@nylorun/runtime 0.7.0-beta → 0.9.0-beta

package/dist/sandbox/tools.js

@@ -0,0 +1,165 @@
+/**
+ * The six built-in sandbox tools, implemented once over `SandboxHandle` so every backend behaves
+ * the same. Expected problems are returned as failed outcomes; only infrastructure errors throw.
+ */
+import { posix } from "node:path";
+import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
+const OUTPUT_LIMIT = 30_000;
+const DEFAULT_TIMEOUT_S = 120;
+const DEFAULT_READ_LINES = 2000;
+const LINE_LIMIT = 2000;
+const DEFAULT_GREP_RESULTS = 200;
+const GLOB_LIMIT = 500;
+const GLOB_SCAN_LIMIT = 20_000;
+export function quote(value) {
+    return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+export function resolvePath(path) {
+    return posix.normalize(path.startsWith("/") ? path : posix.join(SANDBOX_WORKSPACE, path));
+}
+/** Keep the head and tail of long output so the model sees both the start and the error. */
+export function truncateMiddle(value, limit = OUTPUT_LIMIT) {
+    if (value.length <= limit)
+        return { text: value, truncated: false };
+    const half = Math.floor(limit / 2);
+    const omitted = value.length - half * 2;
+    return {
+        text: `${value.slice(0, half)}\n… [${omitted} characters omitted] …\n${value.slice(-half)}`,
+        truncated: true,
+    };
+}
+const failed = (code, message) => ({
+    kind: "failed",
+    code,
+    message,
+});
+export async function runSandboxTool(handle, name, input, signal, report) {
+    const exec = (command, timeoutMs = 60_000) => handle.exec({ command, cwd: SANDBOX_WORKSPACE, timeoutMs }, signal);
+    switch (name) {
+        case "bash": {
+            const command = String(input.command);
+            const timeout = (input.timeout ?? DEFAULT_TIMEOUT_S) * 1000;
+            const result = await exec(command, timeout);
+            report({ command, exitCode: result.exitCode, killed: result.killed });
+            const stdout = truncateMiddle(result.stdout);
+            const stderr = truncateMiddle(result.stderr);
+            return {
+                kind: "completed",
+                output: {
+                    exitCode: result.exitCode,
+                    stdout: stdout.text,
+                    stderr: result.timedOut
+                        ? `${stderr.text}${stderr.text && !stderr.text.endsWith("\n") ? "\n" : ""}Command timed out after ${timeout / 1000}s and was killed.`
+                        : stderr.text,
+                    ...(stdout.truncated || stderr.truncated ? { truncated: true } : {}),
+                    ...(result.timedOut ? { timedOut: true } : {}),
+                },
+            };
+        }
+        case "read": {
+            const path = resolvePath(String(input.path));
+            report({ path });
+            const content = await handle.readFile(path);
+            if (content === undefined)
+                return failed("sandbox.not_found", `No file at ${path}`);
+            const lines = content.split("\n");
+            if (lines.at(-1) === "")
+                lines.pop();
+            const start = (input.offset ?? 1) - 1;
+            const limit = input.limit ?? DEFAULT_READ_LINES;
+            const slice = lines.slice(start, start + limit);
+            const width = String(start + slice.length).length;
+            const text = slice
+                .map((line, index) => {
+                const clipped = line.length > LINE_LIMIT ? `${line.slice(0, LINE_LIMIT)}…` : line;
+                return `${String(start + index + 1).padStart(width, " ")}\t${clipped}`;
+            })
+                .join("\n");
+            const remaining = lines.length - (start + slice.length);
+            return {
+                kind: "completed",
+                output: lines.length === 0
+                    ? `${path} is empty.`
+                    : remaining > 0
+                        ? `${text}\n… ${remaining} more line(s); read again with offset ${start + slice.length + 1}.`
+                        : text,
+            };
+        }
+        case "write": {
+            const path = resolvePath(String(input.path));
+            const content = String(input.content);
+            report({ path });
+            const parent = await exec(`mkdir -p ${quote(posix.dirname(path))}`);
+            if (parent.exitCode !== 0)
+                return failed("sandbox.write_failed", parent.stderr.trim() || `Could not create ${posix.dirname(path)}`);
+            await handle.writeFile(path, content);
+            return { kind: "completed", output: { path, bytes: Buffer.byteLength(content) } };
+        }
+        case "edit": {
+            const path = resolvePath(String(input.path));
+            report({ path });
+            const content = await handle.readFile(path);
+            if (content === undefined)
+                return failed("sandbox.not_found", `No file at ${path}`);
+            const oldString = String(input.old_string);
+            const newString = String(input.new_string);
+            if (oldString === newString)
+                return failed("sandbox.edit_noop", "old_string and new_string are identical");
+            const count = content.split(oldString).length - 1;
+            if (count === 0)
+                return failed("sandbox.edit_no_match", `old_string was not found in ${path}. Read the file and copy the text exactly.`);
+            if (count > 1 && input.replace_all !== true)
+                return failed("sandbox.edit_not_unique", `old_string appears ${count} times in ${path}. Add surrounding context to make it unique, or set replace_all.`);
+            await handle.writeFile(path, content.replaceAll(oldString, () => newString));
+            return { kind: "completed", output: { path, replacements: input.replace_all === true ? count : 1 } };
+        }
+        case "grep": {
+            const max = input.max_results ?? DEFAULT_GREP_RESULTS;
+            const target = input.path ? String(input.path) : ".";
+            const flags = ["-rnE", ...(input.ignore_case ? ["-i"] : [])];
+            const include = input.glob ? ` --include=${quote(String(input.glob))}` : "";
+            const command = `grep ${flags.join(" ")}${include} -e ${quote(String(input.pattern))} -- ${quote(target)} | head -n ${max + 1}`;
+            report({ command });
+            const result = await exec(command);
+            // The pipeline's exit code is head's, so a grep error shows up as stderr with no matches.
+            const lines = result.stdout.split("\n").filter(Boolean);
+            if (lines.length === 0)
+                return result.stderr.trim()
+                    ? failed("sandbox.grep_failed", result.stderr.trim())
+                    : { kind: "completed", output: "No matches." };
+            const shown = lines.slice(0, max).map((line) => (line.length > LINE_LIMIT ? `${line.slice(0, LINE_LIMIT)}…` : line));
+            return {
+                kind: "completed",
+                output: lines.length > max ? `${shown.join("\n")}\n… more matches omitted; narrow the search.` : shown.join("\n"),
+            };
+        }
+        case "glob": {
+            const root = resolvePath(input.path ? String(input.path) : ".");
+            const pattern = String(input.pattern);
+            const command = `find ${quote(root)} -type f -not -path '*/.git/*' 2>/dev/null | head -n ${GLOB_SCAN_LIMIT}`;
+            report({ command });
+            const result = await exec(command);
+            const byBasename = !pattern.includes("/");
+            const matches = [];
+            for (const file of result.stdout.split("\n")) {
+                if (!file)
+                    continue;
+                const relative = posix.relative(root, file);
+                if (posix.matchesGlob(byBasename ? posix.basename(relative) : relative, pattern)) {
+                    matches.push(file);
+                    if (matches.length > GLOB_LIMIT)
+                        break;
+                }
+            }
+            if (matches.length === 0)
+                return { kind: "completed", output: "No files matched." };
+            matches.sort();
+            return {
+                kind: "completed",
+                output: matches.length > GLOB_LIMIT
+                    ? `${matches.slice(0, GLOB_LIMIT).join("\n")}\n… more files omitted; narrow the pattern.`
+                    : matches.join("\n"),
+            };
+        }
+    }
+}

package/dist/sandbox/types.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Backend contract for Runtime-owned sandboxes. Only files under `adapters/sandbox/` implement it
+ * and import a substrate SDK; everything else in the Runtime talks to this interface.
+ */
+import type { SandboxNetworkPreset } from "@nylorun/core/define";
+export type SandboxBackendName = "microsandbox" | "virtual";
+export type SandboxIsolation = "vm" | "process";
+export interface SandboxProbe {
+    readonly name: SandboxBackendName;
+    readonly available: boolean;
+    readonly isolation: SandboxIsolation;
+    /** Why the backend is unavailable, or a short description when it is. */
+    readonly reason?: string;
+    readonly version?: string;
+}
+/** Egress policy after presets are expanded. Always-blocked ranges are the backend's job. */
+export interface ResolvedNetwork {
+    readonly preset: SandboxNetworkPreset;
+    /** Exact host names allowed over HTTPS/HTTP. */
+    readonly hosts: readonly string[];
+    /** Domain suffixes such as ".pythonhosted.org", from "*.pythonhosted.org". */
+    readonly suffixes: readonly string[];
+}
+export interface SandboxSpec {
+    /** Stable backend name for this sandbox; unique per Runtime scope and session. */
+    readonly key: string;
+    readonly image: string;
+    readonly cpus: number;
+    readonly memoryMiB: number;
+    readonly network: ResolvedNetwork;
+}
+export interface ExecRequest {
+    readonly command: string;
+    readonly cwd: string;
+    readonly timeoutMs: number;
+}
+export interface ExecResult {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+    /** The process was actually stopped (timeout or cancellation). */
+    readonly killed: boolean;
+    readonly timedOut: boolean;
+}
+export interface SandboxHandle {
+    exec(request: ExecRequest, signal: AbortSignal): Promise<ExecResult>;
+    /** Returns undefined when the file does not exist. */
+    readFile(path: string): Promise<string | undefined>;
+    /** Parent directories must already exist. */
+    writeFile(path: string, content: string): Promise<void>;
+    /** Release compute; files persist. */
+    stop(): Promise<void>;
+}
+export interface SandboxBackend {
+    readonly name: SandboxBackendName;
+    readonly isolation: SandboxIsolation;
+    probe(): Promise<SandboxProbe>;
+    /** A reason this backend cannot meet the spec, or undefined when it can. */
+    unmet(spec: SandboxSpec): string | undefined;
+    /** Reattach to an existing sandbox (starting it if stopped) or create a new one. */
+    open(spec: SandboxSpec): Promise<SandboxHandle>;
+    /** Delete compute and files. Missing sandboxes are ignored. */
+    remove(key: string): Promise<void>;
+    /** Keys of sandboxes this backend holds whose key starts with the prefix. */
+    list(prefix: string): Promise<readonly string[]>;
+}

package/dist/vault/service.d.ts

@@ -1,5 +1,20 @@
 import type { DatabaseSync } from "node:sqlite";
-import type { CreateCredentialRequest, CreateVaultRequest, CredentialInfo, CredentialSelection, RotateCredentialRequest, VaultInfo } from "@nylorun/core/contracts";
+import type { CreateCredentialRequest, CreateVaultRequest, CredentialInfo, CredentialSelection, HostModelProviderInfo, HostModelView, PutHostModelRequest, RotateCredentialRequest, SelectHostModelRequest, VaultInfo } from "@nylorun/core/contracts";
+export type HostModelSecret = {
+    provider: string;
+    model: string;
+    baseUrl?: string;
+    authType: "api_key" | "oauth";
+    credential: {
+        type: "api_key" | "oauth";
+        key?: string;
+        env?: Record<string, string>;
+        refresh?: string;
+        access?: string;
+        expires?: number;
+        [key: string]: unknown;
+    };
+};
 export type AuthorizeResult = {
     status: "unauthenticated";
     url: string;
@@ -44,6 +59,21 @@ export declare class VaultService {
         url: string;
         serverName?: string;
     }): Promise<AuthorizeResult>;
+    getHostModel(): HostModelView;
+    listHostProviders(): {
+        providers: HostModelProviderInfo[];
+    };
+    putHostModel(body: PutHostModelRequest): HostModelView;
+    selectHostModel(body: SelectHostModelRequest): HostModelView;
+    readHostModel(): HostModelSecret | undefined;
+    updateHostCredential(credential: {
+        type: "api_key" | "oauth";
+        key?: string;
+        env?: Record<string, string>;
+        refresh?: string;
+        access?: string;
+        expires?: number;
+    }): void;
     reject(route: string): void;
     private refresh;
     private replay;
@@ -52,6 +82,16 @@ export declare class VaultService {
     private readPayload;
     private vaultInfo;
     private vaultRow;
+    private ensureHostVault;
+    private validateHostModel;
+    private insertHostCredential;
+    private readHostPayload;
+    private hostModelRows;
+    private hostCredentialRowFor;
+    private activeHostCredentialRow;
+    private activeProviderId;
+    private setActiveProvider;
+    private deleteHostProviderRows;
     private credentialInfo;
     private credentialRow;
     private rowsForVault;

package/dist/vault/service.js

@@ -2,8 +2,11 @@ import { createHash, randomUUID } from "node:crypto";
 import { canonical } from "../core/store.js";
 import { decryptSecret, encryptSecret, VaultCryptoError, } from "./crypto.js";
 import { VaultError } from "./error.js";
+import { hostModelCatalog } from "../model/catalog.js";
 import { normalizeVaultUrl } from "./url.js";
 const REFRESH_SKEW_MS = 60_000;
+const HOST_VAULT_ID = "host";
+const HOST_MODEL_ID = "host-model";
 export class VaultService {
     db;
     tx;
@@ -34,7 +37,7 @@ export class VaultService {
     }
     listVaults(ownerUserId) {
         const rows = this.db
-            .prepare(`SELECT id FROM vaults WHERE owner_user_id=? ORDER BY created_at, id`)
+            .prepare(`SELECT id FROM vaults WHERE owner_user_id=? AND scope='user' ORDER BY created_at, id`)
             .all(ownerUserId);
         return rows.map((row) => this.vaultInfo(row.id));
     }
@@ -156,6 +159,8 @@ export class VaultService {
             const vault = this.vaultRow(id);
             if (!vault)
                 throw new VaultError(404, "Vault not found");
+            if (vault.scope === "host")
+                throw new VaultError(400, "Host vault cannot be attached to a session");
             if (vault.owner_user_id !== ownerUserId)
                 throw new VaultError(403, "Vault belongs to another user");
         }
@@ -274,6 +279,142 @@ export class VaultService {
             headers: { authorization: `Bearer ${token}` },
         };
     }
+    getHostModel() {
+        const row = this.activeHostCredentialRow();
+        if (!row)
+            return { configured: false };
+        const binding = modelBinding(row);
+        return {
+            configured: true,
+            provider: binding.provider,
+            model: binding.model,
+            authType: binding.authType,
+            ...(binding.baseUrl ? { baseUrl: binding.baseUrl } : {}),
+        };
+    }
+    listHostProviders() {
+        const active = this.activeProviderId();
+        const catalog = new Map(hostModelCatalog().providers.map((provider) => [provider.id, provider.name]));
+        const providers = this.hostModelRows().map((row) => {
+            const binding = modelBinding(row);
+            return {
+                id: binding.provider,
+                name: catalog.get(binding.provider) ??
+                    (binding.provider === "custom"
+                        ? "Custom OpenAI-compatible"
+                        : binding.provider),
+                model: binding.model,
+                authType: binding.authType,
+                ...(binding.baseUrl ? { baseUrl: binding.baseUrl } : {}),
+                lastUpdated: row.rotated_at ?? row.created_at,
+                active: binding.provider === active,
+            };
+        });
+        providers.sort((left, right) => left.name.localeCompare(right.name));
+        return { providers };
+    }
+    putHostModel(body) {
+        return this.tx(() => this.replay(`host-model:${body.idempotencyKey}`, body, () => {
+            this.validateHostModel(body);
+            this.ensureHostVault();
+            const credentialId = hostModelCredentialId(body.provider);
+            this.deleteHostProviderRows(body.provider);
+            const payload = body.auth.type === "api_key"
+                ? {
+                    apiKey: body.auth.key,
+                    ...(body.auth.env ? { env: body.auth.env } : {}),
+                }
+                : { oauth: body.auth };
+            this.insertHostCredential({
+                id: credentialId,
+                provider: body.provider,
+                model: body.model,
+                baseUrl: body.baseUrl,
+                authType: body.auth.type,
+                payload,
+            });
+            this.setActiveProvider(body.provider);
+            this.audit({
+                actor: "application",
+                action: "rotate",
+                vaultId: HOST_VAULT_ID,
+                credentialId,
+                outcome: "rotated",
+            });
+            return this.getHostModel();
+        }));
+    }
+    selectHostModel(body) {
+        return this.tx(() => this.replay(`host-model-select:${body.idempotencyKey}`, body, () => {
+            this.validateHostModel(body);
+            const row = this.hostCredentialRowFor(body.provider);
+            if (!row)
+                throw new VaultError(404, "Model provider is not configured");
+            const binding = modelBinding(row);
+            const payload = this.readHostPayload(row, binding);
+            const credentialId = hostModelCredentialId(body.provider);
+            this.deleteHostProviderRows(body.provider);
+            this.insertHostCredential({
+                id: credentialId,
+                provider: body.provider,
+                model: body.model,
+                baseUrl: body.baseUrl,
+                authType: binding.authType,
+                payload,
+            });
+            this.setActiveProvider(body.provider);
+            this.audit({
+                actor: "application",
+                action: "rotate",
+                vaultId: HOST_VAULT_ID,
+                credentialId,
+                outcome: "rotated",
+            });
+            return this.getHostModel();
+        }));
+    }
+    readHostModel() {
+        const row = this.activeHostCredentialRow();
+        if (!row)
+            return undefined;
+        const binding = modelBinding(row);
+        const payload = this.readHostPayload(row, binding);
+        const credential = binding.authType === "oauth"
+            ? { type: "oauth", ...payload.oauth }
+            : {
+                type: "api_key",
+                key: payload.apiKey,
+                ...(payload.env ? { env: payload.env } : {}),
+            };
+        return {
+            provider: binding.provider,
+            model: binding.model,
+            ...(binding.baseUrl ? { baseUrl: binding.baseUrl } : {}),
+            authType: binding.authType,
+            credential,
+        };
+    }
+    updateHostCredential(credential) {
+        this.tx(() => {
+            const row = this.activeHostCredentialRow();
+            if (!row)
+                throw new VaultError(404, "Model provider is not configured");
+            const binding = modelBinding(row);
+            const payload = credential.type === "oauth"
+                ? { oauth: credential }
+                : {
+                    apiKey: credential.key,
+                    ...(credential.env ? { env: credential.env } : {}),
+                };
+            const aad = hostModelAad(binding.provider, binding.model);
+            const sealed = encryptSecret(this.kek(), aad, Buffer.from(JSON.stringify(payload), "utf8"));
+            this.db
+                .prepare(`UPDATE vault_credentials
+           SET type='model', binding_json=?, kek_id=?, nonce=?, ciphertext=?, wrapped_dek=?, rotated_at=?
+           WHERE id=?`)
+                .run(JSON.stringify({ ...binding, authType: credential.type }), sealed.kekId, sealed.nonce, sealed.ciphertext, sealed.wrappedDek, new Date().toISOString(), row.id);
+        });
+    }
     reject(route) {
         this.audit({
             actor: "executor",
@@ -413,7 +554,7 @@ export class VaultService {
     }
     vaultInfo(id) {
         const row = this.vaultRow(id);
-        if (!row)
+        if (!row || row.scope === "host")
             throw new VaultError(404, "Vault not found");
         return {
             id: row.id,
@@ -427,9 +568,134 @@ export class VaultService {
     }
     vaultRow(id) {
         return this.db
-            .prepare(`SELECT id, name, owner_user_id, metadata_json, created_at FROM vaults WHERE id=?`)
+            .prepare(`SELECT id, name, owner_user_id, metadata_json, created_at, scope FROM vaults WHERE id=?`)
             .get(id);
     }
+    ensureHostVault() {
+        const existing = this.vaultRow(HOST_VAULT_ID);
+        if (existing?.scope === "host")
+            return;
+        if (existing)
+            throw new VaultError(409, "Host vault id is already used");
+        this.db
+            .prepare(`INSERT INTO vaults(id,name,owner_user_id,metadata_json,created_at,scope) VALUES(?,?,?,?,?,?)`)
+            .run(HOST_VAULT_ID, "Host", "host", null, new Date().toISOString(), "host");
+    }
+    validateHostModel(body) {
+        if (body.provider === "custom") {
+            if (!body.baseUrl)
+                throw new VaultError(400, "A base URL is required for a custom provider.");
+            let url;
+            try {
+                url = new URL(body.baseUrl);
+            }
+            catch {
+                throw new VaultError(400, "Base URL must be an HTTP(S) URL.");
+            }
+            if (!["http:", "https:"].includes(url.protocol))
+                throw new VaultError(400, "Base URL must be an HTTP(S) URL.");
+            return;
+        }
+        if (body.baseUrl)
+            throw new VaultError(400, "A base URL is only valid for a custom provider.");
+        const provider = hostModelCatalog().providers.find((item) => item.id === body.provider);
+        if (!provider)
+            throw new VaultError(400, "Unknown model provider.");
+        if (!provider.models.some((item) => item.id === body.model))
+            throw new VaultError(400, "Unknown model.");
+    }
+    insertHostCredential(input) {
+        const aad = hostModelAad(input.provider, input.model);
+        const sealed = encryptSecret(this.kek(), aad, Buffer.from(JSON.stringify(input.payload), "utf8"));
+        this.db
+            .prepare(`INSERT INTO vault_credentials(
+          id, vault_id, name, type, binding_json, expires_at, created_at, rotated_at,
+          kek_id, nonce, ciphertext, wrapped_dek
+        ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)`)
+            .run(input.id, HOST_VAULT_ID, input.provider, "model", JSON.stringify({
+            provider: input.provider,
+            model: input.model,
+            ...(input.baseUrl ? { baseUrl: input.baseUrl } : {}),
+            authType: input.authType,
+        }), null, new Date().toISOString(), null, sealed.kekId, sealed.nonce, sealed.ciphertext, sealed.wrappedDek);
+    }
+    readHostPayload(row, binding) {
+        const plaintext = decryptSecret(this.kek(), hostModelAad(binding.provider, binding.model), Buffer.from(row.nonce), Buffer.from(row.ciphertext), Buffer.from(row.wrapped_dek), row.kek_id);
+        try {
+            return JSON.parse(plaintext.toString("utf8"));
+        }
+        finally {
+            plaintext.fill(0);
+        }
+    }
+    hostModelRows() {
+        return this.db
+            .prepare(`SELECT id, vault_id, name, type, binding_json, expires_at, created_at, rotated_at,
+                  kek_id, nonce, ciphertext, wrapped_dek
+           FROM vault_credentials WHERE vault_id=? AND type='model'
+           ORDER BY created_at, id`)
+            .all(HOST_VAULT_ID).filter((row) => {
+            try {
+                modelBinding(row);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    hostCredentialRowFor(provider) {
+        const preferred = hostModelCredentialId(provider);
+        const rows = this.hostModelRows();
+        return (rows.find((row) => row.id === preferred) ??
+            rows.find((row) => modelBinding(row).provider === provider));
+    }
+    activeHostCredentialRow() {
+        const active = this.activeProviderId();
+        if (!active)
+            return undefined;
+        return this.hostCredentialRowFor(active);
+    }
+    activeProviderId() {
+        const vault = this.vaultRow(HOST_VAULT_ID);
+        if (vault?.metadata_json) {
+            try {
+                const metadata = JSON.parse(vault.metadata_json);
+                if (typeof metadata.activeProvider === "string" &&
+                    metadata.activeProvider &&
+                    this.hostCredentialRowFor(metadata.activeProvider))
+                    return metadata.activeProvider;
+            }
+            catch {
+                /* Fall through to the only configured provider. */
+            }
+        }
+        const rows = this.hostModelRows();
+        if (rows.length === 0)
+            return undefined;
+        if (rows.length === 1)
+            return modelBinding(rows[0]).provider;
+        const legacy = rows.find((row) => row.id === HOST_MODEL_ID);
+        if (legacy)
+            return modelBinding(legacy).provider;
+        return modelBinding(rows[0]).provider;
+    }
+    setActiveProvider(provider) {
+        this.ensureHostVault();
+        this.db
+            .prepare(`UPDATE vaults SET metadata_json=? WHERE id=?`)
+            .run(JSON.stringify({ activeProvider: provider }), HOST_VAULT_ID);
+    }
+    deleteHostProviderRows(provider) {
+        const ids = this.hostModelRows()
+            .filter((row) => modelBinding(row).provider === provider)
+            .map((row) => row.id);
+        ids.push(hostModelCredentialId(provider));
+        for (const id of new Set(ids))
+            this.db
+                .prepare(`DELETE FROM vault_credentials WHERE id=? AND vault_id=?`)
+                .run(id, HOST_VAULT_ID);
+    }
     credentialInfo(vaultId, id) {
         const row = this.credentialRow(vaultId, id);
         return {
@@ -449,7 +715,7 @@ export class VaultService {
                 kek_id, nonce, ciphertext, wrapped_dek
          FROM vault_credentials WHERE id=? AND vault_id=?`)
             .get(id, vaultId);
-        if (!row || (row.type !== "bearer" && row.type !== "oauth"))
+        if (!row || row.type === "model")
             throw new VaultError(404, "Credential not found");
         return row;
     }
@@ -529,6 +795,27 @@ function requireTimestamp(value) {
         throw new VaultError(400, "Credential expiry is invalid");
     return new Date(Date.parse(value)).toISOString();
 }
+function modelBinding(row) {
+    const binding = JSON.parse(row.binding_json);
+    if (!binding.provider || !binding.model || !binding.authType)
+        throw new VaultError(500, "Host model credential is unreadable");
+    return binding;
+}
+function hostModelCredentialId(provider) {
+    if (!/^[a-zA-Z0-9._-]+$/.test(provider))
+        throw new VaultError(400, "Invalid provider id");
+    return `${HOST_MODEL_ID}:${provider}`;
+}
+function hostModelAad(provider, model) {
+    return Buffer.from(canonical({
+        scope: "host",
+        vaultId: HOST_VAULT_ID,
+        credentialId: HOST_MODEL_ID,
+        type: "model",
+        provider,
+        model,
+    }), "utf8");
+}
 function credentialAad(vaultId, credentialId, type, url) {
     return Buffer.from(canonical({ vaultId, credentialId, type, url }), "utf8");
 }

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const RUNTIME_VERSION = "0.9.0-beta";

package/dist/version.js

@@ -0,0 +1,3 @@
+// Kept in step with package.json by runtime/scripts/check-package.mjs, which runs in npm run check.
+// release:prepare also rewrites this when it bumps @nylorun/runtime.
+export const RUNTIME_VERSION = "0.9.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.7.0-beta",
+  "version": "0.9.0-beta",
   "description": "SQLite agent execution host and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -29,7 +29,8 @@
     "./configuration": {
       "types": "./dist/configuration.d.ts",
       "import": "./dist/configuration.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "dist",
@@ -54,8 +55,12 @@
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@earendil-works/pi-ai": "0.85.1",
     "@hono/node-server": "^2.1.1",
-    "@nylorun/harness": "0.16.0-beta",
-    "@nylorun/core": "0.2.0-beta"
+    "@nylorun/harness": "0.18.0-beta",
+    "@nylorun/core": "0.4.0-beta",
+    "just-bash": "3.4.2"
+  },
+  "optionalDependencies": {
+    "microsandbox": "0.7.2"
   },
   "devDependencies": {
     "@types/node": "^26.5.0",