@nylorun/runtime 0.6.0-beta → 0.8.0-beta

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## 0.8.0-beta
+
+### Minor Changes
+
+- b8d822a: Studio Model Settings lists multiple vault-stored providers, adds credentials through a sheet, and switches the active provider/model via Runtime host vault APIs.
+- b8d822a: Let a running Runtime learn its executors instead of receiving them all at startup.
+  `PUT /v1/executors` registers or rotates scoped executor credentials with the application
+  credential, `DELETE /v1/executors/:agentId` removes one, and `GET /v1/executors` lists them
+  without disclosing secrets. Registrations persist in SQLite with the token hashed at rest and
+  are restored on the next start; scopes supplied through `NYLORUN_EXECUTORS_JSON` still apply
+  to that process, take precedence for their agent, and are never written to the database. An
+  unchanged registration is idempotent and keeps open streams, while a rotation ends the
+  replaced token's work stream and stops it authorizing. Unauthenticated `/health` now also
+  reports the Runtime version, a non-reversible scope digest of the database path, and the
+  process id; all three are optional in the contract so an older host still parses. Token
+  hashing is adequate only because these credentials are high-entropy values minted by the
+  host; it is not a password derivation.
+- b8d822a: Remove the legacy in-process host. `httpModel`, `HttpModelOptions`, and `ModelEnvironment` are no longer exported from `@nylorun/runtime`, `localSessions` is no longer exported from `@nylorun/runtime/node`, and `modelSelection` is no longer exported from `@nylorun/runtime/configuration`. The internal `Runtime`, `serveAgents`, `openSession`, and AG-UI route are deleted. Host agents with `nylorun dev` / `nylorun serve` and the standalone Runtime.
+- b8d822a: Add `sandbox()`: one `.use(sandbox())` gives an agent Runtime-executed `bash`, `read`, `write`, `edit`, `grep` and `glob` tools on an isolated machine with a persistent `/workspace`. The Runtime selects a microsandbox microVM where available, otherwise an in-process virtual shell, enforces deny-by-default egress presets, owns sandbox lifecycle, and reports its choice through `GET /v1/host/sandbox`, the `nylorun dev` banner and `nylorun doctor sandbox`.
+- b8d822a: Breaking beta: replace `beforeModelCall` / `afterModelCall` with scoped hooks. Register `before("turn" | "step", fn)` and `after("step" | "turn", fn)` on the agent, or `before: { turn, step }` / `after: { step, turn }` on a capability. `before("turn")` runs once per turn and its `Patch` applies to every model call in the turn; the new `after("turn")` returns a `TurnDecision` for the final answer. `after` hooks take one argument and receive `attempt`, and `retry` now retries instead of failing the run. The manifest moves to `manifestSchemaVersion: 4` with `capabilities[].hooks`, and `BeforeModelCallFn`, `AfterModelCallFn` and the `beforeModelCall` / `afterModelCall` action kinds are removed. Every capability registered at a hook point now runs in one `hook` executor action, an expired hook claim is offered again instead of becoming uncertain, and the durable engine version is `hosted-2`. Hook toggles now hide a capability's tools, or one tool of a multi-tool capability, instead of having no effect or failing. Studio lists each capability's hooks with how often they run and labels hook actions. See MIGRATION.md.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [b8d822a]
+- Updated dependencies [b8d822a]
+- Updated dependencies [b8d822a]
+- Updated dependencies [b8d822a]
+- Updated dependencies
+  - @nylorun/core@0.3.0-beta
+  - @nylorun/harness@0.17.0-beta
+
+## 0.7.0-beta
+
+### Minor Changes
+
+- 3a88f51: Ship Agent-Plugins (`plugin()` / `loadPlugin`), Skills (`load_skill` / skill resources), Runtime MCP pool + vault credentials, and manifest v3 capability fields. Validate completed tool `output` against the tool output schema so ordinary tools with `outputSchema` no longer false-fail as `tool.invalid-output`.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [3a88f51]
+- Updated dependencies
+  - @nylorun/core@0.2.0-beta
+  - @nylorun/harness@0.16.0-beta
+
 ## 0.6.0-beta
 
 ### Major Changes

package/README.md

@@ -14,7 +14,7 @@ NYLORUN_SERVER_KEY='<separate-secret-at-least-16-characters>' npm start --worksp
 
 Default address: `http://127.0.0.1:8787`. `HOST`, `PORT`, and `NYLORUN_SQLITE_PATH` configure binding and storage. Missing server credentials fail startup. The default model is a credential-free scripted development response. It does not simulate conversations, tools or provider compatibility.
 
-`NYLORUN_EXECUTORS_JSON` is an array of `{token, agentId, manifestHash, implementationVersion}`. Each secret must differ from the application server key and every other executor token. The manifest hash is available from `@nylorun/core/compatibility` or saved definition registration. SDK clients use `NYLORUN_RUNTIME_URL`, `NYLORUN_SERVER_KEY`, and `NYLORUN_EXECUTOR_KEY`; runtime executor scope is configured explicitly, never broadened by client input.
+`NYLORUN_EXECUTORS_JSON` is an array of `{token, agentId, implementationVersion}`. Each secret must differ from the application server key and every other executor token. An optional `manifestHash` on an existing record is ignored and does not hide or reject work. SDK clients use `NYLORUN_RUNTIME_URL`, `NYLORUN_SERVER_KEY`, and `NYLORUN_EXECUTOR_KEY`; runtime executor scope is the agent id, never broadened by client input.
 
 For a model gateway, set `NYLORUN_MODEL_GATEWAY_URL`, `NYLORUN_MODEL_GATEWAY_KEY`, and `NYLORUN_MODEL`. The gateway receives `{model, call, context}` and returns a harness ModelCandidate or string. Provider credentials remain host configuration. The generic gateway requires an implementation of this envelope; it does not claim arbitrary provider wire compatibility. Alternatively supply a `ModelProvider` to `startRuntime`.
 
@@ -36,12 +36,16 @@ SQLite transactions persist session checkpoints, command receipts, individual ef
 
 One process owns each SQLite database. A local PID lock rejects concurrent owners and recovers only when the recorded process no longer exists. Shared/network filesystems and multiple replicas are unsupported. Keep the database and its WAL/journal together; do not delete persisted effects separately from checkpoints. Invalid lock contents or PID reuse fail closed and require operator inspection. TLS and external ingress belong to deployment infrastructure.
 
+The vault holds two scopes. End-user vaults each belong to one `ownerUserId` and store URL-bound credentials for outbound calls such as MCP. The host scope stores model provider credentials the Runtime uses when it calls a provider; Studio and `nylorun configure` can keep multiple providers and select the active provider/model. Secret values are encrypted with AES-256-GCM under a key-encryption key. Set `NYLORUN_VAULT_KEK` to 32 bytes encoded as base64, or allow the host to create `.nylorun/vault-kek` (mode 0600) on the first write. A database that already holds vault ciphertext will not open without that key. Reads return metadata only.
+
+Agents that declare `.use(sandbox())` get Runtime-executed `bash`, `read`, `write`, `edit`, `grep` and `glob` tools. The Runtime owns each sandbox: one per session, created on the first sandbox tool call, stopped after its idle timeout, and reattached with its files on the next call, including after a restart. On first use the Runtime probes its backends in order and keeps the choice for its lifetime: a microsandbox microVM (macOS on Apple Silicon, or Linux with `/dev/kvm`), then the in-process virtual shell (`just-bash`). Set `NYLORUN_SANDBOX=microsandbox` or `virtual` to force one; a forced backend never falls back. `GET /v1/host/sandbox` reports the selection, and `nylorun doctor sandbox` shows the same probe. Virtual workspaces live in `sandboxes/` beside the SQLite file. Tool calls emit `sandbox.state` and `sandbox.exec` session events. A sandbox call interrupted by a crash becomes uncertain and is never re-run. `microsandbox` is an optional dependency pinned to an exact version. See [the sandbox design](../docs/design/sandboxes.md) for guarantees and limitations.
+
 ## Local project workflow
 
-Install `@nylorun/cli` (generated projects already include it). Use `npm run configure`, then `nylorun dev` in a generated project. It loads the exported `agents` registry from `agents/index.ts`, starts this Runtime in a separate process, registers manifests, connects scoped SDK executors, and opens Studio. Use `--no-studio` or `--no-open` as needed. Runtime binds loopback on port 8787 (`PORT` override). The CLI creates separate server and executor credentials with mode 0600 in `.nylorun/local-credentials.json`; SQLite defaults to `.nylorun/runtime.sqlite`.
+Install `@nylorun/cli` (generated projects already include it). Use `nylorun up` and `nylorun dev` in a generated project. It loads the exported `agents` registry from `agents/index.ts`, starts this Runtime in a separate process, and, when no host model credential is stored, prompts in an interactive terminal and writes it to the vault. It then registers manifests, connects scoped SDK executors, and opens Studio. Use `--no-studio` or `--no-open` as needed. Runtime binds loopback on port 8787 (`PORT` override). The CLI creates separate server and executor credentials with mode 0600 in `.nylorun/local-credentials.json`; SQLite defaults to `.nylorun/runtime.sqlite`.
 
-`nylorun start [entry]` loads `dist/agents/index.js` by default and runs without Studio/watch. `nylorun studio --runtime-url http://127.0.0.1:8787` attaches using the project's local server credential (or `NYLORUN_SERVER_KEY`). Provider selection uses the existing `MODEL_PROVIDER`, `MODEL`, `MODEL_PROVIDER_API_KEY`, and optional `MODEL_PROVIDER_BASE_URL` configuration. No provider request occurs during configuration.
+`nylorun serve [entry]` loads `dist/agents/index.js` by default and runs without Studio/watch, attaching to the Runtime that `nylorun up` started. It uses the same first-start prompt. `nylorun configure` replaces the host credential against a Runtime that is already listening. `nylorun studio` attaches using the project's local server credential (or `NYLORUN_SERVER_KEY`). Studio can replace an API-key credential. If `MODEL_PROVIDER`, `MODEL`, and `MODEL_PROVIDER_API_KEY` are already set, the first start seeds the vault from them and does not prompt. Existing `.env` model settings and `.nylorun/auth.json` are imported once the same way. No provider request occurs during that setup. `NYLORUN_DEV_MODEL=fixture` and `NYLORUN_MODEL_GATEWAY_URL` remain separate from the vault.
 
-Definitions have no `agent.run()`; applications use `@nylorun/agents`. Remove old Hono `src/index.ts`, `Runtime`, `serveAgents`, and `openSession` usage from supported starters. Historical implementations remain internal for regression coverage and advanced examples; they are not root exports or supported hosting alternatives.
+Definitions have no `agent.run()`; applications use `@nylorun/agents`. The previous in-process host (`Runtime`, `serveAgents`, `openSession`, `httpModel`, `localSessions`, and the AG-UI route) has been removed; remove any remaining usage from applications.
 
-Source changes restart the local stack. Start a new session after definition or implementation edits; live upgrades are deferred. `GET /v1/agents` and `GET /v1/sessions?agentId=...` are server-authenticated local discovery conveniences. See the repository handoff for verification and remaining scope.
+Source changes restart the local stack. Start a new session after definition or implementation edits; live upgrades are deferred. `GET /v1/agents` and `GET /v1/sessions?agentId=...` are server-authenticated local discovery conveniences.

package/dist/adapters/sandbox/microsandbox.d.ts

@@ -0,0 +1,2 @@
+import type { SandboxBackend } from "../../sandbox/types.js";
+export declare function microsandboxBackend(): SandboxBackend;

package/dist/adapters/sandbox/microsandbox.js

@@ -0,0 +1,238 @@
+/** microsandbox backend: a hardware-isolated microVM per sandbox (libkrun). */
+import { accessSync, constants, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
+/** Releases that are known not to work; the probe refuses them and selection falls back. */
+const KNOWN_BAD_VERSIONS = new Set(["0.7.0"]);
+/** Keep at most this much of each output stream in memory while a command runs. */
+const CAPTURE_LIMIT = 4 * 1024 * 1024;
+const require = createRequire(import.meta.url);
+/** The package's exports map hides package.json, so walk up from its entry point. */
+function installedVersion() {
+    try {
+        let directory = dirname(require.resolve("microsandbox"));
+        for (let depth = 0; depth < 4; depth += 1, directory = dirname(directory)) {
+            try {
+                const manifest = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
+                if (manifest.name === "microsandbox")
+                    return manifest.version;
+            }
+            catch { }
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function platformReason() {
+    if (process.platform === "darwin")
+        return process.arch === "arm64" ? undefined : "requires Apple Silicon on macOS";
+    if (process.platform === "linux") {
+        try {
+            accessSync("/dev/kvm", constants.R_OK | constants.W_OK);
+            return undefined;
+        }
+        catch {
+            return "no usable /dev/kvm (enable KVM or nested virtualisation)";
+        }
+    }
+    if (process.platform === "win32")
+        return "not yet enabled on Windows";
+    return `unsupported platform ${process.platform}`;
+}
+export function microsandboxBackend() {
+    let sdk;
+    const load = () => (sdk ??= import("microsandbox"));
+    const handleFor = (sandbox) => ({
+        async exec(request, signal) {
+            const execution = await sandbox.execStreamWith("bash", (options) => options
+                .args(["-c", request.command])
+                .cwd(request.cwd)
+                .envs({ LANG: "C.UTF-8", TERM: "dumb" })
+                .stdinNull());
+            const stdout = new Capture();
+            const stderr = new Capture();
+            let killed = false;
+            let timedOut = false;
+            const kill = () => {
+                if (killed)
+                    return;
+                killed = true;
+                void execution.kill().catch(() => undefined);
+            };
+            const timer = setTimeout(() => {
+                timedOut = true;
+                kill();
+            }, request.timeoutMs);
+            const onAbort = () => kill();
+            signal.addEventListener("abort", onAbort, { once: true });
+            if (signal.aborted)
+                kill();
+            let exitCode = -1;
+            try {
+                for await (const event of execution) {
+                    if (event.kind === "stdout")
+                        stdout.push(event.data);
+                    else if (event.kind === "stderr")
+                        stderr.push(event.data);
+                    else if (event.kind === "exited") {
+                        exitCode = event.code;
+                        break;
+                    }
+                }
+            }
+            finally {
+                clearTimeout(timer);
+                signal.removeEventListener("abort", onAbort);
+            }
+            return {
+                exitCode: killed && exitCode < 0 ? (timedOut ? 124 : 130) : exitCode,
+                stdout: stdout.text(),
+                stderr: stderr.text(),
+                killed,
+                timedOut,
+            };
+        },
+        async readFile(path) {
+            const fs = sandbox.fs();
+            if (!(await fs.exists(path)))
+                return undefined;
+            return fs.readToString(path);
+        },
+        async writeFile(path, content) {
+            await sandbox.fs().write(path, content);
+        },
+        async stop() {
+            await sandbox.stop();
+        },
+    });
+    return {
+        name: "microsandbox",
+        isolation: "vm",
+        async probe() {
+            const base = { name: "microsandbox", isolation: "vm" };
+            const version = installedVersion();
+            const platform = platformReason();
+            if (platform)
+                return { ...base, available: false, reason: platform, ...(version ? { version } : {}) };
+            if (!version)
+                return {
+                    ...base,
+                    available: false,
+                    reason: "the optional microsandbox package is not installed (reinstall with optional dependencies enabled)",
+                };
+            if (KNOWN_BAD_VERSIONS.has(version))
+                return { ...base, available: false, version, reason: `microsandbox ${version} is a known-bad release` };
+            try {
+                const msb = await load();
+                if (!(await msb.isRuntimeInstalled()))
+                    return { ...base, available: false, version, reason: "the microsandbox runtime (msb, libkrunfw) is not installed" };
+            }
+            catch (error) {
+                return {
+                    ...base,
+                    available: false,
+                    version,
+                    reason: `could not load microsandbox: ${error instanceof Error ? error.message : String(error)}`,
+                };
+            }
+            return { ...base, available: true, version, reason: "hardware-isolated microVM" };
+        },
+        unmet() {
+            return undefined;
+        },
+        async open(spec) {
+            const msb = await load();
+            const { Sandbox, SandboxNotFoundError } = msb;
+            try {
+                const existing = await Sandbox.get(spec.key);
+                return handleFor(await existing.connectOrStart());
+            }
+            catch (error) {
+                if (!(error instanceof SandboxNotFoundError))
+                    throw error;
+            }
+            const sandbox = await Sandbox.builder(spec.key)
+                .image(spec.image)
+                .cpus(spec.cpus)
+                .memory(spec.memoryMiB)
+                .patch((patch) => patch.mkdir(SANDBOX_WORKSPACE, { mode: 0o755 }))
+                .workdir(SANDBOX_WORKSPACE)
+                .label("nylorun", "sandbox")
+                .network((network) => network.policy(policyFor(msb, spec)))
+                .create();
+            return handleFor(sandbox);
+        },
+        async remove(key) {
+            const { Sandbox, SandboxNotFoundError } = await load();
+            try {
+                const handle = await Sandbox.get(key);
+                await handle.destroy({ force: true });
+            }
+            catch (error) {
+                if (!(error instanceof SandboxNotFoundError))
+                    throw error;
+            }
+        },
+        async list(prefix) {
+            const { Sandbox } = await load();
+            const keys = [];
+            let page = await Sandbox.list();
+            for (;;) {
+                for (const handle of page.sandboxes)
+                    if (handle.name.startsWith(prefix))
+                        keys.push(handle.name);
+                if (!page.nextCursor)
+                    break;
+                const cursor = page.nextCursor;
+                page = await Sandbox.listWith((list) => list.cursor(cursor));
+            }
+            return keys;
+        },
+    };
+}
+/** Deny by default. Private, loopback, link-local, metadata and host ranges are always denied. */
+function policyFor(msb, spec) {
+    const { Destination, Rule } = msb;
+    const always = ["private", "loopback", "link-local", "metadata", "multicast"];
+    // The host is denied for TCP only: its resolver answers DNS for the sandbox and filters
+    // names by this same policy, so a UDP deny would break every allowed host.
+    const host = {
+        direction: "egress",
+        destination: Destination.group("host"),
+        protocols: ["tcp"],
+        ports: [],
+        action: "deny",
+    };
+    return {
+        defaultEgress: "deny",
+        defaultIngress: "deny",
+        rules: [
+            ...always.map((group) => Rule.denyEgress(Destination.group(group))),
+            host,
+            ...(spec.network.preset === "open" ? [Rule.allowEgress(Destination.group("public"))] : []),
+            ...spec.network.hosts.map((host) => Rule.allowEgress(Destination.domain(host))),
+            ...spec.network.suffixes.map((suffix) => Rule.allowEgress(Destination.domainSuffix(suffix))),
+        ],
+    };
+}
+class Capture {
+    chunks = [];
+    size = 0;
+    dropped = 0;
+    push(data) {
+        const chunk = typeof data === "string" ? Buffer.from(data) : Buffer.from(data);
+        if (this.size >= CAPTURE_LIMIT) {
+            this.dropped += chunk.length;
+            return;
+        }
+        this.chunks.push(chunk);
+        this.size += chunk.length;
+    }
+    text() {
+        const text = Buffer.concat(this.chunks).toString("utf8");
+        return this.dropped > 0 ? `${text}\n… [${this.dropped} bytes not captured]` : text;
+    }
+}

package/dist/adapters/sandbox/virtual.d.ts

@@ -0,0 +1,4 @@
+import type { SandboxBackend } from "../../sandbox/types.js";
+export declare function virtualBackend(options: {
+    readonly root: string;
+}): SandboxBackend;

package/dist/adapters/sandbox/virtual.js

@@ -0,0 +1,125 @@
+/**
+ * Virtual backend: an emulated bash with a virtual filesystem, running in the Runtime process.
+ * `/workspace` is backed by a host directory so files survive stop and Runtime restarts.
+ * It is not a VM boundary; it exists so the first run and CI work on any machine.
+ */
+import { mkdirSync, readdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
+const ENV = Object.freeze({
+    PATH: "/usr/local/bin:/usr/bin:/bin",
+    HOME: SANDBOX_WORKSPACE,
+    LANG: "C.UTF-8",
+    TERM: "dumb",
+});
+const METHODS = ["GET", "HEAD", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"];
+export function virtualBackend(options) {
+    let sdk;
+    const load = () => (sdk ??= import("just-bash"));
+    const directory = (key) => join(options.root, key, "workspace");
+    return {
+        name: "virtual",
+        isolation: "process",
+        async probe() {
+            const base = { name: "virtual", isolation: "process" };
+            try {
+                await load();
+                return { ...base, available: true, reason: "emulated shell in the Runtime process (not a VM)" };
+            }
+            catch (error) {
+                return {
+                    ...base,
+                    available: false,
+                    reason: `could not load just-bash: ${error instanceof Error ? error.message : String(error)}`,
+                };
+            }
+        },
+        unmet(spec) {
+            if (spec.network.suffixes.length > 0)
+                return "the virtual backend cannot allow wildcard hosts; list exact host names in network.allow or run with microsandbox";
+            return undefined;
+        },
+        async open(spec) {
+            const { Bash, InMemoryFs, MountableFs, ReadWriteFs } = await load();
+            const root = directory(spec.key);
+            mkdirSync(root, { recursive: true });
+            const base = new InMemoryFs();
+            await base.mkdir("/tmp", { recursive: true });
+            const fs = new MountableFs({
+                base,
+                mounts: [{ mountPoint: SANDBOX_WORKSPACE, filesystem: new ReadWriteFs({ root }) }],
+            });
+            const network = spec.network.preset === "open"
+                ? { dangerouslyAllowFullInternetAccess: true, denyPrivateRanges: true }
+                : spec.network.hosts.length > 0
+                    ? {
+                        allowedUrlPrefixes: spec.network.hosts.flatMap((host) => [`https://${host}`, `http://${host}`]),
+                        allowedMethods: [...METHODS],
+                        denyPrivateRanges: true,
+                    }
+                    : undefined;
+            const bash = new Bash({
+                fs,
+                cwd: SANDBOX_WORKSPACE,
+                env: { ...ENV },
+                python: true,
+                ...(network ? { network } : {}),
+            });
+            return {
+                async exec(request, signal) {
+                    const controller = new AbortController();
+                    let timedOut = false;
+                    const timer = setTimeout(() => {
+                        timedOut = true;
+                        controller.abort();
+                    }, request.timeoutMs);
+                    const onAbort = () => controller.abort();
+                    signal.addEventListener("abort", onAbort, { once: true });
+                    if (signal.aborted)
+                        controller.abort();
+                    try {
+                        const result = await bash.exec(request.command, {
+                            cwd: request.cwd,
+                            env: { ...ENV },
+                            replaceEnv: true,
+                            rawScript: true,
+                            signal: controller.signal,
+                        });
+                        const killed = controller.signal.aborted;
+                        return {
+                            exitCode: killed ? (timedOut ? 124 : 130) : result.exitCode,
+                            stdout: result.stdout,
+                            stderr: result.stderr,
+                            killed,
+                            timedOut,
+                        };
+                    }
+                    finally {
+                        clearTimeout(timer);
+                        signal.removeEventListener("abort", onAbort);
+                    }
+                },
+                async readFile(path) {
+                    if (!(await fs.exists(path)))
+                        return undefined;
+                    return fs.readFile(path, "utf8");
+                },
+                async writeFile(path, content) {
+                    await fs.writeFile(path, content, "utf8");
+                },
+                async stop() { },
+            };
+        },
+        async remove(key) {
+            rmSync(join(options.root, key), { recursive: true, force: true });
+        },
+        async list(prefix) {
+            try {
+                return readdirSync(options.root).filter((name) => name.startsWith(prefix));
+            }
+            catch {
+                return [];
+            }
+        },
+    };
+}

package/dist/configuration.d.ts

@@ -1,3 +1,3 @@
 export { modelsFor, type Selection } from "./model/models.js";
-export { modelSelection, projectSecrets } from "./model/settings.js";
+export { projectSecrets } from "./model/settings.js";
 export { ProjectCredentialStore } from "./model/auth-store.js";

package/dist/configuration.js

@@ -1,3 +1,3 @@
 export { modelsFor } from "./model/models.js";
-export { modelSelection, projectSecrets } from "./model/settings.js";
+export { projectSecrets } from "./model/settings.js";
 export { ProjectCredentialStore } from "./model/auth-store.js";

package/dist/core/executors.d.ts

@@ -0,0 +1,32 @@
+import type { ExecutorScope } from "@nylorun/core/contracts";
+/**
+ * Executor bearer tokens are 256-bit CSPRNG values minted by the CLI and the wire schema
+ * requires at least 16 characters, so an unsalted digest is adequate to keep them out of
+ * SQLite at rest. This is not a password KDF and must not be used for one.
+ */
+export declare const hashToken: (token: string) => string;
+export interface ExecutorRecord extends ExecutorScope {
+    readonly tokenHash: string;
+    /** False for scopes supplied through NYLORUN_EXECUTORS_JSON, which are never written to SQLite. */
+    readonly persisted: boolean;
+    readonly updatedAt: string;
+}
+export declare function assertExecutorCredential(executor: {
+    agentId: string;
+    implementationVersion: string;
+    token: string;
+}, serverToken: string): void;
+export declare class ExecutorRegistry {
+    private readonly byHash;
+    private readonly byAgent;
+    seed(records: readonly ExecutorRecord[]): void;
+    find(tokenHash: string): ExecutorRecord | undefined;
+    get(agentId: string): ExecutorRecord | undefined;
+    list(): readonly ExecutorRecord[];
+    upsert(record: ExecutorRecord): {
+        rotated: boolean;
+        previousHash?: string;
+    };
+    remove(agentId: string): ExecutorRecord | undefined;
+    private write;
+}

package/dist/core/executors.js

@@ -0,0 +1,60 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+const equals = (a, b) => {
+    const aa = Buffer.from(a), bb = Buffer.from(b);
+    return aa.length === bb.length && timingSafeEqual(aa, bb);
+};
+/**
+ * Executor bearer tokens are 256-bit CSPRNG values minted by the CLI and the wire schema
+ * requires at least 16 characters, so an unsalted digest is adequate to keep them out of
+ * SQLite at rest. This is not a password KDF and must not be used for one.
+ */
+export const hashToken = (token) => createHash("sha256").update(token, "utf8").digest("hex");
+export function assertExecutorCredential(executor, serverToken) {
+    if (executor.token.length < 16 ||
+        equals(executor.token, serverToken) ||
+        !executor.agentId ||
+        !executor.implementationVersion)
+        throw new Error("Executor tokens require independent credentials and an agent id");
+}
+export class ExecutorRegistry {
+    byHash = new Map();
+    byAgent = new Map();
+    seed(records) {
+        for (const record of records)
+            this.write(record);
+    }
+    find(tokenHash) {
+        return this.byHash.get(tokenHash);
+    }
+    get(agentId) {
+        return this.byAgent.get(agentId);
+    }
+    list() {
+        return [...this.byAgent.values()];
+    }
+    upsert(record) {
+        const previous = this.byAgent.get(record.agentId);
+        const collision = this.byHash.get(record.tokenHash);
+        if (collision && collision.agentId !== record.agentId)
+            throw new Error("Executor tokens must be unique");
+        this.write(record);
+        if (!previous || previous.tokenHash === record.tokenHash)
+            return { rotated: false };
+        return { rotated: true, previousHash: previous.tokenHash };
+    }
+    remove(agentId) {
+        const record = this.byAgent.get(agentId);
+        if (!record)
+            return undefined;
+        this.byAgent.delete(agentId);
+        this.byHash.delete(record.tokenHash);
+        return record;
+    }
+    write(record) {
+        const previous = this.byAgent.get(record.agentId);
+        if (previous)
+            this.byHash.delete(previous.tokenHash);
+        this.byAgent.set(record.agentId, record);
+        this.byHash.set(record.tokenHash, record);
+    }
+}

package/dist/core/main.js

@@ -1,21 +1,15 @@
-import { piModel } from "../model/pi-model.js";
 import { startRuntime } from "./runtime.js";
 import { gatewayModel, scriptedModel, toolFixtureModel } from "./provider.js";
 const serverToken = process.env.NYLORUN_SERVER_KEY;
 if (!serverToken)
     throw new Error("Set NYLORUN_SERVER_KEY (at least 16 characters)");
 const executors = JSON.parse(process.env.NYLORUN_EXECUTORS_JSON ?? "[]");
-const configured = piModel();
-const projectModel = (effect, signal) => configured(effect.input, {
-    request: effect.context.request,
-    invocationId: String(effect.context.invocationId),
-    signal,
-    reportPreparedCall() { },
-});
-const model = process.env.NYLORUN_DEV_MODEL === "fixture"
-    ? toolFixtureModel()
-    : process.env.NYLORUN_PROJECT_PROVIDER === "1"
-        ? projectModel
+const useHostModel = process.env.NYLORUN_DEV_MODEL !== "fixture" &&
+    process.env.NYLORUN_PROJECT_PROVIDER === "1";
+const model = useHostModel
+    ? undefined
+    : process.env.NYLORUN_DEV_MODEL === "fixture"
+        ? toolFixtureModel()
         : process.env.NYLORUN_MODEL_GATEWAY_URL
             ? gatewayModel({
                 url: process.env.NYLORUN_MODEL_GATEWAY_URL,
@@ -28,6 +22,7 @@ const runtime = await startRuntime({
     serverToken,
     executors,
     model,
+    useHostModel,
     port: Number(process.env.PORT ?? 8787),
     hostname: process.env.HOST ?? "127.0.0.1",
 });