE = "nylorun-computer";
+/** The longest a start or an attach waits before it answers `running`. */
+export declare const MAX_WAIT_MS = 50000;
+/** Checks a ticket; the claims, or why it fails. */
+export declare function checkTicket(token: string | undefined, key: KeyObject, subject: string, now?: number): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export interface ComputerExecRequest {
+    readonly id: string;
+    readonly command: string;
+    readonly cwd: string;
+    readonly timeoutMs: number;
+    readonly env?: Readonly<Record<string, string>>;
+    readonly waitMs?: number;
+}
+export type ComputerExecAnswer = {
+    readonly state: "running";
+} | {
+    readonly state: "done";
+    readonly result: ExecResult;
+} | {
+    readonly state: "failed";
+    readonly message: string;
+};
+/** The commands a computer runs, by id: start, join, attach, cancel. */
+export declare class ComputerCommands {
+    private readonly handle;
+    private readonly commands;
+    constructor(handle: Pick<SandboxHandle, "exec">);
+    start(request: ComputerExecRequest): Promise<ComputerExecAnswer>;
+    /** Undefined when the computer doesn't know the command. */
+    attach(id: string, waitMs?: number): Promise<ComputerExecAnswer> | undefined;
+    cancel(id: string): boolean;
+    private wait;
+    private prune;
+}
+/** The routes, on a handle (tests give their own). */
+export declare function computerHandler(options: {
+    readonly handle: SandboxHandle;
+    readonly key: KeyObject;
+    readonly name: string;
+    readonly ready: () => boolean;
+    readonly now?: () => number;
+}): (request: IncomingMessage, response: ServerResponse) => Promise<void>;
+/** Runs the computer until the process ends. */
+export declare function runComputer(config: ComputerServiceConfig, baseline: Readonly<Record<string, string>>): Promise<void>;