@nylorun/runtime 0.9.0-beta → 0.10.0-beta

package/dist/core/sandbox-routes.d.ts

@@ -0,0 +1,35 @@
+import type { Action } from "@nylorun/core/contracts";
+import type { SandboxManager } from "../sandbox/manager.js";
+import type { SandboxToolOutcome } from "../sandbox/tools.js";
+import { type SessionSandboxRef } from "../sandbox/share.js";
+export declare class SandboxRouteError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export type SandboxRouteSession = SessionSandboxRef & {
+    readonly activeTurnId: string | null;
+    readonly status: string;
+};
+export type SandboxRouteDeps = {
+    readonly sandbox: SandboxManager;
+    readonly session: (id: string) => SandboxRouteSession;
+    readonly lookup: (id: string) => SessionSandboxRef | undefined;
+    readonly getAction: (id: string) => Action | undefined;
+};
+/**
+ * `POST /v1/sessions/:id/sandbox/:tool` — application principal.
+ * Refused while the session has an active agent turn.
+ */
+export declare function handleSessionSandboxTool(deps: SandboxRouteDeps, sessionId: string, toolName: string, body: unknown, signal: AbortSignal): Promise<SandboxToolOutcome>;
+/**
+ * `POST /v1/actions/:id/sandbox/:tool` — executor, authorized by the live claim.
+ * Body must include claimId and generation matching the claimed action.
+ */
+export declare function handleActionSandboxTool(deps: SandboxRouteDeps, actionId: string, toolName: string, body: unknown, signal: AbortSignal): Promise<SandboxToolOutcome>;
+/** Validate PutSession.sandbox attach: same owner, identical specs. */
+export declare function validateSandboxAttach(body: {
+    ownerUserId: string;
+    sandbox?: {
+        session: string;
+    };
+}, newManifest: SessionSandboxRef["manifest"], lookup: (id: string) => SessionSandboxRef | undefined): string | undefined;

package/dist/core/sandbox-routes.js

@@ -0,0 +1,106 @@
+/**
+ * HTTP handlers for session-scoped and claim-scoped sandbox tool endpoints.
+ * Wired from TenantRuntime; keeps route bodies out of the hot runtime file.
+ */
+import { isSandboxToolName, } from "@nylorun/core/define";
+import { capabilityForSandbox, owningSandboxSessionId, sandboxSpecOf, sandboxSpecsEqual, } from "../sandbox/share.js";
+export class SandboxRouteError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = "SandboxRouteError";
+    }
+}
+function resolveSpec(session, lookup) {
+    const ownerId = owningSandboxSessionId(session, lookup);
+    const owner = ownerId === session.id ? session : lookup(ownerId) ?? session;
+    const spec = sandboxSpecOf(owner.manifest) ?? sandboxSpecOf(session.manifest);
+    if (!spec)
+        throw new SandboxRouteError(404, "Session has no sandbox");
+    return spec;
+}
+function parseTool(tool) {
+    if (!isSandboxToolName(tool))
+        throw new SandboxRouteError(400, `Unknown sandbox tool '${tool}'`);
+    return tool;
+}
+function toolInput(body) {
+    if (body === undefined || body === null)
+        return {};
+    if (typeof body !== "object" || Array.isArray(body))
+        throw new SandboxRouteError(400, "Sandbox tool body must be an object");
+    const record = body;
+    const { claimId: _c, generation: _g, requestId: _r, ...input } = record;
+    return input;
+}
+async function runTool(deps, session, tool, input, signal) {
+    const spec = resolveSpec(session, deps.lookup);
+    const ownerId = owningSandboxSessionId(session, deps.lookup);
+    const ref = {
+        id: ownerId,
+        activeTurnId: session.activeTurnId,
+        manifest: session.manifest,
+    };
+    return deps.sandbox.run(ref, capabilityForSandbox(spec), tool, input, signal);
+}
+/**
+ * `POST /v1/sessions/:id/sandbox/:tool` — application principal.
+ * Refused while the session has an active agent turn.
+ */
+export async function handleSessionSandboxTool(deps, sessionId, toolName, body, signal) {
+    const session = deps.session(sessionId);
+    if (session.activeTurnId)
+        throw new SandboxRouteError(409, "Sandbox is unavailable while the session has an active agent turn");
+    const tool = parseTool(toolName);
+    return runTool(deps, session, tool, toolInput(body), signal);
+}
+/**
+ * `POST /v1/actions/:id/sandbox/:tool` — executor, authorized by the live claim.
+ * Body must include claimId and generation matching the claimed action.
+ */
+export async function handleActionSandboxTool(deps, actionId, toolName, body, signal) {
+    if (!body || typeof body !== "object" || Array.isArray(body))
+        throw new SandboxRouteError(400, "Sandbox tool body must be an object");
+    const record = body;
+    const claimId = record.claimId;
+    const generation = record.generation;
+    if (typeof claimId !== "string" || claimId.length === 0)
+        throw new SandboxRouteError(400, "claimId is required");
+    if (typeof generation !== "number" || !Number.isInteger(generation) || generation < 1)
+        throw new SandboxRouteError(400, "generation must be a positive integer");
+    const action = deps.getAction(actionId);
+    if (!action)
+        throw new SandboxRouteError(404, "Action not found");
+    if (action.status !== "claimed" ||
+        action.claimId !== claimId ||
+        action.generation !== generation ||
+        !action.leaseExpiresAt ||
+        Date.parse(action.leaseExpiresAt) <= Date.now())
+        throw new SandboxRouteError(409, "Stale or expired claim");
+    const session = deps.session(action.sessionId);
+    if (session.activeTurnId !== action.turnId)
+        throw new SandboxRouteError(409, "Action unavailable");
+    const tool = parseTool(toolName);
+    return runTool(deps, session, tool, toolInput(body), signal);
+}
+/** Validate PutSession.sandbox attach: same owner, identical specs. */
+export function validateSandboxAttach(body, newManifest, lookup) {
+    const share = body.sandbox?.session;
+    if (!share)
+        return undefined;
+    const owner = lookup(share);
+    if (!owner)
+        throw new SandboxRouteError(404, "Sandbox session not found");
+    if (owner.ownerUserId !== body.ownerUserId)
+        throw new SandboxRouteError(403, "Sandbox session must belong to the same owner");
+    const ownerSpec = sandboxSpecOf(owner.manifest);
+    const newSpec = sandboxSpecOf(newManifest);
+    if (!ownerSpec)
+        throw new SandboxRouteError(400, "Target session has no sandbox to share");
+    if (!newSpec)
+        throw new SandboxRouteError(400, "Session must declare a sandbox identical to the shared session");
+    if (!sandboxSpecsEqual(ownerSpec, newSpec))
+        throw new SandboxRouteError(409, "Sandbox specs must be identical to share a sandbox");
+    return owningSandboxSessionId(owner, lookup);
+}

package/dist/core/store.d.ts

@@ -6,12 +6,14 @@ export interface ExecutorRow {
     tokenHash: string;
     implementationVersion: string;
     manifestHash?: string;
+    principalId?: string;
     createdAt: string;
     updatedAt: string;
 }
 export declare class Store {
+    private readonly tenantId;
     readonly db: DatabaseSync;
-    constructor(path: string);
+    constructor(path: string, tenantId: string);
     tx<T>(fn: () => T): T;
     get<T = any>(table: string, id: string): T | undefined;
     all<T = any>(table: string): T[];

package/dist/core/store.js

@@ -1,5 +1,6 @@
 import { DatabaseSync } from "node:sqlite";
 import { randomUUID } from "node:crypto";
+import { migrateTenantDatabase } from "../tenant/schema.js";
 export function canonical(value) {
     if (Array.isArray(value))
         return "[" + value.map(canonical).join(",") + "]";
@@ -14,69 +15,13 @@ export function canonical(value) {
     return JSON.stringify(value) ?? "null";
 }
 export class Store {
+    tenantId;
     db;
-    constructor(path) {
+    constructor(path, tenantId) {
+        this.tenantId = tenantId;
         this.db = new DatabaseSync(path);
-        this.db
-            .exec(`PRAGMA journal_mode=WAL; PRAGMA foreign_keys=ON; PRAGMA busy_timeout=5000;
-      CREATE TABLE IF NOT EXISTS definitions(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS sessions(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS commands(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS checkpoints(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS effects(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS actions(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS sandboxes(id TEXT PRIMARY KEY, body TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS events(sequence INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, body TEXT NOT NULL);
-      CREATE INDEX IF NOT EXISTS events_session ON events(session_id, sequence);
-      CREATE TABLE IF NOT EXISTS vaults(
-        id TEXT PRIMARY KEY,
-        name TEXT NOT NULL,
-        owner_user_id TEXT NOT NULL,
-        metadata_json TEXT,
-        created_at TEXT NOT NULL,
-        scope TEXT NOT NULL DEFAULT 'user'
-      );
-      CREATE INDEX IF NOT EXISTS vaults_owner ON vaults(owner_user_id);
-      CREATE TABLE IF NOT EXISTS vault_credentials(
-        id TEXT PRIMARY KEY,
-        vault_id TEXT NOT NULL REFERENCES vaults(id) ON DELETE CASCADE,
-        name TEXT NOT NULL,
-        type TEXT NOT NULL,
-        binding_json TEXT NOT NULL,
-        expires_at TEXT,
-        created_at TEXT NOT NULL,
-        rotated_at TEXT,
-        kek_id TEXT NOT NULL,
-        nonce BLOB NOT NULL,
-        ciphertext BLOB NOT NULL,
-        wrapped_dek BLOB NOT NULL
-      );
-      CREATE INDEX IF NOT EXISTS vault_credentials_vault ON vault_credentials(vault_id);
-      CREATE TABLE IF NOT EXISTS vault_audit(
-        id TEXT PRIMARY KEY,
-        at TEXT NOT NULL,
-        actor TEXT NOT NULL,
-        action TEXT NOT NULL,
-        vault_id TEXT,
-        credential_id TEXT,
-        session_id TEXT,
-        target TEXT,
-        outcome TEXT NOT NULL
-      );
-      CREATE TABLE IF NOT EXISTS vault_idempotency(
-        id TEXT PRIMARY KEY,
-        body_hash TEXT NOT NULL,
-        response TEXT NOT NULL
-      );
-      CREATE TABLE IF NOT EXISTS executors(
-        agent_id TEXT PRIMARY KEY,
-        token_hash TEXT NOT NULL UNIQUE,
-        implementation_version TEXT NOT NULL,
-        manifest_hash TEXT,
-        created_at TEXT NOT NULL,
-        updated_at TEXT NOT NULL
-      );`);
-        migrateVaultScope(this.db);
+        this.db.exec(`PRAGMA journal_mode=WAL; PRAGMA foreign_keys=ON; PRAGMA busy_timeout=5000;`);
+        migrateTenantDatabase(this.db);
     }
     tx(fn) {
         this.db.exec("BEGIN IMMEDIATE");
@@ -112,27 +57,29 @@ export class Store {
     // token hash instead of flowing through the generic JSON document helpers above.
     allExecutors() {
         return this.db
-            .prepare("SELECT agent_id,token_hash,implementation_version,manifest_hash,created_at,updated_at FROM executors")
+            .prepare("SELECT agent_id,token_hash,implementation_version,manifest_hash,principal_id,created_at,updated_at FROM executors")
             .all()
             .map((r) => ({
             agentId: String(r.agent_id),
             tokenHash: String(r.token_hash),
             implementationVersion: String(r.implementation_version),
             manifestHash: r.manifest_hash == null ? undefined : String(r.manifest_hash),
+            principalId: r.principal_id == null ? undefined : String(r.principal_id),
             createdAt: String(r.created_at),
             updatedAt: String(r.updated_at),
         }));
     }
     putExecutor(row) {
         this.db
-            .prepare(`INSERT INTO executors(agent_id,token_hash,implementation_version,manifest_hash,created_at,updated_at)
-         VALUES(?,?,?,?,?,?)
+            .prepare(`INSERT INTO executors(agent_id,token_hash,implementation_version,manifest_hash,principal_id,created_at,updated_at)
+         VALUES(?,?,?,?,?,?,?)
          ON CONFLICT(agent_id) DO UPDATE SET
            token_hash=excluded.token_hash,
            implementation_version=excluded.implementation_version,
            manifest_hash=excluded.manifest_hash,
+           principal_id=excluded.principal_id,
            updated_at=excluded.updated_at`)
-            .run(row.agentId, row.tokenHash, row.implementationVersion, row.manifestHash ?? null, row.updatedAt, row.updatedAt);
+            .run(row.agentId, row.tokenHash, row.implementationVersion, row.manifestHash ?? null, row.principalId ?? null, row.updatedAt, row.updatedAt);
     }
     deleteExecutor(agentId) {
         this.db.prepare("DELETE FROM executors WHERE agent_id=?").run(agentId);
@@ -151,6 +98,7 @@ export class Store {
             .run(sessionId, "{}");
         const event = {
             ...base,
+            tenantId: this.tenantId,
             cursor: Buffer.from(`${sessionId}:${result.lastInsertRowid}`).toString("base64url"),
         };
         this.db
@@ -190,13 +138,6 @@ export class Store {
     }
 }
 function belongsTo(event, agent) {
-    const ref = event.payload
-        ?.agent;
+    const ref = event.payload?.agent;
     return ref?.delegationId === agent || ref?.path === agent;
 }
-function migrateVaultScope(db) {
-    const columns = db.prepare("PRAGMA table_info(vaults)").all();
-    if (!columns.some((column) => column.name === "scope"))
-        db.exec("ALTER TABLE vaults ADD COLUMN scope TEXT NOT NULL DEFAULT 'user'");
-    db.exec("CREATE UNIQUE INDEX IF NOT EXISTS vaults_one_host ON vaults(scope) WHERE scope = 'host'");
-}

package/dist/core/turn-manifest.d.ts

@@ -0,0 +1,50 @@
+import { type AgentManifest } from "@nylorun/core/contracts";
+export type TurnManifestStore = {
+    /** Look up a previously pinned turn variant by hash. */
+    get(hash: string): AgentManifest | undefined;
+    /** Persist a validated turn variant for replay / Studio. */
+    put(hash: string, manifest: AgentManifest): void;
+};
+export type TurnManifestOk = {
+    readonly ok: true;
+    readonly manifest: AgentManifest;
+    readonly hash: string;
+};
+export type TurnManifestErr = {
+    readonly ok: false;
+    readonly code: "loop.invalid-agent";
+    readonly message: string;
+};
+/**
+ * Parse `message.manifest`, require it to be a variant of the session pin,
+ * hash it, and store it. Applies to that turn only (caller must not latch).
+ */
+export declare function pinTurnManifest(args: {
+    readonly candidate: unknown;
+    readonly pinned: AgentManifest;
+    readonly store: TurnManifestStore;
+}): TurnManifestOk | TurnManifestErr;
+/** Resolve the manifest a turn runs with: optional message field, else the pin. */
+export declare function resolveMessageManifest(args: {
+    readonly pinned: AgentManifest;
+    readonly pinnedHash: string;
+    readonly messageManifest?: unknown;
+    readonly store: TurnManifestStore;
+}): TurnManifestOk | TurnManifestErr;
+/**
+ * At turn start: if state's hash differs from the turn's, set `state.manifestHash`
+ * to the turn's when both are the pin or validated variants (`loops.md` §4.2).
+ * Leaves state unchanged when either hash is unrelated (runDurable still rejects).
+ */
+export declare function rebaseTurnState<S extends {
+    manifestHash?: string;
+}>(args: {
+    readonly state: S | undefined;
+    readonly turnManifestHash: string;
+    readonly isAllowedHash: (hash: string) => boolean;
+}): S | undefined;
+/** Allowed hashes: the session pin plus every stored turn variant. */
+export declare function allowedManifestHashes(args: {
+    readonly pinnedHash: string;
+    readonly variantHashes: Iterable<string>;
+}): Set<string>;

package/dist/core/turn-manifest.js

@@ -0,0 +1,66 @@
+import { AgentManifestSchema, } from "@nylorun/core/contracts";
+import { hashManifest } from "@nylorun/core/compatibility";
+import { isVariantOf } from "@nylorun/core/define";
+/**
+ * Parse `message.manifest`, require it to be a variant of the session pin,
+ * hash it, and store it. Applies to that turn only (caller must not latch).
+ */
+export function pinTurnManifest(args) {
+    const parsed = AgentManifestSchema.safeParse(args.candidate);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            code: "loop.invalid-agent",
+            message: "Turn manifest failed AgentManifestSchema validation",
+        };
+    }
+    const manifest = parsed.data;
+    if (!isVariantOf(manifest, args.pinned)) {
+        return {
+            ok: false,
+            code: "loop.invalid-agent",
+            message: "Turn manifest is not a variant of the session's pinned manifest",
+        };
+    }
+    const hash = hashManifest(manifest);
+    args.store.put(hash, manifest);
+    return { ok: true, manifest, hash };
+}
+/** Resolve the manifest a turn runs with: optional message field, else the pin. */
+export function resolveMessageManifest(args) {
+    if (args.messageManifest === undefined) {
+        return {
+            ok: true,
+            manifest: args.pinned,
+            hash: args.pinnedHash,
+        };
+    }
+    return pinTurnManifest({
+        candidate: args.messageManifest,
+        pinned: args.pinned,
+        store: args.store,
+    });
+}
+/**
+ * At turn start: if state's hash differs from the turn's, set `state.manifestHash`
+ * to the turn's when both are the pin or validated variants (`loops.md` §4.2).
+ * Leaves state unchanged when either hash is unrelated (runDurable still rejects).
+ */
+export function rebaseTurnState(args) {
+    const state = args.state;
+    if (!state?.manifestHash)
+        return state;
+    if (state.manifestHash === args.turnManifestHash)
+        return state;
+    if (!args.isAllowedHash(state.manifestHash) ||
+        !args.isAllowedHash(args.turnManifestHash))
+        return state;
+    return { ...state, manifestHash: args.turnManifestHash };
+}
+/** Allowed hashes: the session pin plus every stored turn variant. */
+export function allowedManifestHashes(args) {
+    const set = new Set([args.pinnedHash]);
+    for (const hash of args.variantHashes)
+        set.add(hash);
+    return set;
+}

package/dist/host/config-for.d.ts

@@ -0,0 +1,16 @@
+import type { HostConfigFile } from "./config.js";
+import type { Logger, TenantConfig } from "../tenant/types.js";
+/**
+ * Builds a TenantConfig for `openTenantRuntime`.
+ * Reads seeded sandbox backend from the Tenant database when present (I1).
+ */
+export declare function configForFactory(options: {
+    hostRoot: string;
+    hostConfig: HostConfigFile;
+    logger: Logger;
+    /** Allowlisted baseline from `baselineEnvironment` (built in `host/main.ts`). */
+    baseline: Readonly<Record<string, string>>;
+    mode?: TenantConfig["mode"];
+    /** Override model; default vault. Fixture/scripted require ephemeral/test mode. */
+    model?: TenantConfig["model"];
+}): (id: string) => TenantConfig;

package/dist/host/config-for.js

@@ -0,0 +1,45 @@
+import { existsSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+import { tenantPaths } from "../tenant/paths.js";
+import { readTenantConfig } from "../tenant/schema.js";
+import { tenantChildEnvironment } from "./environment.js";
+/**
+ * Builds a TenantConfig for `openTenantRuntime`.
+ * Reads seeded sandbox backend from the Tenant database when present (I1).
+ */
+export function configForFactory(options) {
+    const { baseline } = options;
+    return (id) => {
+        const tenant = tenantPaths(options.hostRoot, id);
+        let sandboxBackend = "auto";
+        if (existsSync(tenant.database)) {
+            try {
+                const db = new DatabaseSync(tenant.database, { readOnly: true });
+                try {
+                    const seeded = readTenantConfig(db).sandboxBackend;
+                    if (seeded)
+                        sandboxBackend = seeded;
+                }
+                finally {
+                    db.close();
+                }
+            }
+            catch {
+                /* unreadable — keep default */
+            }
+        }
+        return {
+            tenantId: id,
+            mode: options.mode ?? "shared",
+            paths: tenant,
+            sandbox: { backend: sandboxBackend },
+            model: options.model ?? { kind: "vault" },
+            childEnv: tenantChildEnvironment(baseline, options.hostConfig, tenant),
+            logger: {
+                info: (message, fields) => options.logger.info(message, { tenantId: id, ...fields }),
+                warn: (message, fields) => options.logger.warn(message, { tenantId: id, ...fields }),
+                error: (message, fields) => options.logger.error(message, { tenantId: id, ...fields }),
+            },
+        };
+    };
+}

package/dist/host/config.d.ts

@@ -0,0 +1,24 @@
+/** host.json — durable, no secrets */
+export interface HostConfigFile {
+    hostId: string;
+    host: string;
+    port: number;
+    allowNonLoopback?: boolean;
+    proxy?: {
+        httpsProxy?: string;
+        noProxy?: string;
+        nodeExtraCaCerts?: string;
+    };
+}
+/** host-state.json — process only */
+export interface HostStateFile {
+    pid: number;
+    startedAt: string;
+    version: string;
+    entry: string;
+    url: string;
+}
+/** host-credentials.json, mode 0600 */
+export interface HostCredentialsFile {
+    adminKey: string;
+}

package/dist/host/create-host.d.ts

@@ -0,0 +1,21 @@
+import type { Logger, TenantModule } from "../tenant/types.js";
+import type { HostConfigFile, HostCredentialsFile } from "./config.js";
+export interface CreateHostOptions {
+    hostRoot: string;
+    module: TenantModule;
+    config: HostConfigFile;
+    credentials: HostCredentialsFile;
+    logger: Logger;
+    /** Diagnostic package version of `@nylorun/core` for `/health`. */
+    coreVersion: string;
+    /** Process id reported by `/health` and admin host status. Defaults to `process.pid`. */
+    pid?: number;
+}
+export interface HostServer {
+    listen(): Promise<void>;
+    close(): Promise<void>;
+    readonly url: string;
+}
+/** Constant-time comparison of SHA-256 digests of the presented and stored admin keys. */
+export declare function adminKeyMatches(presented: string | undefined, adminKey: string): boolean;
+export declare function createHost(options: CreateHostOptions): HostServer;