@nylorun/runtime 0.51.2-beta → 0.53.0-beta

package/dist/harness/computer.js

@@ -0,0 +1,273 @@
+/**
+ * The computer (`--service computer`, ADR-149): the engine in an Agent Substrate actor when every
+ * harness runs outside the sandbox. It runs no loop, joins nothing and dials nothing to the
+ * Runtime. It serves the sandbox handle (`SandboxHandle`: commands, files, listings) on
+ * `NYLORUN_COMPUTER_PORT` (8080), which the sandbox gateway reaches through Substrate's router
+ * (ADR-148), and runs each command as the `local` backend does: the image's shell in `/workspace`,
+ * its own process group, the trust variables pointing at a bundle with Substrate's egress CA.
+ *
+ * Every route but `GET /ready` (the template's wake-up probe) needs `x-nylorun-ticket`: a compact
+ * JWS core signs with Ed25519, checked against `NYLORUN_COMPUTER_TICKET_KEY` (the public half the
+ * template carries), with `aud: "nylorun-computer"`, `exp` ahead, and `sub` this actor's name
+ * (`NYLORUN_COMPUTER_NAME_FILE`), so a router client other than the gateway can't command it.
+ *
+ * Commands are a start and attaches (ADR-148 decision 5): `POST /v1/exec` starts command `id`, or
+ * joins it while it runs, and answers within `waitMs` (at most 50 s) with `{state: "running"}` or
+ * `{state: "done", result}`; `POST /v1/exec/{id}/attach` waits again. A command's result is kept 10
+ * minutes after it ends. After a drain, the next attach reaches this process on the new worker, its
+ * commands moved with the memory snapshot. SIGTERM on Substrate means the worker is stopping: the
+ * engine keeps running, so the sandboxes service can suspend it.
+ */
+import { createPublicKey, verify } from "node:crypto";
+import { accessSync, constants, readFileSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { rootCertificates } from "node:tls";
+import { join } from "node:path";
+import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
+import { createHostLogger } from "../host/logger.js";
+import { localBackend } from "../adapters/sandbox/local.js";
+import { SandboxFileTooLargeError } from "../sandbox/types.js";
+import { TRUST_VARIABLES } from "./pod.js";
+import { RUNTIME_VERSION } from "../version.js";
+/** The ticket audience. */
+export const COMPUTER_AUDIENCE = "nylorun-computer";
+/** The longest a start or an attach waits before it answers `running`. */
+export const MAX_WAIT_MS = 50_000;
+/** How long a command's result is kept after it ends. */
+const KEEP_MS = 10 * 60_000;
+/** Checks a ticket; the claims, or why it fails. */
+export function checkTicket(token, key, subject, now = Date.now()) {
+    const parts = (token ?? "").split(".");
+    if (parts.length !== 3)
+        return { ok: false, reason: "no ticket" };
+    try {
+        const header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
+        if (header.alg !== "EdDSA")
+            return { ok: false, reason: "alg" };
+        const signed = verify(null, Buffer.from(`${parts[0]}.${parts[1]}`), key, Buffer.from(parts[2], "base64url"));
+        if (!signed)
+            return { ok: false, reason: "signature" };
+        const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        if (claims.aud !== COMPUTER_AUDIENCE)
+            return { ok: false, reason: "audience" };
+        if (claims.sub !== subject)
+            return { ok: false, reason: "subject" };
+        if (typeof claims.exp !== "number" || now / 1000 >= claims.exp)
+            return { ok: false, reason: "expired" };
+        return { ok: true };
+    }
+    catch {
+        return { ok: false, reason: "malformed" };
+    }
+}
+/** The commands a computer runs, by id: start, join, attach, cancel. */
+export class ComputerCommands {
+    handle;
+    commands = new Map();
+    constructor(handle) {
+        this.handle = handle;
+    }
+    start(request) {
+        this.prune();
+        let command = this.commands.get(request.id);
+        if (!command) {
+            const controller = new AbortController();
+            const done = this.handle.exec({
+                command: request.command,
+                cwd: request.cwd,
+                timeoutMs: request.timeoutMs,
+                ...(request.env ? { env: request.env } : {}),
+            }, controller.signal);
+            const created = { done, controller };
+            done.then((result) => {
+                created.result = result;
+                created.endedAt = Date.now();
+            }, (error) => {
+                created.error = error instanceof Error ? error.message : String(error);
+                created.endedAt = Date.now();
+            });
+            this.commands.set(request.id, created);
+            command = created;
+        }
+        return this.wait(command, request.waitMs);
+    }
+    /** Undefined when the computer doesn't know the command. */
+    attach(id, waitMs) {
+        const command = this.commands.get(id);
+        return command ? this.wait(command, waitMs) : undefined;
+    }
+    cancel(id) {
+        const command = this.commands.get(id);
+        command?.controller.abort(new Error("Cancelled"));
+        return command !== undefined;
+    }
+    async wait(command, waitMs = MAX_WAIT_MS) {
+        const ms = Math.max(0, Math.min(waitMs, MAX_WAIT_MS));
+        let timer;
+        const late = new Promise((resolve) => (timer = setTimeout(() => resolve("late"), ms)));
+        try {
+            await Promise.race([command.done.catch(() => undefined), late]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (command.result)
+            return { state: "done", result: command.result };
+        if (command.error !== undefined)
+            return { state: "failed", message: command.error };
+        return { state: "running" };
+    }
+    prune(now = Date.now()) {
+        for (const [id, command] of this.commands)
+            if (command.endedAt !== undefined && now - command.endedAt > KEEP_MS)
+                this.commands.delete(id);
+    }
+}
+/** Writes the trust bundle commands use (the public roots, then Substrate's egress CA). */
+function trustEnvironment(root, egressCaFile) {
+    if (!egressCaFile)
+        return {};
+    let ca;
+    try {
+        ca = readFileSync(egressCaFile, "utf8");
+    }
+    catch {
+        return {};
+    }
+    const bundle = join(root, "egress-ca-bundle.pem");
+    writeFileSync(bundle, `${rootCertificates.join("\n")}\n${ca}\n`, { mode: 0o644 });
+    return Object.fromEntries(TRUST_VARIABLES.map((name) => [name, bundle]));
+}
+async function body(request) {
+    const chunks = [];
+    for await (const chunk of request)
+        chunks.push(chunk);
+    return chunks.length === 0 ? {} : JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function send(response, status, value) {
+    response.writeHead(status, { "content-type": "application/json" });
+    response.end(JSON.stringify(value));
+}
+function failure(response, status, code, message) {
+    send(response, status, { error: { code, message } });
+}
+/** The routes, on a handle (tests give their own). */
+export function computerHandler(options) {
+    const commands = new ComputerCommands(options.handle);
+    const workspace = options.handle.workspace ?? SANDBOX_WORKSPACE;
+    return async (request, response) => {
+        const url = new URL(request.url ?? "/", "http://computer");
+        try {
+            if (request.method === "GET" && url.pathname === "/ready") {
+                if (options.ready())
+                    send(response, 200, { status: "ok", version: RUNTIME_VERSION });
+                else
+                    failure(response, 503, "not_ready", `${workspace} is not writable`);
+                return;
+            }
+            const ticket = request.headers["x-nylorun-ticket"];
+            const checked = checkTicket(Array.isArray(ticket) ? ticket[0] : ticket, options.key, options.name, options.now?.() ?? Date.now());
+            if (!checked.ok)
+                return failure(response, 401, "unauthorized", `Ticket refused: ${checked.reason}`);
+            const path = url.searchParams.get("path") ?? "";
+            if (request.method === "GET" && url.pathname === "/v1/info")
+                return send(response, 200, { workspace, diskRoots: options.handle.diskRoots ?? { workspace }, version: RUNTIME_VERSION });
+            if (request.method === "POST" && url.pathname === "/v1/exec") {
+                const exec = (await body(request));
+                if (typeof exec.id !== "string" || typeof exec.command !== "string" || typeof exec.timeoutMs !== "number")
+                    return failure(response, 400, "invalid_request", "id, command and timeoutMs are required");
+                return send(response, 200, await commands.start({ ...exec, cwd: exec.cwd || workspace }));
+            }
+            const attach = /^\/v1\/exec\/([^/]+)\/(attach|cancel)$/.exec(url.pathname);
+            if (request.method === "POST" && attach) {
+                const id = decodeURIComponent(attach[1]);
+                if (attach[2] === "cancel")
+                    return send(response, commands.cancel(id) ? 200 : 404, { cancelled: true });
+                const { waitMs } = (await body(request));
+                const answer = commands.attach(id, waitMs);
+                if (!answer)
+                    return failure(response, 404, "unknown_command", `This computer doesn't know command ${id}`);
+                return send(response, 200, await answer);
+            }
+            if (url.pathname === "/v1/files") {
+                if (!path.startsWith("/"))
+                    return failure(response, 400, "invalid_request", "path must be absolute");
+                if (request.method === "GET") {
+                    const max = Number(url.searchParams.get("maxBytes") ?? "0") || Number.MAX_SAFE_INTEGER;
+                    const bytes = await options.handle.readBytes(path, max);
+                    if (bytes === undefined)
+                        return failure(response, 404, "not_found", `${path} does not exist`);
+                    response.writeHead(200, { "content-type": "application/octet-stream", "content-length": bytes.length });
+                    response.end(bytes);
+                    return;
+                }
+                if (request.method === "PUT") {
+                    await options.handle.writeFile(path, request);
+                    return send(response, 200, { written: true });
+                }
+            }
+            if (request.method === "GET" && url.pathname === "/v1/list") {
+                const dir = url.searchParams.get("dir") ?? "";
+                const max = Number(url.searchParams.get("maxEntries") ?? "10000");
+                const listed = await options.handle.listFiles(dir, max);
+                if (!listed)
+                    return failure(response, 404, "not_found", `${dir} is not a directory`);
+                return send(response, 200, listed);
+            }
+            failure(response, 404, "not_found", `No route ${request.method} ${url.pathname}`);
+        }
+        catch (error) {
+            if (error instanceof SandboxFileTooLargeError)
+                return failure(response, 413, "too_large", error.message);
+            if (response.headersSent)
+                return void response.destroy();
+            failure(response, 500, "computer_error", error instanceof Error ? error.message : String(error));
+        }
+    };
+}
+/** Runs the computer until the process ends. */
+export async function runComputer(config, baseline) {
+    const logger = createHostLogger();
+    const trust = trustEnvironment(config.root, config.egressCaFile);
+    const backend = localBackend({ env: baseline, proxyEnv: () => trust, harnessRoot: config.root });
+    const handle = await backend.open({
+        key: "computer",
+        cpus: 1,
+        memoryMiB: 1024,
+        network: { preset: "none", hosts: [], suffixes: [] },
+    });
+    const name = readFileSync(config.nameFile, "utf8").trim();
+    const key = createPublicKey(config.ticketKey);
+    const ready = () => {
+        try {
+            accessSync(handle.workspace ?? SANDBOX_WORKSPACE, constants.W_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const server = createServer((request, response) => void computerHandler({ handle, key, name, ready })(request, response));
+    server.requestTimeout = 0;
+    server.headersTimeout = 30_000;
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(config.port, "0.0.0.0", () => resolve());
+    });
+    logger.info("computer_ready", { name, port: config.port, version: RUNTIME_VERSION });
+    let stopping = false;
+    for (const signal of ["SIGINT", "SIGTERM"])
+        process.on(signal, () => {
+            // On Agent Substrate, SIGTERM means the worker pod is stopping: the actor has 30 minutes to
+            // be suspended, and the sandboxes service suspends it (Substrate's eviction contract).
+            if (signal === "SIGTERM" && config.substrate) {
+                logger.info("computer_worker_stopping", { name });
+                return;
+            }
+            if (stopping)
+                return;
+            stopping = true;
+            server.close();
+            process.exit(0);
+        });
+}

package/dist/harness/executors.d.ts

@@ -11,6 +11,11 @@ export interface HarnessExecutorsOptions {
     readonly mcp: McpPool;
     /** The SandboxManager; a harness process creates it once `hello` names the Tenant. */
     readonly sandbox: () => SandboxManager;
+    /**
+     * The manager of a run whose sandbox is a computer (`routing.sandbox.computer`, ADR-149): one on
+     * the computer backend, opened with `computer.open`. Absent: such a run's sandbox calls fail.
+     */
+    readonly computer?: (run: HarnessRun) => SandboxManager;
     /**
      * The sandbox tools' limits the calls run with: the harness's configuration, the same it gives
      * `createHarness({ sandboxTools })`. Each left out is its default.

package/dist/harness/executors.js

@@ -14,6 +14,14 @@ import { serversOf } from "../mcp/pool.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
 import { abortOn, callHttpTool, callMcpTool, callSandboxTool, invokeModel, isRemoteMcpCall, } from "./calls.js";
 export function harnessExecutors(options) {
+    /** The run's SandboxManager: its computer's, or the harness's own. */
+    const managerOf = (run) => {
+        if (run.start.routing.sandbox?.computer !== true)
+            return options.sandbox();
+        if (!options.computer)
+            throw new Error("This harness can't reach computers: the run's sandbox is one");
+        return options.computer(run);
+    };
     const recoversTools = options.toolGate.recovers === true;
     const sandboxTools = sandboxToolLimitsOf(options.sandboxTools);
     const atGate = (effect, run) => {
@@ -36,7 +44,7 @@ export function harnessExecutors(options) {
                 return callHttpTool(options.toolGate, effect, abortOn(signal, kinds), traceparent);
             // A sandbox command joins its call's span (R7.4): a CLI that reads TRACEPARENT traces under it.
             if (effect.target?.kind === "sandbox")
-                return callSandboxTool(options.sandbox(), traceparent ? { ...routing, environment: { ...routing.environment, TRACEPARENT: traceparent } } : routing, effect, signal, sandboxTools);
+                return callSandboxTool(managerOf(run), traceparent ? { ...routing, environment: { ...routing.environment, TRACEPARENT: traceparent } } : routing, effect, signal, sandboxTools);
             if (effect.target?.kind !== "mcp")
                 throw new Error(`This harness runs no ${effect.target?.kind ?? "untargeted"} call of '${effect.toolName ?? ""}'`);
             return callMcpTool(options.mcp, routing, effect, abortOn(signal, kinds), run.start.limits.toolAnswerBytes, traceparent);
@@ -58,17 +66,17 @@ export function harnessExecutors(options) {
         },
         prepare: (run, record) => prepareMcp(options.mcp, run, record),
         files: {
-            read: (run, path, maxBytes, signal) => withSandbox(run, (session, spec) => options.sandbox().readBytes(session, spec, path, maxBytes, signal)),
-            write: (run, path, body, signal) => withSandbox(run, (session, spec) => options.sandbox().writeBytes(session, spec, path, body, signal)),
+            read: (run, path, maxBytes, signal) => withSandbox(run, (session, spec) => managerOf(run).readBytes(session, spec, path, maxBytes, signal)),
+            write: (run, path, body, signal) => withSandbox(run, (session, spec) => managerOf(run).writeBytes(session, spec, path, body, signal)),
             list: (run, dir, maxEntries, signal) => withSandbox(run, async (session, spec) => {
-                const listed = await options.sandbox().listFiles(session, spec, dir, maxEntries, signal);
+                const listed = await managerOf(run).listFiles(session, spec, dir, maxEntries, signal);
                 return listed.kind === "listed"
                     ? { kind: "listed", entries: listed.listing.entries, truncated: listed.listing.truncated }
                     : listed.kind === "missing"
                         ? { kind: "missing" }
                         : listed;
             }),
-            mount: (run, folder, files, read, signal) => withSandbox(run, (session, spec) => options.sandbox().mountFolder(session, spec, folder, files, read, signal)),
+            mount: (run, folder, files, read, signal) => withSandbox(run, (session, spec) => managerOf(run).mountFolder(session, spec, folder, files, read, signal)),
         },
     };
 }

package/dist/harness/pod.d.ts

@@ -22,6 +22,8 @@ export interface DiskSetupReport {
     readonly exitCode?: number;
     readonly output?: string;
 }
+/** The variables CLIs read their trust bundle from: OpenSSL, Node, Python, curl, git, AWS. */
+export declare const TRUST_VARIABLES: readonly ["SSL_CERT_FILE", "NODE_EXTRA_CA_CERTS", "REQUESTS_CA_BUNDLE", "CURL_CA_BUNDLE", "GIT_SSL_CAINFO", "AWS_CA_BUNDLE"];
 export interface PodHost {
     /**
      * A current host token, for the next connection. Throws when neither renewal nor join works,

package/dist/harness/pod.js

@@ -19,7 +19,7 @@ import { hostTuning } from "../tuning.js";
 import { RUNTIME_VERSION } from "../version.js";
 import { IMAGE_ENGINE_HEADER, isBuiltinEngine } from "./image-engine.js";
 /** The variables CLIs read their trust bundle from: OpenSSL, Node, Python, curl, git, AWS. */
-const TRUST_VARIABLES = [
+export const TRUST_VARIABLES = [
     "SSL_CERT_FILE",
     "NODE_EXTRA_CA_CERTS",
     "REQUESTS_CA_BUNDLE",

package/dist/harness/service.js

@@ -15,7 +15,8 @@ import { DEFAULT_HARNESS, HarnessApiError, } from "@nylorun/core/harness-api";
 import { openMcpThrough } from "../gates/tool-gate.js";
 import { McpPool } from "../mcp/pool.js";
 import { SandboxManager } from "../sandbox/manager.js";
-import { fileSandboxRecords, workspacePrefix } from "../sandbox/records.js";
+import { computerBackend } from "../adapters/sandbox/computer.js";
+import { fileSandboxRecords, memorySandboxRecords, workspacePrefix } from "../sandbox/records.js";
 import { defaultSandboxBackends } from "../sandbox/select.js";
 import { harnessExecutors } from "./executors.js";
 import { connectHarness } from "./ws-client.js";
@@ -57,6 +58,60 @@ export function startHarnessService(options) {
             throw new HarnessApiError("unavailable", "The harness has not said hello yet");
         return manager;
     };
+    // A claim core refuses (its run ended, the session is gone) is dropped, as core's own
+    // SandboxManager drops an event it cannot write.
+    const emit = async (sessionId, turnId, type, payload, meta) => {
+        const channel = client.channel();
+        if (!channel)
+            return;
+        await channel
+            .request("event", {
+            ...(meta.claim === undefined ? {} : { runId: meta.claim }),
+            sessionId,
+            turnId,
+            type,
+            payload,
+            ...(meta.record ? { record: meta.record } : {}),
+        })
+            .catch((error) => logger.warn("harness sandbox event not claimed", {
+            sessionId,
+            type,
+            message: error instanceof Error ? error.message : String(error),
+        }));
+    };
+    // Computers (ADR-149): one manager per computer, on the computer backend, opened with
+    // `computer.open` for the latest run that used it.
+    const computers = new Map();
+    const computerOf = (run) => {
+        const environmentId = run.start.routing.sandbox?.environmentId;
+        if (environmentId === undefined)
+            throw new HarnessApiError("invalid", "A computer's run names its Environment");
+        const known = computers.get(environmentId);
+        if (known) {
+            known.runId = run.runId;
+            return known.manager;
+        }
+        const entry = { runId: run.runId };
+        entry.manager = new SandboxManager({
+            scope: tenantId,
+            records: memorySandboxRecords(),
+            backends: [
+                computerBackend({
+                    open: async (signal) => {
+                        const channel = client.channel();
+                        if (!channel)
+                            throw new HarnessApiError("unavailable", "Not connected to core");
+                        return channel.request("computer.open", { runId: entry.runId, environmentId }, signal);
+                    },
+                }),
+            ],
+            preference: "auto",
+            ephemeral: false,
+            emit,
+        });
+        computers.set(environmentId, entry);
+        return entry.manager;
+    };
     const pool = new McpPool({ openRemote: openMcpThrough(options.toolGate) });
     // How often the harness closes MCP connections idle past their timeout.
     const sweep = setInterval(() => void pool.sweep().catch(() => undefined), hostTuning().harness.mcpSweepMs);
@@ -75,6 +130,7 @@ export function startHarnessService(options) {
         toolGate: options.toolGate,
         mcp: pool,
         sandbox,
+        computer: (run) => computerOf(run),
         ...(sandboxTools ? { sandboxTools } : {}),
     });
     const serve = async (method, params, signal) => {
@@ -142,27 +198,7 @@ export function startHarnessService(options) {
                 backends,
                 preference: answer.sandbox.backend ?? "auto",
                 ephemeral: options.ephemeral === true,
-                // A claim core refuses (its run ended, the session is gone) is dropped, as core's own
-                // SandboxManager drops an event it cannot write.
-                emit: async (sessionId, turnId, type, payload, meta) => {
-                    const channel = client.channel();
-                    if (!channel)
-                        return;
-                    await channel
-                        .request("event", {
-                        ...(meta.claim === undefined ? {} : { runId: meta.claim }),
-                        sessionId,
-                        turnId,
-                        type,
-                        payload,
-                        ...(meta.record ? { record: meta.record } : {}),
-                    })
-                        .catch((error) => logger.warn("harness sandbox event not claimed", {
-                        sessionId,
-                        type,
-                        message: error instanceof Error ? error.message : String(error),
-                    }));
-                },
+                emit,
             });
         },
         ...(options.onGrant ? { onGrant: options.onGrant } : {}),

package/dist/harness-api/server.js

@@ -27,6 +27,8 @@
  * the sandbox's (`revokeHost`: a new join, a stop, a loss) is closed; its runs end as
  * `connection.lost`.
  */
+import { openComputer } from "../sandbox/computer.js";
+import { HttpError } from "../tenant/http.js";
 import { randomUUID } from "node:crypto";
 import { DEFAULT_HARNESS, HARNESS_API_VERSION, HARNESS_CLAIMS, isHarnessId, HarnessApiError, } from "@nylorun/core/harness-api";
 import { definitionFilesOf, limitExceededMessage } from "@nylorun/core/contracts";
@@ -186,6 +188,21 @@ export function createHarnessApiServer(ctx, options = {}) {
                 return recordMcp(run, p);
             case "definition.file":
                 return definitionFile(run, p, signal);
+            case "computer.open": {
+                // Only the computer of the run's own session (ADR-149).
+                const { environmentId } = p;
+                const sandbox = run.offer.start.routing.sandbox;
+                if (sandbox?.computer !== true || sandbox.environmentId !== environmentId)
+                    throw new HarnessApiError("invalid", "This run has no such computer");
+                try {
+                    return await openComputer(ctx, environmentId, signal);
+                }
+                catch (error) {
+                    if (error instanceof HttpError)
+                        throw new HarnessApiError(error.status === 409 || error.status === 503 ? "unavailable" : "invalid", error.message);
+                    throw error;
+                }
+            }
             case "artifact.read":
                 return artifacts.read(artifactScope(run), p, signal);
             case "artifact.write":

package/dist/harness-api/start.js

@@ -74,6 +74,8 @@ options = {}) {
             ...workspace,
             ...(Object.keys(environment).length > 0 ? { environment } : {}),
             ...(current.sandbox === undefined ? {} : { spec: current.sandbox }),
+            // A pod Agent's sandbox is a computer when the Tenant's are (ADR-149).
+            ...(resource?.kind === "pod" && ctx.pods?.computer ? { computer: true } : {}),
         };
         const turnId = current.activeTurnId;
         const noted = current.memoryIndex;

package/dist/harness-api/workspace.d.ts

@@ -50,5 +50,10 @@ export declare function remoteWorkspace(options: RemoteWorkspaceOptions): Worksp
  */
 export declare function withPodWorkspaces(base: WorkspacePort, options: Omit<RemoteWorkspaceOptions, "pod"> & {
     readonly isPod: (environmentId: string) => Promise<boolean>;
+    /**
+     * Computers (ADR-149): a pod Agent's workspace, reached through the sandbox gateway rather
+     * than a pod's host connection.
+     */
+    readonly computer?: (environmentId: string) => WorkspacePort;
 }): WorkspacePort;
 export {};

package/dist/harness-api/workspace.js

@@ -12,6 +12,8 @@
  *   stop idle workspaces and list them (`workspace.sweep`), decides which owners are gone, and
  *   removes theirs (`workspace.remove`); it also keeps the `sandboxes` table in step with the
  *   list.
+ * - **Computers** (ADR-149): a pod Agent's workspace when the Tenant's pod Agents are computers,
+ *   through a SandboxManager on the computer backend (`sandbox/computer.ts`).
  * - **Pod sandboxes** (F7.2, `withPodWorkspaces`): a session attached to a pod sandbox has its
  *   workspace in the pod, served by the sandbox's engine (its host connection). Its tool calls
  *   and disk operations go there whatever serves the other workspaces; with the pod stopped or
@@ -165,11 +167,13 @@ export function remoteWorkspace(options) {
  */
 export function withPodWorkspaces(base, options) {
     const routed = async (session) => session.environmentId !== undefined && (await options.isPod(session.environmentId))
-        ? remoteWorkspace({
-            ...options,
-            pod: session.environmentId,
-            ...(session.hostEpoch === undefined ? {} : { minEpoch: session.hostEpoch }),
-        })
+        ? options.computer
+            ? options.computer(session.environmentId)
+            : remoteWorkspace({
+                ...options,
+                pod: session.environmentId,
+                ...(session.hostEpoch === undefined ? {} : { minEpoch: session.hostEpoch }),
+            })
         : base;
     return {
         ...base,

package/dist/host/harness-entry.js

@@ -1,5 +1,5 @@
 /**
- * The pod's engine (`--service harness` in a sandbox pod), on its own: what `main()` does for that
+ * The pod's engine (`--service harness` in a sandbox pod, or `--service computer` in a computer), on its own: what `main()` does for that
  * service, without importing the rest of the Host. `scripts/bundle-harness.mjs` bundles this file
  * into one script, which the Runtime image ships as `/engine/harness.mjs` and the sandboxes service
  * copies into each pod instead of `/app` (ADR-92 §5: 12 files instead of about 30,000).
@@ -7,13 +7,18 @@
 import { baselineEnvironment } from "./environment.js";
 import { parseStackConfig } from "./stack-config.js";
 import { runHarness } from "../harness/main.js";
+import { runComputer } from "../harness/computer.js";
 import { useHostTuning } from "../tuning.js";
 import { useHostIdentity } from "../vault/host-identity.js";
 import { useWorkloadToken } from "../vault/workload-token.js";
 async function start() {
     const stack = parseStackConfig(process.env, process.argv.slice(2));
+    if (stack.computer) {
+        await runComputer(stack.computer, baselineEnvironment(process.env));
+        return;
+    }
     if (!stack.services.has("harness"))
-        throw new Error("This entry runs only --service harness");
+        throw new Error("This entry runs only --service harness or computer");
     if (stack.tuning)
         useHostTuning(stack.tuning.values, stack.tuning.overrides);
     useWorkloadToken(stack.workloadToken ?? {});

package/dist/host/main.js

@@ -61,6 +61,8 @@ import { httpModelGate } from "../gates/http-client.js";
 import { createS3BlobStore } from "../blob/index.js";
 import { createRunGrants } from "../tenant/run-grants.js";
 import { runHarness } from "../harness/main.js";
+import { runComputer } from "../harness/computer.js";
+import { loadTicketKey, TICKET_TTL_MS } from "../sandbox/computer.js";
 import { startHarnessListener } from "../harness-api/ws-server.js";
 import { httpSandboxesClient } from "../sandbox/pods/client.js";
 import { createCredentialProvider } from "../gates/credential-provider.js";
@@ -234,6 +236,8 @@ export async function main() {
         return runGates(stack);
     if (stack.services.has("harness"))
         return runHarness(stack, baselineEnvironment(process.env));
+    if (stack.computer)
+        return runComputer(stack.computer, baselineEnvironment(process.env));
     const hostRoot = resolveHostRoot();
     const paths = hostPaths(hostRoot);
     mkdirSync(paths.home, { recursive: true });
@@ -385,6 +389,15 @@ export async function main() {
         ? {
             client: httpSandboxesClient({ url: stack.sandboxes.url, token: stack.sandboxes.token }),
             harnessImage: stack.sandboxes.harnessImage,
+            ...(stack.sandboxes.computer
+                ? {
+                    computer: {
+                        gatewayUrl: stack.sandboxes.computer.gatewayUrl,
+                        ticketKey: loadTicketKey(stack.sandboxes.computer.ticketKeyFile),
+                        ttlMs: TICKET_TTL_MS,
+                    },
+                }
+                : {}),
         }
         : undefined;
     // The outside credential provider: each pod Agent segment's variables it names (CP-E).

package/dist/host/stack-config.d.ts

@@ -50,8 +50,9 @@ import { type TraceResource } from "../traces/otlp.js";
 import { type TraceContentKind } from "../traces/map.js";
 import { type BlockedAddress } from "../sandbox/pods/network-gate.js";
 import { type HostTuning } from "../tuning.js";
+import type { ComputerServiceConfig } from "../harness/computer.js";
 /** A Runtime service this release has. */
-export type RuntimeService = "core" | "loop" | "gates" | "keys" | "egress" | "harness";
+export type RuntimeService = "core" | "loop" | "gates" | "keys" | "egress" | "harness" | "computer";
 export type RuntimeServices = ReadonlySet<RuntimeService>;
 export declare const RUNTIME_SERVICES: readonly RuntimeService[];
 /** Where the gates service listens by default. */
@@ -148,6 +149,15 @@ export interface SandboxesConfig {
     token: string;
     /** `NYLORUN_SANDBOX_HARNESS_IMAGE` (the stack sets it to the Runtime image). */
     harnessImage: string;
+    /**
+     * Computers (ADR-149): `NYLORUN_SANDBOX_GATEWAY_URL`, the sandbox gateway, and
+     * `NYLORUN_COMPUTER_TICKET_KEY_FILE`, the key core signs tickets with. With them, every pod
+     * Agent is a computer: its runs go to the harness container.
+     */
+    computer?: {
+        gatewayUrl: string;
+        ticketKeyFile: string;
+    };
 }
 /**
  * The engine in a pod sandbox (`--service harness` with `NYLORUN_SANDBOX_KIND=pod`, F7.2): no
@@ -226,6 +236,8 @@ export interface StackConfig {
     egress?: EgressConfig;
     /** Present when the process runs the harness service (`--service harness`). */
     harness?: HarnessServiceConfig;
+    /** `--service computer` (ADR-149): the engine in a computer. */
+    computer?: ComputerServiceConfig;
     /**
      * `NYLORUN_HARNESS` (`in-process` or `remote`; absent means `in-process`), for a process running
      * core or loop: whether the Tenant runs its own harness, or harnesses connect to