@nylorun/runtime 0.6.0-beta → 0.8.0-beta

package/dist/core/store.d.ts

@@ -1,6 +1,14 @@
 import { DatabaseSync } from "node:sqlite";
 import type { LiveEvent } from "@nylorun/core/contracts";
 export declare function canonical(value: unknown): string;
+export interface ExecutorRow {
+    agentId: string;
+    tokenHash: string;
+    implementationVersion: string;
+    manifestHash?: string;
+    createdAt: string;
+    updatedAt: string;
+}
 export declare class Store {
     readonly db: DatabaseSync;
     constructor(path: string);
@@ -8,7 +16,12 @@ export declare class Store {
     get<T = any>(table: string, id: string): T | undefined;
     all<T = any>(table: string): T[];
     put(table: string, id: string, body: unknown): void;
+    delete(table: string, id: string): void;
+    allExecutors(): ExecutorRow[];
+    putExecutor(row: Omit<ExecutorRow, "createdAt">): void;
+    deleteExecutor(agentId: string): void;
     event(sessionId: string, turnId: string | null, type: string, payload: unknown): LiveEvent;
+    credentialCount(): number;
     history(sessionId: string, cursor?: string): {
         items: LiveEvent[];
         cursor: string | null;

package/dist/core/store.js

@@ -25,8 +25,58 @@ export class Store {
       CREATE TABLE IF NOT EXISTS checkpoints(id TEXT PRIMARY KEY, body TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS effects(id TEXT PRIMARY KEY, body TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS actions(id TEXT PRIMARY KEY, body TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS sandboxes(id TEXT PRIMARY KEY, body TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS events(sequence INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, body TEXT NOT NULL);
-      CREATE INDEX IF NOT EXISTS events_session ON events(session_id, sequence);`);
+      CREATE INDEX IF NOT EXISTS events_session ON events(session_id, sequence);
+      CREATE TABLE IF NOT EXISTS vaults(
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        owner_user_id TEXT NOT NULL,
+        metadata_json TEXT,
+        created_at TEXT NOT NULL,
+        scope TEXT NOT NULL DEFAULT 'user'
+      );
+      CREATE INDEX IF NOT EXISTS vaults_owner ON vaults(owner_user_id);
+      CREATE TABLE IF NOT EXISTS vault_credentials(
+        id TEXT PRIMARY KEY,
+        vault_id TEXT NOT NULL REFERENCES vaults(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        type TEXT NOT NULL,
+        binding_json TEXT NOT NULL,
+        expires_at TEXT,
+        created_at TEXT NOT NULL,
+        rotated_at TEXT,
+        kek_id TEXT NOT NULL,
+        nonce BLOB NOT NULL,
+        ciphertext BLOB NOT NULL,
+        wrapped_dek BLOB NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS vault_credentials_vault ON vault_credentials(vault_id);
+      CREATE TABLE IF NOT EXISTS vault_audit(
+        id TEXT PRIMARY KEY,
+        at TEXT NOT NULL,
+        actor TEXT NOT NULL,
+        action TEXT NOT NULL,
+        vault_id TEXT,
+        credential_id TEXT,
+        session_id TEXT,
+        target TEXT,
+        outcome TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS vault_idempotency(
+        id TEXT PRIMARY KEY,
+        body_hash TEXT NOT NULL,
+        response TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS executors(
+        agent_id TEXT PRIMARY KEY,
+        token_hash TEXT NOT NULL UNIQUE,
+        implementation_version TEXT NOT NULL,
+        manifest_hash TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );`);
+        migrateVaultScope(this.db);
     }
     tx(fn) {
         this.db.exec("BEGIN IMMEDIATE");
@@ -55,6 +105,38 @@ export class Store {
             .prepare(`INSERT INTO ${table}(id,body) VALUES(?,?) ON CONFLICT(id) DO UPDATE SET body=excluded.body`)
             .run(id, JSON.stringify(body));
     }
+    delete(table, id) {
+        this.db.prepare(`DELETE FROM ${table} WHERE id=?`).run(id);
+    }
+    // Executors carry a bearer secret, so they use typed columns with a database-enforced unique
+    // token hash instead of flowing through the generic JSON document helpers above.
+    allExecutors() {
+        return this.db
+            .prepare("SELECT agent_id,token_hash,implementation_version,manifest_hash,created_at,updated_at FROM executors")
+            .all()
+            .map((r) => ({
+            agentId: String(r.agent_id),
+            tokenHash: String(r.token_hash),
+            implementationVersion: String(r.implementation_version),
+            manifestHash: r.manifest_hash == null ? undefined : String(r.manifest_hash),
+            createdAt: String(r.created_at),
+            updatedAt: String(r.updated_at),
+        }));
+    }
+    putExecutor(row) {
+        this.db
+            .prepare(`INSERT INTO executors(agent_id,token_hash,implementation_version,manifest_hash,created_at,updated_at)
+         VALUES(?,?,?,?,?,?)
+         ON CONFLICT(agent_id) DO UPDATE SET
+           token_hash=excluded.token_hash,
+           implementation_version=excluded.implementation_version,
+           manifest_hash=excluded.manifest_hash,
+           updated_at=excluded.updated_at`)
+            .run(row.agentId, row.tokenHash, row.implementationVersion, row.manifestHash ?? null, row.updatedAt, row.updatedAt);
+    }
+    deleteExecutor(agentId) {
+        this.db.prepare("DELETE FROM executors WHERE agent_id=?").run(agentId);
+    }
     event(sessionId, turnId, type, payload) {
         const base = {
             eventId: randomUUID(),
@@ -76,6 +158,12 @@ export class Store {
             .run(JSON.stringify(event), result.lastInsertRowid);
         return event;
     }
+    credentialCount() {
+        const row = this.db
+            .prepare("SELECT COUNT(*) AS n FROM vault_credentials")
+            .get();
+        return Number(row.n);
+    }
     history(sessionId, cursor) {
         let sequence = 0;
         if (cursor) {
@@ -99,3 +187,9 @@ export class Store {
         };
     }
 }
+function migrateVaultScope(db) {
+    const columns = db.prepare("PRAGMA table_info(vaults)").all();
+    if (!columns.some((column) => column.name === "scope"))
+        db.exec("ALTER TABLE vaults ADD COLUMN scope TEXT NOT NULL DEFAULT 'user'");
+    db.exec("CREATE UNIQUE INDEX IF NOT EXISTS vaults_one_host ON vaults(scope) WHERE scope = 'host'");
+}

package/dist/index.d.ts

@@ -1,6 +1,5 @@
 export { CoreRuntime, createRuntime, startRuntime, type RuntimeOptions } from "./core/runtime.js";
 export { scriptedModel, gatewayModel, type ModelProvider } from "./core/provider.js";
-export { httpModel, type HttpModelOptions, type ModelEnvironment } from "./model/http-model.js";
 export type { RuntimeAgent } from "./contracts.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes } from "./media.js";
 export type { RuntimeModelAdapter } from "./contracts.js";

package/dist/index.js

@@ -1,4 +1,3 @@
 export { CoreRuntime, createRuntime, startRuntime } from "./core/runtime.js";
 export { scriptedModel, gatewayModel } from "./core/provider.js";
-export { httpModel } from "./model/http-model.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes } from "./media.js";

package/dist/mcp/connect.d.ts

@@ -0,0 +1,31 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import type { McpServerManifest } from "@nylorun/core/define";
+import type { AuthorizeResult } from "../vault/service.js";
+import { type McpDiagnostic, type McpToolRecord } from "./snapshot.js";
+export interface LiveConnection {
+    readonly client: Client;
+    close(): Promise<void>;
+}
+export declare function openMcpServer(input: {
+    server: McpServerManifest;
+    authorize?: (url: string) => Promise<AuthorizeResult>;
+    pluginRoot?: string;
+    pluginData: string;
+}): Promise<LiveConnection>;
+export declare function listMcpTools(client: Client, input: {
+    capabilityId: string;
+    serverName: string;
+    taken: Set<string>;
+}): Promise<{
+    tools: McpToolRecord[];
+    omitted: string[];
+}>;
+export declare function callMcpTool(client: Client, serverToolName: string, args: unknown): Promise<{
+    kind: "completed";
+    output: unknown;
+} | {
+    kind: "failed";
+    code: string;
+    message: string;
+}>;
+export declare function diagnosticFromError(capabilityId: string, serverName: string, error: unknown): McpDiagnostic;

package/dist/mcp/connect.js

@@ -0,0 +1,190 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { schemaFromJSON } from "@nylorun/core/define";
+import { modelToolName, } from "./snapshot.js";
+import { prepareStdioLaunch } from "./stdio.js";
+export async function openMcpServer(input) {
+    if (input.server.type === "stdio") {
+        const launch = prepareStdioLaunch(input.server, {
+            pluginRoot: input.pluginRoot,
+            pluginData: input.pluginData,
+        });
+        const transport = new StdioClientTransport({
+            command: launch.command,
+            args: [...launch.args],
+            cwd: launch.cwd,
+            env: { ...launch.env },
+            stderr: "pipe",
+        });
+        transport.stderr?.on("data", () => { });
+        const client = createClient();
+        await client.connect(transport);
+        return { client, close: () => client.close() };
+    }
+    const authorize = input.authorize;
+    if (!authorize)
+        throw new Error("HTTP MCP server requires authorization");
+    const initial = await authorize(input.server.url);
+    if (initial.status === "refused") {
+        const error = new Error(`MCP authorization refused: ${initial.reason}`);
+        error.credentialIds =
+            initial.credentialIds;
+        throw error;
+    }
+    const fetchImpl = authorizedFetch(input.server, authorize);
+    const url = new URL(input.server.url);
+    const transport = input.server.type === "sse"
+        ? new SSEClientTransport(url, { fetch: fetchImpl })
+        : new StreamableHTTPClientTransport(url, { fetch: fetchImpl });
+    const client = createClient();
+    await client.connect(transport);
+    return { client, close: () => client.close() };
+}
+export async function listMcpTools(client, input) {
+    const tools = [];
+    const omitted = [];
+    let cursor;
+    for (let page = 0; page < 100; page += 1) {
+        const listed = await client.listTools(cursor ? { cursor } : undefined);
+        for (const tool of listed.tools) {
+            if (typeof tool.name !== "string" || tool.name.length === 0)
+                continue;
+            const name = modelToolName(input.serverName, tool.name);
+            const inputSchema = usableSchema(tool.inputSchema);
+            if (!inputSchema || input.taken.has(name)) {
+                omitted.push(name);
+                continue;
+            }
+            const outputSchema = tool.outputSchema
+                ? usableSchema(tool.outputSchema)
+                : undefined;
+            input.taken.add(name);
+            tools.push({
+                capabilityId: input.capabilityId,
+                serverName: input.serverName,
+                serverToolName: tool.name,
+                name,
+                ...(typeof tool.description === "string" && tool.description.length > 0
+                    ? { description: tool.description }
+                    : {}),
+                inputSchema,
+                ...(outputSchema === undefined ? {} : { outputSchema }),
+            });
+        }
+        cursor = listed.nextCursor;
+        if (!cursor)
+            break;
+    }
+    return { tools, omitted };
+}
+export async function callMcpTool(client, serverToolName, args) {
+    const result = await client.callTool({
+        name: serverToolName,
+        arguments: args && typeof args === "object" && !Array.isArray(args)
+            ? args
+            : {},
+    });
+    if ("isError" in result && result.isError) {
+        return {
+            kind: "failed",
+            code: "mcp.tool",
+            message: textContent(result.content) || "MCP tool failed",
+        };
+    }
+    if ("structuredContent" in result && result.structuredContent !== undefined)
+        return { kind: "completed", output: result.structuredContent };
+    const text = "content" in result ? textContent(result.content) : undefined;
+    if (text !== undefined)
+        return { kind: "completed", output: text };
+    return {
+        kind: "completed",
+        output: "content" in result ? result.content : result,
+    };
+}
+export function diagnosticFromError(capabilityId, serverName, error) {
+    const credentialIds = error && typeof error === "object" && "credentialIds" in error
+        ? error.credentialIds
+        : undefined;
+    const refused = error instanceof Error && error.message.startsWith("MCP authorization refused");
+    if (refused) {
+        return {
+            capabilityId,
+            serverName,
+            outcome: "refused",
+            message: error.message,
+            ...(credentialIds === undefined ? {} : { credentialIds }),
+        };
+    }
+    const code = error && typeof error === "object" && "code" in error
+        ? error.code
+        : undefined;
+    const unauthorized = code === 401 ||
+        (error instanceof Error && /\b401\b/.test(error.message));
+    return {
+        capabilityId,
+        serverName,
+        outcome: "failed",
+        message: unauthorized
+            ? "MCP server returned 401"
+            : error instanceof Error
+                ? error.message.slice(0, 500)
+                : "MCP server connection failed",
+    };
+}
+function createClient() {
+    return new Client({ name: "nylorun-runtime", version: "0.6.0" }, { capabilities: {} });
+}
+function authorizedFetch(server, authorize) {
+    return async (url, init) => {
+        const target = typeof url === "string" ? url : url.href;
+        if (!sameOrigin(target, server.url))
+            throw new Error("MCP request origin does not match the declared server");
+        const result = await authorize(server.url);
+        if (result.status === "refused") {
+            const error = new Error(`MCP authorization refused: ${result.reason}`);
+            error.credentialIds =
+                result.credentialIds;
+            throw error;
+        }
+        const headers = new Headers();
+        for (const [key, value] of Object.entries(server.headers ?? {}))
+            headers.set(key, value);
+        new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
+        if (result.status === "authorized")
+            headers.set("authorization", result.headers.authorization);
+        return fetch(target, { ...init, headers, redirect: "error" });
+    };
+}
+function sameOrigin(requestUrl, serverUrl) {
+    try {
+        return new URL(requestUrl).origin === new URL(serverUrl).origin;
+    }
+    catch {
+        return false;
+    }
+}
+function usableSchema(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const schema = JSON.parse(JSON.stringify(value));
+    try {
+        schemaFromJSON(schema);
+    }
+    catch {
+        return undefined;
+    }
+    return schema;
+}
+function textContent(content) {
+    if (!Array.isArray(content))
+        return undefined;
+    const text = content
+        .filter((part) => !!part &&
+        typeof part === "object" &&
+        part.type === "text" &&
+        typeof part.text === "string")
+        .map((part) => part.text);
+    return text.length === 0 ? undefined : text.join("\n");
+}

package/dist/mcp/pool.d.ts

@@ -0,0 +1,45 @@
+import type { AgentManifest } from "@nylorun/core/define";
+import type { AuthorizeResult } from "../vault/service.js";
+import { callMcpTool } from "./connect.js";
+import { type McpDiagnostic, type McpSnapshot, type McpToolRecord } from "./snapshot.js";
+export declare class McpPool {
+    private readonly options;
+    private readonly live;
+    constructor(options: {
+        readonly dataDir: string;
+        readonly authorize: (sessionId: string, request: {
+            url: string;
+            serverName: string;
+        }) => Promise<AuthorizeResult>;
+    });
+    discover(input: {
+        sessionId: string;
+        manifest: AgentManifest;
+        manifestHash: string;
+        pluginRoots: Readonly<Record<string, string>>;
+        signal?: AbortSignal;
+    }): Promise<{
+        snapshot: McpSnapshot;
+        diagnostics: McpDiagnostic[];
+    }>;
+    reconnect(input: {
+        sessionId: string;
+        manifest: AgentManifest;
+        pluginRoots: Readonly<Record<string, string>>;
+        tools: readonly McpToolRecord[];
+        signal?: AbortSignal;
+    }): Promise<McpDiagnostic[]>;
+    call(input: {
+        sessionId: string;
+        capabilityId: string;
+        serverName: string;
+        serverToolName: string;
+        args: unknown;
+        manifest: AgentManifest;
+        pluginRoots: Readonly<Record<string, string>>;
+    }): Promise<Awaited<ReturnType<typeof callMcpTool>>>;
+    close(): Promise<void>;
+    private remember;
+    private liveKey;
+    private connectDeclared;
+}

package/dist/mcp/pool.js

@@ -0,0 +1,143 @@
+import { join } from "node:path";
+import { callMcpTool, diagnosticFromError, listMcpTools, openMcpServer, } from "./connect.js";
+import { declaredToolNames, } from "./snapshot.js";
+export class McpPool {
+    options;
+    live = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    async discover(input) {
+        const taken = declaredToolNames(input.manifest);
+        const tools = [];
+        const diagnostics = [];
+        for (const declared of serversOf(input.manifest)) {
+            input.signal?.throwIfAborted();
+            const opened = await this.connectDeclared(input, declared);
+            if (!opened.ok) {
+                diagnostics.push(opened.diagnostic);
+                continue;
+            }
+            try {
+                const listed = await listMcpTools(opened.connection.client, {
+                    capabilityId: declared.capabilityId,
+                    serverName: declared.server.name,
+                    taken,
+                });
+                tools.push(...listed.tools);
+                diagnostics.push({
+                    capabilityId: declared.capabilityId,
+                    serverName: declared.server.name,
+                    outcome: "connected",
+                    message: listed.omitted.length === 0
+                        ? "Connected"
+                        : `Connected. Omitted ${listed.omitted.join(", ")}`,
+                });
+                this.remember(input.sessionId, declared, opened.connection);
+            }
+            catch (error) {
+                await opened.connection.close().catch(() => { });
+                diagnostics.push(diagnosticFromError(declared.capabilityId, declared.server.name, error));
+            }
+        }
+        return {
+            snapshot: {
+                snapshotSchemaVersion: 1,
+                manifestHash: input.manifestHash,
+                mcpTools: tools,
+            },
+            diagnostics,
+        };
+    }
+    async reconnect(input) {
+        const diagnostics = [];
+        const seen = new Set();
+        for (const tool of input.tools) {
+            const key = `${tool.capabilityId}\0${tool.serverName}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            if (this.live.has(this.liveKey(input.sessionId, tool.capabilityId, tool.serverName)))
+                continue;
+            input.signal?.throwIfAborted();
+            const declared = serversOf(input.manifest).find((item) => item.capabilityId === tool.capabilityId && item.server.name === tool.serverName);
+            if (!declared) {
+                diagnostics.push({
+                    capabilityId: tool.capabilityId,
+                    serverName: tool.serverName,
+                    outcome: "failed",
+                    message: "Declared MCP server is missing from the pinned manifest",
+                });
+                continue;
+            }
+            const opened = await this.connectDeclared(input, declared);
+            if (!opened.ok) {
+                diagnostics.push(opened.diagnostic);
+                continue;
+            }
+            this.remember(input.sessionId, declared, opened.connection);
+        }
+        return diagnostics;
+    }
+    async call(input) {
+        const key = this.liveKey(input.sessionId, input.capabilityId, input.serverName);
+        let live = this.live.get(key);
+        if (!live) {
+            const declared = serversOf(input.manifest).find((item) => item.capabilityId === input.capabilityId && item.server.name === input.serverName);
+            if (!declared)
+                throw new Error(`MCP server '${input.serverName}' is not declared`);
+            const opened = await this.connectDeclared(input, declared);
+            if (!opened.ok)
+                throw new Error(opened.diagnostic.message);
+            this.remember(input.sessionId, declared, opened.connection);
+            live = this.live.get(key);
+        }
+        if (!live)
+            throw new Error(`MCP server '${input.serverName}' is not connected`);
+        return callMcpTool(live.connection.client, input.serverToolName, input.args);
+    }
+    async close() {
+        const connections = [...this.live.values()];
+        this.live.clear();
+        await Promise.all(connections.map((item) => item.connection.close().catch(() => { })));
+    }
+    remember(sessionId, declared, connection) {
+        this.live.set(this.liveKey(sessionId, declared.capabilityId, declared.server.name), {
+            capabilityId: declared.capabilityId,
+            serverName: declared.server.name,
+            connection,
+        });
+    }
+    liveKey(sessionId, capabilityId, serverName) {
+        return JSON.stringify([sessionId, capabilityId, serverName]);
+    }
+    async connectDeclared(input, declared) {
+        try {
+            const connection = await openMcpServer({
+                server: declared.server,
+                pluginRoot: input.pluginRoots[declared.capabilityId],
+                pluginData: join(this.options.dataDir, "plugin-data", declared.capabilityId),
+                authorize: declared.server.type === "stdio"
+                    ? undefined
+                    : (url) => this.options.authorize(input.sessionId, {
+                        url,
+                        serverName: declared.server.name,
+                    }),
+            });
+            return { ok: true, connection };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                diagnostic: diagnosticFromError(declared.capabilityId, declared.server.name, error),
+            };
+        }
+    }
+}
+function serversOf(manifest) {
+    const servers = [];
+    for (const capability of manifest.capabilities)
+        for (const server of Object.values(capability.mcpServers ?? {}))
+            servers.push({ capabilityId: capability.id, server });
+    return servers;
+}

package/dist/mcp/snapshot.d.ts

@@ -0,0 +1,25 @@
+import type { JsonObject } from "@nylorun/core/define";
+import type { AgentManifest } from "@nylorun/core/define";
+export interface McpToolRecord {
+    readonly capabilityId: string;
+    readonly serverName: string;
+    readonly serverToolName: string;
+    readonly name: string;
+    readonly description?: string;
+    readonly inputSchema: JsonObject;
+    readonly outputSchema?: JsonObject;
+}
+export interface McpSnapshot {
+    readonly snapshotSchemaVersion: 1;
+    readonly manifestHash: string;
+    readonly mcpTools: readonly McpToolRecord[];
+}
+export interface McpDiagnostic {
+    readonly capabilityId: string;
+    readonly serverName: string;
+    readonly outcome: "connected" | "refused" | "failed";
+    readonly message: string;
+    readonly credentialIds?: readonly string[];
+}
+export declare function modelToolName(serverName: string, serverToolName: string): string;
+export declare function declaredToolNames(manifest: AgentManifest): Set<string>;

package/dist/mcp/snapshot.js

@@ -0,0 +1,10 @@
+export function modelToolName(serverName, serverToolName) {
+    return `${serverName}__${serverToolName}`;
+}
+export function declaredToolNames(manifest) {
+    const names = new Set();
+    for (const capability of manifest.capabilities)
+        for (const tool of capability.tools ?? [])
+            names.add(tool.name);
+    return names;
+}

package/dist/mcp/stdio.d.ts

@@ -0,0 +1,15 @@
+import type { McpServerManifest } from "@nylorun/core/define";
+/** Single-pass replacement. Text inserted for a token is not scanned again. */
+export declare function expandPluginPlaceholders(value: string, pluginRoot: string, pluginData: string): string;
+export interface StdioLaunch {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly cwd: string;
+    readonly env: Readonly<Record<string, string>>;
+}
+export declare function prepareStdioLaunch(server: Extract<McpServerManifest, {
+    type: "stdio";
+}>, options: {
+    readonly pluginRoot?: string;
+    readonly pluginData: string;
+}): StdioLaunch;