@nylorun/runtime 0.52.0-beta → 0.53.0-beta

package/dist/harness/executors.js

@@ -14,6 +14,14 @@ import { serversOf } from "../mcp/pool.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
 import { abortOn, callHttpTool, callMcpTool, callSandboxTool, invokeModel, isRemoteMcpCall, } from "./calls.js";
 export function harnessExecutors(options) {
+    /** The run's SandboxManager: its computer's, or the harness's own. */
+    const managerOf = (run) => {
+        if (run.start.routing.sandbox?.computer !== true)
+            return options.sandbox();
+        if (!options.computer)
+            throw new Error("This harness can't reach computers: the run's sandbox is one");
+        return options.computer(run);
+    };
     const recoversTools = options.toolGate.recovers === true;
     const sandboxTools = sandboxToolLimitsOf(options.sandboxTools);
     const atGate = (effect, run) => {
@@ -36,7 +44,7 @@ export function harnessExecutors(options) {
                 return callHttpTool(options.toolGate, effect, abortOn(signal, kinds), traceparent);
             // A sandbox command joins its call's span (R7.4): a CLI that reads TRACEPARENT traces under it.
             if (effect.target?.kind === "sandbox")
-                return callSandboxTool(options.sandbox(), traceparent ? { ...routing, environment: { ...routing.environment, TRACEPARENT: traceparent } } : routing, effect, signal, sandboxTools);
+                return callSandboxTool(managerOf(run), traceparent ? { ...routing, environment: { ...routing.environment, TRACEPARENT: traceparent } } : routing, effect, signal, sandboxTools);
             if (effect.target?.kind !== "mcp")
                 throw new Error(`This harness runs no ${effect.target?.kind ?? "untargeted"} call of '${effect.toolName ?? ""}'`);
             return callMcpTool(options.mcp, routing, effect, abortOn(signal, kinds), run.start.limits.toolAnswerBytes, traceparent);
@@ -58,17 +66,17 @@ export function harnessExecutors(options) {
         },
         prepare: (run, record) => prepareMcp(options.mcp, run, record),
         files: {
-            read: (run, path, maxBytes, signal) => withSandbox(run, (session, spec) => options.sandbox().readBytes(session, spec, path, maxBytes, signal)),
-            write: (run, path, body, signal) => withSandbox(run, (session, spec) => options.sandbox().writeBytes(session, spec, path, body, signal)),
+            read: (run, path, maxBytes, signal) => withSandbox(run, (session, spec) => managerOf(run).readBytes(session, spec, path, maxBytes, signal)),
+            write: (run, path, body, signal) => withSandbox(run, (session, spec) => managerOf(run).writeBytes(session, spec, path, body, signal)),
             list: (run, dir, maxEntries, signal) => withSandbox(run, async (session, spec) => {
-                const listed = await options.sandbox().listFiles(session, spec, dir, maxEntries, signal);
+                const listed = await managerOf(run).listFiles(session, spec, dir, maxEntries, signal);
                 return listed.kind === "listed"
                     ? { kind: "listed", entries: listed.listing.entries, truncated: listed.listing.truncated }
                     : listed.kind === "missing"
                         ? { kind: "missing" }
                         : listed;
             }),
-            mount: (run, folder, files, read, signal) => withSandbox(run, (session, spec) => options.sandbox().mountFolder(session, spec, folder, files, read, signal)),
+            mount: (run, folder, files, read, signal) => withSandbox(run, (session, spec) => managerOf(run).mountFolder(session, spec, folder, files, read, signal)),
         },
     };
 }

package/dist/harness/pod.d.ts

@@ -22,6 +22,8 @@ export interface DiskSetupReport {
     readonly exitCode?: number;
     readonly output?: string;
 }
+/** The variables CLIs read their trust bundle from: OpenSSL, Node, Python, curl, git, AWS. */
+export declare const TRUST_VARIABLES: readonly ["SSL_CERT_FILE", "NODE_EXTRA_CA_CERTS", "REQUESTS_CA_BUNDLE", "CURL_CA_BUNDLE", "GIT_SSL_CAINFO", "AWS_CA_BUNDLE"];
 export interface PodHost {
     /**
      * A current host token, for the next connection. Throws when neither renewal nor join works,

package/dist/harness/pod.js

@@ -19,7 +19,7 @@ import { hostTuning } from "../tuning.js";
 import { RUNTIME_VERSION } from "../version.js";
 import { IMAGE_ENGINE_HEADER, isBuiltinEngine } from "./image-engine.js";
 /** The variables CLIs read their trust bundle from: OpenSSL, Node, Python, curl, git, AWS. */
-const TRUST_VARIABLES = [
+export const TRUST_VARIABLES = [
     "SSL_CERT_FILE",
     "NODE_EXTRA_CA_CERTS",
     "REQUESTS_CA_BUNDLE",

package/dist/harness/service.js

@@ -15,7 +15,8 @@ import { DEFAULT_HARNESS, HarnessApiError, } from "@nylorun/core/harness-api";
 import { openMcpThrough } from "../gates/tool-gate.js";
 import { McpPool } from "../mcp/pool.js";
 import { SandboxManager } from "../sandbox/manager.js";
-import { fileSandboxRecords, workspacePrefix } from "../sandbox/records.js";
+import { computerBackend } from "../adapters/sandbox/computer.js";
+import { fileSandboxRecords, memorySandboxRecords, workspacePrefix } from "../sandbox/records.js";
 import { defaultSandboxBackends } from "../sandbox/select.js";
 import { harnessExecutors } from "./executors.js";
 import { connectHarness } from "./ws-client.js";
@@ -57,6 +58,60 @@ export function startHarnessService(options) {
             throw new HarnessApiError("unavailable", "The harness has not said hello yet");
         return manager;
     };
+    // A claim core refuses (its run ended, the session is gone) is dropped, as core's own
+    // SandboxManager drops an event it cannot write.
+    const emit = async (sessionId, turnId, type, payload, meta) => {
+        const channel = client.channel();
+        if (!channel)
+            return;
+        await channel
+            .request("event", {
+            ...(meta.claim === undefined ? {} : { runId: meta.claim }),
+            sessionId,
+            turnId,
+            type,
+            payload,
+            ...(meta.record ? { record: meta.record } : {}),
+        })
+            .catch((error) => logger.warn("harness sandbox event not claimed", {
+            sessionId,
+            type,
+            message: error instanceof Error ? error.message : String(error),
+        }));
+    };
+    // Computers (ADR-149): one manager per computer, on the computer backend, opened with
+    // `computer.open` for the latest run that used it.
+    const computers = new Map();
+    const computerOf = (run) => {
+        const environmentId = run.start.routing.sandbox?.environmentId;
+        if (environmentId === undefined)
+            throw new HarnessApiError("invalid", "A computer's run names its Environment");
+        const known = computers.get(environmentId);
+        if (known) {
+            known.runId = run.runId;
+            return known.manager;
+        }
+        const entry = { runId: run.runId };
+        entry.manager = new SandboxManager({
+            scope: tenantId,
+            records: memorySandboxRecords(),
+            backends: [
+                computerBackend({
+                    open: async (signal) => {
+                        const channel = client.channel();
+                        if (!channel)
+                            throw new HarnessApiError("unavailable", "Not connected to core");
+                        return channel.request("computer.open", { runId: entry.runId, environmentId }, signal);
+                    },
+                }),
+            ],
+            preference: "auto",
+            ephemeral: false,
+            emit,
+        });
+        computers.set(environmentId, entry);
+        return entry.manager;
+    };
     const pool = new McpPool({ openRemote: openMcpThrough(options.toolGate) });
     // How often the harness closes MCP connections idle past their timeout.
     const sweep = setInterval(() => void pool.sweep().catch(() => undefined), hostTuning().harness.mcpSweepMs);
@@ -75,6 +130,7 @@ export function startHarnessService(options) {
         toolGate: options.toolGate,
         mcp: pool,
         sandbox,
+        computer: (run) => computerOf(run),
         ...(sandboxTools ? { sandboxTools } : {}),
     });
     const serve = async (method, params, signal) => {
@@ -142,27 +198,7 @@ export function startHarnessService(options) {
                 backends,
                 preference: answer.sandbox.backend ?? "auto",
                 ephemeral: options.ephemeral === true,
-                // A claim core refuses (its run ended, the session is gone) is dropped, as core's own
-                // SandboxManager drops an event it cannot write.
-                emit: async (sessionId, turnId, type, payload, meta) => {
-                    const channel = client.channel();
-                    if (!channel)
-                        return;
-                    await channel
-                        .request("event", {
-                        ...(meta.claim === undefined ? {} : { runId: meta.claim }),
-                        sessionId,
-                        turnId,
-                        type,
-                        payload,
-                        ...(meta.record ? { record: meta.record } : {}),
-                    })
-                        .catch((error) => logger.warn("harness sandbox event not claimed", {
-                        sessionId,
-                        type,
-                        message: error instanceof Error ? error.message : String(error),
-                    }));
-                },
+                emit,
             });
         },
         ...(options.onGrant ? { onGrant: options.onGrant } : {}),

package/dist/harness-api/server.js

@@ -27,6 +27,8 @@
  * the sandbox's (`revokeHost`: a new join, a stop, a loss) is closed; its runs end as
  * `connection.lost`.
  */
+import { openComputer } from "../sandbox/computer.js";
+import { HttpError } from "../tenant/http.js";
 import { randomUUID } from "node:crypto";
 import { DEFAULT_HARNESS, HARNESS_API_VERSION, HARNESS_CLAIMS, isHarnessId, HarnessApiError, } from "@nylorun/core/harness-api";
 import { definitionFilesOf, limitExceededMessage } from "@nylorun/core/contracts";
@@ -186,6 +188,21 @@ export function createHarnessApiServer(ctx, options = {}) {
                 return recordMcp(run, p);
             case "definition.file":
                 return definitionFile(run, p, signal);
+            case "computer.open": {
+                // Only the computer of the run's own session (ADR-149).
+                const { environmentId } = p;
+                const sandbox = run.offer.start.routing.sandbox;
+                if (sandbox?.computer !== true || sandbox.environmentId !== environmentId)
+                    throw new HarnessApiError("invalid", "This run has no such computer");
+                try {
+                    return await openComputer(ctx, environmentId, signal);
+                }
+                catch (error) {
+                    if (error instanceof HttpError)
+                        throw new HarnessApiError(error.status === 409 || error.status === 503 ? "unavailable" : "invalid", error.message);
+                    throw error;
+                }
+            }
             case "artifact.read":
                 return artifacts.read(artifactScope(run), p, signal);
             case "artifact.write":

package/dist/harness-api/start.js

@@ -74,6 +74,8 @@ options = {}) {
             ...workspace,
             ...(Object.keys(environment).length > 0 ? { environment } : {}),
             ...(current.sandbox === undefined ? {} : { spec: current.sandbox }),
+            // A pod Agent's sandbox is a computer when the Tenant's are (ADR-149).
+            ...(resource?.kind === "pod" && ctx.pods?.computer ? { computer: true } : {}),
         };
         const turnId = current.activeTurnId;
         const noted = current.memoryIndex;

package/dist/harness-api/workspace.d.ts

@@ -50,5 +50,10 @@ export declare function remoteWorkspace(options: RemoteWorkspaceOptions): Worksp
  */
 export declare function withPodWorkspaces(base: WorkspacePort, options: Omit<RemoteWorkspaceOptions, "pod"> & {
     readonly isPod: (environmentId: string) => Promise<boolean>;
+    /**
+     * Computers (ADR-149): a pod Agent's workspace, reached through the sandbox gateway rather
+     * than a pod's host connection.
+     */
+    readonly computer?: (environmentId: string) => WorkspacePort;
 }): WorkspacePort;
 export {};

package/dist/harness-api/workspace.js

@@ -12,6 +12,8 @@
  *   stop idle workspaces and list them (`workspace.sweep`), decides which owners are gone, and
  *   removes theirs (`workspace.remove`); it also keeps the `sandboxes` table in step with the
  *   list.
+ * - **Computers** (ADR-149): a pod Agent's workspace when the Tenant's pod Agents are computers,
+ *   through a SandboxManager on the computer backend (`sandbox/computer.ts`).
  * - **Pod sandboxes** (F7.2, `withPodWorkspaces`): a session attached to a pod sandbox has its
  *   workspace in the pod, served by the sandbox's engine (its host connection). Its tool calls
  *   and disk operations go there whatever serves the other workspaces; with the pod stopped or
@@ -165,11 +167,13 @@ export function remoteWorkspace(options) {
  */
 export function withPodWorkspaces(base, options) {
     const routed = async (session) => session.environmentId !== undefined && (await options.isPod(session.environmentId))
-        ? remoteWorkspace({
-            ...options,
-            pod: session.environmentId,
-            ...(session.hostEpoch === undefined ? {} : { minEpoch: session.hostEpoch }),
-        })
+        ? options.computer
+            ? options.computer(session.environmentId)
+            : remoteWorkspace({
+                ...options,
+                pod: session.environmentId,
+                ...(session.hostEpoch === undefined ? {} : { minEpoch: session.hostEpoch }),
+            })
         : base;
     return {
         ...base,

package/dist/host/harness-entry.js

@@ -1,5 +1,5 @@
 /**
- * The pod's engine (`--service harness` in a sandbox pod), on its own: what `main()` does for that
+ * The pod's engine (`--service harness` in a sandbox pod, or `--service computer` in a computer), on its own: what `main()` does for that
  * service, without importing the rest of the Host. `scripts/bundle-harness.mjs` bundles this file
  * into one script, which the Runtime image ships as `/engine/harness.mjs` and the sandboxes service
  * copies into each pod instead of `/app` (ADR-92 §5: 12 files instead of about 30,000).
@@ -7,13 +7,18 @@
 import { baselineEnvironment } from "./environment.js";
 import { parseStackConfig } from "./stack-config.js";
 import { runHarness } from "../harness/main.js";
+import { runComputer } from "../harness/computer.js";
 import { useHostTuning } from "../tuning.js";
 import { useHostIdentity } from "../vault/host-identity.js";
 import { useWorkloadToken } from "../vault/workload-token.js";
 async function start() {
     const stack = parseStackConfig(process.env, process.argv.slice(2));
+    if (stack.computer) {
+        await runComputer(stack.computer, baselineEnvironment(process.env));
+        return;
+    }
     if (!stack.services.has("harness"))
-        throw new Error("This entry runs only --service harness");
+        throw new Error("This entry runs only --service harness or computer");
     if (stack.tuning)
         useHostTuning(stack.tuning.values, stack.tuning.overrides);
     useWorkloadToken(stack.workloadToken ?? {});

package/dist/host/main.js

@@ -61,6 +61,8 @@ import { httpModelGate } from "../gates/http-client.js";
 import { createS3BlobStore } from "../blob/index.js";
 import { createRunGrants } from "../tenant/run-grants.js";
 import { runHarness } from "../harness/main.js";
+import { runComputer } from "../harness/computer.js";
+import { loadTicketKey, TICKET_TTL_MS } from "../sandbox/computer.js";
 import { startHarnessListener } from "../harness-api/ws-server.js";
 import { httpSandboxesClient } from "../sandbox/pods/client.js";
 import { createCredentialProvider } from "../gates/credential-provider.js";
@@ -234,6 +236,8 @@ export async function main() {
         return runGates(stack);
     if (stack.services.has("harness"))
         return runHarness(stack, baselineEnvironment(process.env));
+    if (stack.computer)
+        return runComputer(stack.computer, baselineEnvironment(process.env));
     const hostRoot = resolveHostRoot();
     const paths = hostPaths(hostRoot);
     mkdirSync(paths.home, { recursive: true });
@@ -385,6 +389,15 @@ export async function main() {
         ? {
             client: httpSandboxesClient({ url: stack.sandboxes.url, token: stack.sandboxes.token }),
             harnessImage: stack.sandboxes.harnessImage,
+            ...(stack.sandboxes.computer
+                ? {
+                    computer: {
+                        gatewayUrl: stack.sandboxes.computer.gatewayUrl,
+                        ticketKey: loadTicketKey(stack.sandboxes.computer.ticketKeyFile),
+                        ttlMs: TICKET_TTL_MS,
+                    },
+                }
+                : {}),
         }
         : undefined;
     // The outside credential provider: each pod Agent segment's variables it names (CP-E).

package/dist/host/stack-config.d.ts

@@ -50,8 +50,9 @@ import { type TraceResource } from "../traces/otlp.js";
 import { type TraceContentKind } from "../traces/map.js";
 import { type BlockedAddress } from "../sandbox/pods/network-gate.js";
 import { type HostTuning } from "../tuning.js";
+import type { ComputerServiceConfig } from "../harness/computer.js";
 /** A Runtime service this release has. */
-export type RuntimeService = "core" | "loop" | "gates" | "keys" | "egress" | "harness";
+export type RuntimeService = "core" | "loop" | "gates" | "keys" | "egress" | "harness" | "computer";
 export type RuntimeServices = ReadonlySet<RuntimeService>;
 export declare const RUNTIME_SERVICES: readonly RuntimeService[];
 /** Where the gates service listens by default. */
@@ -148,6 +149,15 @@ export interface SandboxesConfig {
     token: string;
     /** `NYLORUN_SANDBOX_HARNESS_IMAGE` (the stack sets it to the Runtime image). */
     harnessImage: string;
+    /**
+     * Computers (ADR-149): `NYLORUN_SANDBOX_GATEWAY_URL`, the sandbox gateway, and
+     * `NYLORUN_COMPUTER_TICKET_KEY_FILE`, the key core signs tickets with. With them, every pod
+     * Agent is a computer: its runs go to the harness container.
+     */
+    computer?: {
+        gatewayUrl: string;
+        ticketKeyFile: string;
+    };
 }
 /**
  * The engine in a pod sandbox (`--service harness` with `NYLORUN_SANDBOX_KIND=pod`, F7.2): no
@@ -226,6 +236,8 @@ export interface StackConfig {
     egress?: EgressConfig;
     /** Present when the process runs the harness service (`--service harness`). */
     harness?: HarnessServiceConfig;
+    /** `--service computer` (ADR-149): the engine in a computer. */
+    computer?: ComputerServiceConfig;
     /**
      * `NYLORUN_HARNESS` (`in-process` or `remote`; absent means `in-process`), for a process running
      * core or loop: whether the Tenant runs its own harness, or harnesses connect to

package/dist/host/stack-config.js

@@ -53,7 +53,7 @@ import { LOOPBACK_HOSTS } from "@nylorun/core/contracts";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 import { HostTuningError, parseHostTuning } from "../tuning.js";
 import { HOST_IDENTITY_PROVIDERS } from "../vault/host-identity.js";
-export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
+export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness", "computer"];
 /**
  * Services that may share a process (D12): they hold the same secrets and parse the same
  * trust class of input. keys joins gates (F4.2), and egress joins them (F7.2). The harness
@@ -63,6 +63,7 @@ const SERVICE_GROUPS = [
     ["core", "loop"],
     ["gates", "keys", "egress"],
     ["harness"],
+    ["computer"],
 ];
 /** Where the gates service listens by default. */
 export const DEFAULT_GATES_LISTEN_PORT = 4100;
@@ -264,6 +265,8 @@ export function parseStackConfig(env, argv) {
     const tuning = parseTuning(env);
     if (services.has("harness"))
         return { services, harness: parseHarnessService(env), endpoints: {}, ...(tuning ? { tuning } : {}) };
+    if (services.has("computer"))
+        return { services, computer: parseComputerService(env), endpoints: {}, ...(tuning ? { tuning } : {}) };
     // The image sets NYLORUN_LISTEN_*: only the API's processes read them.
     const servesApi = services.has("core") || services.has("loop");
     const listen = servesApi ? parseListen(env) : undefined;
@@ -567,7 +570,16 @@ function parseSandboxes(env) {
     const harnessImage = read(env, "NYLORUN_SANDBOX_HARNESS_IMAGE");
     if (harnessImage === undefined || /\s/.test(harnessImage))
         throw new StackConfigError("NYLORUN_SANDBOX_HARNESS_IMAGE is required with NYLORUN_SANDBOXES_URL: the Runtime image sandbox pods copy the engine from (`nylorun start` sets it)");
-    return { url: url.replace(/\/+$/, ""), token, harnessImage };
+    const gatewayUrl = parseUrl(env, "NYLORUN_SANDBOX_GATEWAY_URL", ["http:", "https:"]);
+    const ticketKeyFile = read(env, "NYLORUN_COMPUTER_TICKET_KEY_FILE");
+    if ((gatewayUrl === undefined) !== (ticketKeyFile === undefined))
+        throw new StackConfigError("NYLORUN_SANDBOX_GATEWAY_URL and NYLORUN_COMPUTER_TICKET_KEY_FILE go together: computers need the sandbox gateway and the key core signs their tickets with");
+    return {
+        url: url.replace(/\/+$/, ""),
+        token,
+        harnessImage,
+        ...(gatewayUrl && ticketKeyFile ? { computer: { gatewayUrl: gatewayUrl.replace(/\/+$/, ""), ticketKeyFile } } : {}),
+    };
 }
 /**
  * `StackConfig.harnessListener` from `NYLORUN_HARNESS_LISTEN_*` and `NYLORUN_HARNESS_TOKEN`
@@ -585,6 +597,34 @@ function parseHarnessListener(env, tokenRequired = true) {
 }
 /** What a harness process must not hold: it runs next to agent code. */
 const HARNESS_REFUSED = ["NYLORUN_DATABASE_URL", "NYLORUN_GATES_TOKEN", "NYLORUN_KEYS_URL"];
+/**
+ * The engine in a computer (ADR-149), from the variables its template carries: the port, the
+ * ticket key's public half and the file with the actor's name. It holds no Runtime credential.
+ */
+function parseComputerService(env) {
+    const held = [...HARNESS_REFUSED, "NYLORUN_HARNESS_TOKEN", "NYLORUN_JOIN_TOKEN"].filter((name) => read(env, name) !== undefined);
+    if (held.length > 0)
+        throw new StackConfigError(`--service computer refuses to start with ${held.join(", ")} set: a computer holds no Runtime credential`);
+    const ticketKey = read(env, "NYLORUN_COMPUTER_TICKET_KEY");
+    if (ticketKey === undefined || !ticketKey.includes("PUBLIC KEY"))
+        throw new StackConfigError("NYLORUN_COMPUTER_TICKET_KEY is required for --service computer: the PEM public key tickets are checked with");
+    const nameFile = read(env, "NYLORUN_COMPUTER_NAME_FILE");
+    if (nameFile === undefined)
+        throw new StackConfigError("NYLORUN_COMPUTER_NAME_FILE is required for --service computer: the file holding the actor's name");
+    const rawPort = read(env, "NYLORUN_COMPUTER_PORT");
+    const root = read(env, "NYLORUN_HARNESS_ROOT") ?? "/harness";
+    if (!root.startsWith("/"))
+        throw new StackConfigError(`NYLORUN_HARNESS_ROOT must be an absolute path, not ${root}`);
+    const egressCaFile = read(env, "NYLORUN_SANDBOX_EGRESS_CA_FILE");
+    return {
+        port: rawPort === undefined ? 8080 : parsePort("NYLORUN_COMPUTER_PORT", rawPort),
+        ticketKey,
+        nameFile,
+        root,
+        ...(egressCaFile ? { egressCaFile } : {}),
+        substrate: read(env, "NYLORUN_SANDBOX_SUBSTRATE") === "1",
+    };
+}
 /** `StackConfig.harness` from `NYLORUN_HARNESS_*` and `NYLORUN_GATES_URL`. */
 function parseHarnessService(env) {
     const held = [

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.52.0-beta",
+    "version": "0.53.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.52.0-beta",
+    "version": "0.53.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/sandbox/computer.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Computers in core (ADR-149, ADR-150): a pod Agent on an Agent Substrate cluster whose sandboxes
+ * service renders computers (`NYLORUN_SANDBOX_GATEWAY_URL` set). Its engine runs no loop: its
+ * sessions' runs go to the harness container, and its commands and files go through the sandbox
+ * gateway with a ticket core signs here (`computer-ticket.key`, Ed25519; ADR-148).
+ *
+ * - `computerAccess` wakes the computer when it isn't running (as a turn start does), waits until
+ *   the sandboxes service says it is ready (its wake-up probe answered), records its first contact
+ *   (`agent.running` or `agent.relaunched`, the pod's UID for the lost check), and answers where it
+ *   is and a ticket. Core's own uses (the sandbox route, disk versions, artifacts) open it so.
+ * - `openComputer` is what a harness gets with `computer.open`: the same, once a seed being copied
+ *   onto a new volume is written (R2d step 3), with the disk's setup run through the computer when
+ *   its marker isn't the recipe's (R2d step 2; `prepareComputerDisk`), and a version's start check
+ *   passed (T3).
+ */
+import { type KeyObject } from "node:crypto";
+import type { TenantContext } from "../tenant/context.js";
+import { type ComputerAccess } from "../adapters/sandbox/computer.js";
+import { SandboxManager } from "./manager.js";
+import type { SandboxHandle } from "./types.js";
+/** How a Tenant reaches its computers. */
+export interface TenantComputers {
+    /** The sandbox gateway's base URL (`http://sandbox-gateway:4400`). */
+    readonly gatewayUrl: string;
+    /** The ticket key's private half. */
+    readonly ticketKey: KeyObject;
+    /** How long a ticket holds (10 minutes). */
+    readonly ttlMs: number;
+}
+export declare const TICKET_TTL_MS: number;
+/** Reads `NYLORUN_COMPUTER_TICKET_KEY_FILE`'s key (PKCS #8 PEM, Ed25519). */
+export declare function loadTicketKey(path: string): KeyObject;
+/** A computer ticket for sandbox `subject`, signed with `key`: a compact JWS (EdDSA). */
+export declare function signTicket(key: KeyObject, subject: string, expiresAt: number): string;
+/** Whether pod Environments of this Tenant are computers. */
+export declare function computersOf(ctx: Pick<TenantContext, "pods">): TenantComputers | undefined;
+/**
+ * Wakes computer `id` if needed, waits until it is ready, and answers where it is with a ticket.
+ * Refused for a lost, deleted or failed one.
+ */
+export declare function computerAccess(ctx: TenantContext, id: string, signal?: AbortSignal): Promise<ComputerAccess>;
+/**
+ * What `computer.open` answers a harness: access to computer `id`, once a seed is written, its
+ * setup ran, and a version's start check passed. Concurrent opens of one computer share one.
+ */
+export declare function openComputer(ctx: TenantContext, id: string, signal?: AbortSignal): Promise<ComputerAccess>;
+/** The disk's setup, run through the computer when its marker isn't the recipe's (R2d step 2). */
+export declare function prepareComputerDisk(ctx: TenantContext, id: string, handle: SandboxHandle, signal?: AbortSignal): Promise<void>;
+/**
+ * A SandboxManager per computer, for core's own uses: its backend opens the computer with
+ * `computerAccess` (no setup run: the harness's `computer.open` does that before a turn's tools).
+ */
+export declare function computerManagers(ctx: () => TenantContext, emit: ConstructorParameters<typeof SandboxManager>[0]["emit"]): (environmentId: string) => SandboxManager;