@nylorun/runtime 0.7.0-beta → 0.8.0-beta

package/dist/sandbox/select.d.ts

@@ -0,0 +1,35 @@
+import type { SandboxBackend, SandboxBackendName, SandboxIsolation, SandboxProbe } from "./types.js";
+export type SandboxPreference = "auto" | SandboxBackendName;
+export interface SandboxSelection {
+    readonly preference: SandboxPreference;
+    readonly backend?: SandboxBackend;
+    /** Why this backend was chosen, or why none could be. */
+    readonly reason: string;
+    readonly probes: readonly SandboxProbe[];
+}
+/** Serializable view of a selection for the CLI and `GET /v1/host/sandbox`. */
+export interface SandboxSelectionReport {
+    readonly preference: SandboxPreference;
+    readonly backend: SandboxBackendName | null;
+    readonly isolation: SandboxIsolation | null;
+    readonly reason: string;
+    readonly probes: readonly SandboxProbe[];
+}
+/** The default order: strongest isolation first, then the backend that always works. */
+export declare function defaultSandboxBackends(options: {
+    readonly root: string;
+}): SandboxBackend[];
+export declare function parseSandboxPreference(value: string | undefined): SandboxPreference | undefined;
+/**
+ * Probe backends in order and pick one. An explicit preference never falls back, so a
+ * production Runtime cannot silently run with weaker isolation than it was configured for.
+ */
+export declare function selectSandboxBackend(backends: readonly SandboxBackend[], preference: SandboxPreference): Promise<SandboxSelection>;
+export declare function reportSelection(selection: SandboxSelection): SandboxSelectionReport;
+/**
+ * Probe this machine the way a Runtime would at startup. Used by `nylorun doctor sandbox`.
+ * Nothing is created or booted.
+ */
+export declare function probeSandboxBackends(options?: {
+    readonly preference?: string;
+}): Promise<SandboxSelectionReport>;

package/dist/sandbox/select.js

@@ -0,0 +1,76 @@
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { microsandboxBackend } from "../adapters/sandbox/microsandbox.js";
+import { virtualBackend } from "../adapters/sandbox/virtual.js";
+const PREFERENCES = ["auto", "microsandbox", "virtual"];
+/** The default order: strongest isolation first, then the backend that always works. */
+export function defaultSandboxBackends(options) {
+    return [microsandboxBackend(), virtualBackend({ root: options.root })];
+}
+export function parseSandboxPreference(value) {
+    const normalized = (value ?? "auto").trim().toLowerCase() || "auto";
+    return PREFERENCES.includes(normalized)
+        ? normalized
+        : undefined;
+}
+/**
+ * Probe backends in order and pick one. An explicit preference never falls back, so a
+ * production Runtime cannot silently run with weaker isolation than it was configured for.
+ */
+export async function selectSandboxBackend(backends, preference) {
+    const probes = [];
+    for (const backend of backends)
+        probes.push(await backend.probe());
+    const probeOf = (name) => probes.find((probe) => probe.name === name);
+    if (preference !== "auto") {
+        const backend = backends.find((item) => item.name === preference);
+        const probe = probeOf(preference);
+        if (backend && probe?.available)
+            return { preference, backend, reason: `${preference} selected by NYLORUN_SANDBOX`, probes };
+        return {
+            preference,
+            reason: `NYLORUN_SANDBOX=${preference} but ${preference} is unavailable: ${probe?.reason ?? "unknown backend"}. Fix it, or unset NYLORUN_SANDBOX to use the best available backend`,
+            probes,
+        };
+    }
+    const index = backends.findIndex((_, i) => probes[i].available);
+    if (index < 0)
+        return {
+            preference,
+            reason: `no sandbox backend is available (${probes.map((probe) => `${probe.name}: ${probe.reason}`).join("; ")})`,
+            probes,
+        };
+    const skipped = probes.slice(0, index).map((probe) => `${probe.name} unavailable: ${probe.reason}`);
+    return {
+        preference,
+        backend: backends[index],
+        reason: skipped.length ? skipped.join("; ") : probes[index].reason ?? backends[index].name,
+        probes,
+    };
+}
+export function reportSelection(selection) {
+    return {
+        preference: selection.preference,
+        backend: selection.backend?.name ?? null,
+        isolation: selection.backend?.isolation ?? null,
+        reason: selection.reason,
+        probes: selection.probes,
+    };
+}
+/**
+ * Probe this machine the way a Runtime would at startup. Used by `nylorun doctor sandbox`.
+ * Nothing is created or booted.
+ */
+export async function probeSandboxBackends(options = {}) {
+    const preference = parseSandboxPreference(options.preference ?? process.env.NYLORUN_SANDBOX);
+    const backends = defaultSandboxBackends({ root: join(tmpdir(), "nylorun-sandbox-probe") });
+    if (!preference)
+        return {
+            preference: "auto",
+            backend: null,
+            isolation: null,
+            reason: "NYLORUN_SANDBOX must be auto, microsandbox or virtual",
+            probes: await Promise.all(backends.map((backend) => backend.probe())),
+        };
+    return reportSelection(await selectSandboxBackend(backends, preference));
+}

package/dist/sandbox/tools.d.ts

@@ -0,0 +1,25 @@
+import { type SandboxToolName } from "@nylorun/core/define";
+import type { SandboxHandle } from "./types.js";
+export type SandboxToolOutcome = {
+    readonly kind: "completed";
+    readonly output: unknown;
+} | {
+    readonly kind: "failed";
+    readonly code: string;
+    readonly message: string;
+};
+/** What the Runtime reports about a tool call on the session stream. */
+export interface SandboxToolReport {
+    readonly command?: string;
+    readonly path?: string;
+    readonly exitCode?: number;
+    readonly killed?: boolean;
+}
+export declare function quote(value: string): string;
+export declare function resolvePath(path: string): string;
+/** Keep the head and tail of long output so the model sees both the start and the error. */
+export declare function truncateMiddle(value: string, limit?: number): {
+    text: string;
+    truncated: boolean;
+};
+export declare function runSandboxTool(handle: SandboxHandle, name: SandboxToolName, input: Record<string, any>, signal: AbortSignal, report: (value: SandboxToolReport) => void): Promise<SandboxToolOutcome>;

package/dist/sandbox/tools.js

@@ -0,0 +1,165 @@
+/**
+ * The six built-in sandbox tools, implemented once over `SandboxHandle` so every backend behaves
+ * the same. Expected problems are returned as failed outcomes; only infrastructure errors throw.
+ */
+import { posix } from "node:path";
+import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
+const OUTPUT_LIMIT = 30_000;
+const DEFAULT_TIMEOUT_S = 120;
+const DEFAULT_READ_LINES = 2000;
+const LINE_LIMIT = 2000;
+const DEFAULT_GREP_RESULTS = 200;
+const GLOB_LIMIT = 500;
+const GLOB_SCAN_LIMIT = 20_000;
+export function quote(value) {
+    return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+export function resolvePath(path) {
+    return posix.normalize(path.startsWith("/") ? path : posix.join(SANDBOX_WORKSPACE, path));
+}
+/** Keep the head and tail of long output so the model sees both the start and the error. */
+export function truncateMiddle(value, limit = OUTPUT_LIMIT) {
+    if (value.length <= limit)
+        return { text: value, truncated: false };
+    const half = Math.floor(limit / 2);
+    const omitted = value.length - half * 2;
+    return {
+        text: `${value.slice(0, half)}\n… [${omitted} characters omitted] …\n${value.slice(-half)}`,
+        truncated: true,
+    };
+}
+const failed = (code, message) => ({
+    kind: "failed",
+    code,
+    message,
+});
+export async function runSandboxTool(handle, name, input, signal, report) {
+    const exec = (command, timeoutMs = 60_000) => handle.exec({ command, cwd: SANDBOX_WORKSPACE, timeoutMs }, signal);
+    switch (name) {
+        case "bash": {
+            const command = String(input.command);
+            const timeout = (input.timeout ?? DEFAULT_TIMEOUT_S) * 1000;
+            const result = await exec(command, timeout);
+            report({ command, exitCode: result.exitCode, killed: result.killed });
+            const stdout = truncateMiddle(result.stdout);
+            const stderr = truncateMiddle(result.stderr);
+            return {
+                kind: "completed",
+                output: {
+                    exitCode: result.exitCode,
+                    stdout: stdout.text,
+                    stderr: result.timedOut
+                        ? `${stderr.text}${stderr.text && !stderr.text.endsWith("\n") ? "\n" : ""}Command timed out after ${timeout / 1000}s and was killed.`
+                        : stderr.text,
+                    ...(stdout.truncated || stderr.truncated ? { truncated: true } : {}),
+                    ...(result.timedOut ? { timedOut: true } : {}),
+                },
+            };
+        }
+        case "read": {
+            const path = resolvePath(String(input.path));
+            report({ path });
+            const content = await handle.readFile(path);
+            if (content === undefined)
+                return failed("sandbox.not_found", `No file at ${path}`);
+            const lines = content.split("\n");
+            if (lines.at(-1) === "")
+                lines.pop();
+            const start = (input.offset ?? 1) - 1;
+            const limit = input.limit ?? DEFAULT_READ_LINES;
+            const slice = lines.slice(start, start + limit);
+            const width = String(start + slice.length).length;
+            const text = slice
+                .map((line, index) => {
+                const clipped = line.length > LINE_LIMIT ? `${line.slice(0, LINE_LIMIT)}…` : line;
+                return `${String(start + index + 1).padStart(width, " ")}\t${clipped}`;
+            })
+                .join("\n");
+            const remaining = lines.length - (start + slice.length);
+            return {
+                kind: "completed",
+                output: lines.length === 0
+                    ? `${path} is empty.`
+                    : remaining > 0
+                        ? `${text}\n… ${remaining} more line(s); read again with offset ${start + slice.length + 1}.`
+                        : text,
+            };
+        }
+        case "write": {
+            const path = resolvePath(String(input.path));
+            const content = String(input.content);
+            report({ path });
+            const parent = await exec(`mkdir -p ${quote(posix.dirname(path))}`);
+            if (parent.exitCode !== 0)
+                return failed("sandbox.write_failed", parent.stderr.trim() || `Could not create ${posix.dirname(path)}`);
+            await handle.writeFile(path, content);
+            return { kind: "completed", output: { path, bytes: Buffer.byteLength(content) } };
+        }
+        case "edit": {
+            const path = resolvePath(String(input.path));
+            report({ path });
+            const content = await handle.readFile(path);
+            if (content === undefined)
+                return failed("sandbox.not_found", `No file at ${path}`);
+            const oldString = String(input.old_string);
+            const newString = String(input.new_string);
+            if (oldString === newString)
+                return failed("sandbox.edit_noop", "old_string and new_string are identical");
+            const count = content.split(oldString).length - 1;
+            if (count === 0)
+                return failed("sandbox.edit_no_match", `old_string was not found in ${path}. Read the file and copy the text exactly.`);
+            if (count > 1 && input.replace_all !== true)
+                return failed("sandbox.edit_not_unique", `old_string appears ${count} times in ${path}. Add surrounding context to make it unique, or set replace_all.`);
+            await handle.writeFile(path, content.replaceAll(oldString, () => newString));
+            return { kind: "completed", output: { path, replacements: input.replace_all === true ? count : 1 } };
+        }
+        case "grep": {
+            const max = input.max_results ?? DEFAULT_GREP_RESULTS;
+            const target = input.path ? String(input.path) : ".";
+            const flags = ["-rnE", ...(input.ignore_case ? ["-i"] : [])];
+            const include = input.glob ? ` --include=${quote(String(input.glob))}` : "";
+            const command = `grep ${flags.join(" ")}${include} -e ${quote(String(input.pattern))} -- ${quote(target)} | head -n ${max + 1}`;
+            report({ command });
+            const result = await exec(command);
+            // The pipeline's exit code is head's, so a grep error shows up as stderr with no matches.
+            const lines = result.stdout.split("\n").filter(Boolean);
+            if (lines.length === 0)
+                return result.stderr.trim()
+                    ? failed("sandbox.grep_failed", result.stderr.trim())
+                    : { kind: "completed", output: "No matches." };
+            const shown = lines.slice(0, max).map((line) => (line.length > LINE_LIMIT ? `${line.slice(0, LINE_LIMIT)}…` : line));
+            return {
+                kind: "completed",
+                output: lines.length > max ? `${shown.join("\n")}\n… more matches omitted; narrow the search.` : shown.join("\n"),
+            };
+        }
+        case "glob": {
+            const root = resolvePath(input.path ? String(input.path) : ".");
+            const pattern = String(input.pattern);
+            const command = `find ${quote(root)} -type f -not -path '*/.git/*' 2>/dev/null | head -n ${GLOB_SCAN_LIMIT}`;
+            report({ command });
+            const result = await exec(command);
+            const byBasename = !pattern.includes("/");
+            const matches = [];
+            for (const file of result.stdout.split("\n")) {
+                if (!file)
+                    continue;
+                const relative = posix.relative(root, file);
+                if (posix.matchesGlob(byBasename ? posix.basename(relative) : relative, pattern)) {
+                    matches.push(file);
+                    if (matches.length > GLOB_LIMIT)
+                        break;
+                }
+            }
+            if (matches.length === 0)
+                return { kind: "completed", output: "No files matched." };
+            matches.sort();
+            return {
+                kind: "completed",
+                output: matches.length > GLOB_LIMIT
+                    ? `${matches.slice(0, GLOB_LIMIT).join("\n")}\n… more files omitted; narrow the pattern.`
+                    : matches.join("\n"),
+            };
+        }
+    }
+}

package/dist/sandbox/types.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Backend contract for Runtime-owned sandboxes. Only files under `adapters/sandbox/` implement it
+ * and import a substrate SDK; everything else in the Runtime talks to this interface.
+ */
+import type { SandboxNetworkPreset } from "@nylorun/core/define";
+export type SandboxBackendName = "microsandbox" | "virtual";
+export type SandboxIsolation = "vm" | "process";
+export interface SandboxProbe {
+    readonly name: SandboxBackendName;
+    readonly available: boolean;
+    readonly isolation: SandboxIsolation;
+    /** Why the backend is unavailable, or a short description when it is. */
+    readonly reason?: string;
+    readonly version?: string;
+}
+/** Egress policy after presets are expanded. Always-blocked ranges are the backend's job. */
+export interface ResolvedNetwork {
+    readonly preset: SandboxNetworkPreset;
+    /** Exact host names allowed over HTTPS/HTTP. */
+    readonly hosts: readonly string[];
+    /** Domain suffixes such as ".pythonhosted.org", from "*.pythonhosted.org". */
+    readonly suffixes: readonly string[];
+}
+export interface SandboxSpec {
+    /** Stable backend name for this sandbox; unique per Runtime scope and session. */
+    readonly key: string;
+    readonly image: string;
+    readonly cpus: number;
+    readonly memoryMiB: number;
+    readonly network: ResolvedNetwork;
+}
+export interface ExecRequest {
+    readonly command: string;
+    readonly cwd: string;
+    readonly timeoutMs: number;
+}
+export interface ExecResult {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+    /** The process was actually stopped (timeout or cancellation). */
+    readonly killed: boolean;
+    readonly timedOut: boolean;
+}
+export interface SandboxHandle {
+    exec(request: ExecRequest, signal: AbortSignal): Promise<ExecResult>;
+    /** Returns undefined when the file does not exist. */
+    readFile(path: string): Promise<string | undefined>;
+    /** Parent directories must already exist. */
+    writeFile(path: string, content: string): Promise<void>;
+    /** Release compute; files persist. */
+    stop(): Promise<void>;
+}
+export interface SandboxBackend {
+    readonly name: SandboxBackendName;
+    readonly isolation: SandboxIsolation;
+    probe(): Promise<SandboxProbe>;
+    /** A reason this backend cannot meet the spec, or undefined when it can. */
+    unmet(spec: SandboxSpec): string | undefined;
+    /** Reattach to an existing sandbox (starting it if stopped) or create a new one. */
+    open(spec: SandboxSpec): Promise<SandboxHandle>;
+    /** Delete compute and files. Missing sandboxes are ignored. */
+    remove(key: string): Promise<void>;
+    /** Keys of sandboxes this backend holds whose key starts with the prefix. */
+    list(prefix: string): Promise<readonly string[]>;
+}

package/dist/vault/service.d.ts

@@ -1,5 +1,20 @@
 import type { DatabaseSync } from "node:sqlite";
-import type { CreateCredentialRequest, CreateVaultRequest, CredentialInfo, CredentialSelection, RotateCredentialRequest, VaultInfo } from "@nylorun/core/contracts";
+import type { CreateCredentialRequest, CreateVaultRequest, CredentialInfo, CredentialSelection, HostModelProviderInfo, HostModelView, PutHostModelRequest, RotateCredentialRequest, SelectHostModelRequest, VaultInfo } from "@nylorun/core/contracts";
+export type HostModelSecret = {
+    provider: string;
+    model: string;
+    baseUrl?: string;
+    authType: "api_key" | "oauth";
+    credential: {
+        type: "api_key" | "oauth";
+        key?: string;
+        env?: Record<string, string>;
+        refresh?: string;
+        access?: string;
+        expires?: number;
+        [key: string]: unknown;
+    };
+};
 export type AuthorizeResult = {
     status: "unauthenticated";
     url: string;
@@ -44,6 +59,21 @@ export declare class VaultService {
         url: string;
         serverName?: string;
     }): Promise<AuthorizeResult>;
+    getHostModel(): HostModelView;
+    listHostProviders(): {
+        providers: HostModelProviderInfo[];
+    };
+    putHostModel(body: PutHostModelRequest): HostModelView;
+    selectHostModel(body: SelectHostModelRequest): HostModelView;
+    readHostModel(): HostModelSecret | undefined;
+    updateHostCredential(credential: {
+        type: "api_key" | "oauth";
+        key?: string;
+        env?: Record<string, string>;
+        refresh?: string;
+        access?: string;
+        expires?: number;
+    }): void;
     reject(route: string): void;
     private refresh;
     private replay;
@@ -52,6 +82,16 @@ export declare class VaultService {
     private readPayload;
     private vaultInfo;
     private vaultRow;
+    private ensureHostVault;
+    private validateHostModel;
+    private insertHostCredential;
+    private readHostPayload;
+    private hostModelRows;
+    private hostCredentialRowFor;
+    private activeHostCredentialRow;
+    private activeProviderId;
+    private setActiveProvider;
+    private deleteHostProviderRows;
     private credentialInfo;
     private credentialRow;
     private rowsForVault;