@nylorun/runtime 0.9.0-beta → 0.11.0-beta

package/dist/execution/types.js

@@ -0,0 +1,52 @@
+/**
+ * The Durable Session Execution seam (architecture §12.3).
+ *
+ * Durable Session Execution decides when to look at a session again. It never
+ * holds session state: every outcome lives in the Session Store, and `advance`
+ * is safe to repeat (§10.1). Restate is the supported implementation
+ * (`adapters/execution/restate.ts`); `execution/memory.ts` is the in-process
+ * implementation used by unit tests, `startEphemeralRuntime` and a Host
+ * started without Restate endpoints.
+ *
+ * ## Guarantees every implementation keeps
+ *
+ * - **One advance per key at a time.** The key is `<tenantId>:<sessionId>`.
+ *   Two `advance` calls for one key never overlap, on one process or many.
+ *   Different keys may run concurrently.
+ * - **At least once after a wake.** When `wake` resolves, an `advance` for the
+ *   key will start after that point (possibly merged with other wakes). Wakes
+ *   are sent after the Session Store transaction that caused them commits
+ *   (`Tx.afterCommit`), never inside it.
+ * - **Dedupe.** Wakes carrying the same `dedupeKey` for the same key cause at
+ *   most one advance for that cause (within the implementation's retention
+ *   window, at least 24 hours for Restate).
+ * - **Busy re-wake.** An advance that returns `busy` is re-run for the same key
+ *   after `retryAfterMs`.
+ * - **Retries on infrastructure errors.** A handler that throws is retried with
+ *   backoff. Session outcomes never throw: a turn that fails, pauses, waits or
+ *   becomes `uncertain` is settled in the Session Store and `advance` returns
+ *   `done`.
+ * - **Sweeps.** `armSweep` arms one self-re-arming sweep per Tenant; arming an
+ *   armed Tenant is a no-op. The sweep expires claims, re-wakes orphaned
+ *   `runnable` sessions and relays outbox rows left behind.
+ */
+export const WAKE_REASONS = [
+    "message",
+    "approve",
+    "respond",
+    "action_result",
+    "linked",
+    "flow",
+    "recover",
+];
+/** The key one advance at a time is serialized on. */
+export function sessionKey(tenantId, sessionId) {
+    return `${tenantId}:${sessionId}`;
+}
+/** Splits a key made by `sessionKey`. Tenant ids never contain `:`. */
+export function parseSessionKey(key) {
+    const at = key.indexOf(":");
+    if (at <= 0 || at === key.length - 1)
+        throw new Error(`Invalid session key: ${key}`);
+    return { tenantId: key.slice(0, at), sessionId: key.slice(at + 1) };
+}

package/dist/host/config-for.d.ts

@@ -0,0 +1,17 @@
+import type { HostConfigFile } from "./config.js";
+import type { Logger, TenantConfig } from "../tenant/types.js";
+/**
+ * Builds a TenantConfig for `openTenantRuntime`.
+ * The sandbox backend here is the Host default; a Tenant's seeded `sandbox.backend`
+ * setting overrides it when the Tenant opens (I1, A18).
+ */
+export declare function configForFactory(options: {
+    hostRoot: string;
+    hostConfig: HostConfigFile;
+    logger: Logger;
+    /** Allowlisted baseline from `baselineEnvironment` (built in `host/main.ts`). */
+    baseline: Readonly<Record<string, string>>;
+    mode?: TenantConfig["mode"];
+    /** Override model; default vault. Fixture/scripted require ephemeral/test mode. */
+    model?: TenantConfig["model"];
+}): (id: string) => TenantConfig;

package/dist/host/config-for.js

@@ -0,0 +1,27 @@
+import { tenantPaths } from "../tenant/paths.js";
+import { tenantChildEnvironment } from "./environment.js";
+/**
+ * Builds a TenantConfig for `openTenantRuntime`.
+ * The sandbox backend here is the Host default; a Tenant's seeded `sandbox.backend`
+ * setting overrides it when the Tenant opens (I1, A18).
+ */
+export function configForFactory(options) {
+    const { baseline } = options;
+    return (id) => {
+        const tenant = tenantPaths(options.hostRoot, id);
+        const sandboxBackend = "auto";
+        return {
+            tenantId: id,
+            mode: options.mode ?? "shared",
+            paths: tenant,
+            sandbox: { backend: sandboxBackend },
+            model: options.model ?? { kind: "vault" },
+            childEnv: tenantChildEnvironment(baseline, options.hostConfig, tenant),
+            logger: {
+                info: (message, fields) => options.logger.info(message, { tenantId: id, ...fields }),
+                warn: (message, fields) => options.logger.warn(message, { tenantId: id, ...fields }),
+                error: (message, fields) => options.logger.error(message, { tenantId: id, ...fields }),
+            },
+        };
+    };
+}

package/dist/host/config.d.ts

@@ -0,0 +1,16 @@
+/** host.json — durable, no secrets */
+export interface HostConfigFile {
+    hostId: string;
+    host: string;
+    port: number;
+    allowNonLoopback?: boolean;
+    proxy?: {
+        httpsProxy?: string;
+        noProxy?: string;
+        nodeExtraCaCerts?: string;
+    };
+}
+/** host-credentials.json, mode 0600 */
+export interface HostCredentialsFile {
+    adminKey: string;
+}

package/dist/host/create-host.d.ts

@@ -0,0 +1,56 @@
+import { type Logger, type TenantModule } from "../tenant/types.js";
+import type { HostConfigFile, HostCredentialsFile } from "./config.js";
+import type { ContainerListen } from "./stack-config.js";
+export interface CreateHostOptions {
+    hostRoot: string;
+    module: TenantModule;
+    config: HostConfigFile;
+    credentials: HostCredentialsFile;
+    logger: Logger;
+    /** Diagnostic package version of `@nylorun/core` for `/health`. */
+    coreVersion: string;
+    /** Process id reported by `/health` and admin host status. Defaults to `process.pid`. */
+    pid?: number;
+    /**
+     * Container mode: bind this address and port instead of host.json's, and
+     * accept only `allowedHosts` in the `Host` check (replacing the
+     * loopback-only rule). host.json then describes the client-facing address.
+     */
+    listen?: ContainerListen;
+    /**
+     * The client-facing URL `/v1/admin/status` reports as `host.url`
+     * (`NYLORUN_PUBLIC_URL`). Defaults to the bound address, which in container
+     * mode is `http://0.0.0.0:4000`.
+     */
+    publicUrl?: string;
+    /**
+     * Infrastructure readiness (`infra/readiness.ts`). `/ready` adds its checks
+     * and answers 503 while it reports not ok. Default: listener and discovery
+     * only.
+     */
+    readiness?: () => Promise<{
+        ok: boolean;
+        checks: Record<string, boolean>;
+    }>;
+    /**
+     * Shutdown steps around closing the Tenants. `close()` runs them whatever asked for it
+     * (SIGTERM in `host/main.ts`, `POST /v1/admin/host/shutdown`): the listener stops, then
+     * `beforeTenants` (stop the Worker so no advance starts on a closing Tenant), the Tenants
+     * close, then `afterTenants` (end the infrastructure clients). A failing step is logged
+     * and shutdown goes on.
+     */
+    shutdown?: {
+        beforeTenants?(): Promise<void>;
+        afterTenants?(): Promise<void>;
+    };
+}
+export interface HostServer {
+    listen(): Promise<void>;
+    close(): Promise<void>;
+    /** Settles once `close()` has finished, whatever called it. */
+    readonly closed: Promise<void>;
+    readonly url: string;
+}
+/** Constant-time comparison of SHA-256 digests of the presented and stored admin keys. */
+export declare function adminKeyMatches(presented: string | undefined, adminKey: string): boolean;
+export declare function createHost(options: CreateHostOptions): HostServer;

package/dist/host/create-host.js

@@ -0,0 +1,420 @@
+import { createServer, } from "node:http";
+import { createHash, timingSafeEqual } from "node:crypto";
+import { checkCompatibility, HOST_PROTOCOL, isTenantId, PROTOCOL_HEADER, TENANT_HEADER, } from "@nylorun/core/compatibility";
+import { AdminStatusSchema, CreateTenantRequestSchema, } from "@nylorun/core/contracts";
+import { TenantBusyError, TenantConflictError, } from "../tenant/quarantine.js";
+import { TenantNotFoundError, } from "../tenant/types.js";
+import { EXIT_NON_LOOPBACK, EXIT_PORT_IN_USE, HostListenError, isAllowedRequestHost, isJsonContentType, isLoopbackHost, readBearer, readJsonBody, redactRoutePath, requestHasBody, sendJson, sendOpaqueNotFound, sendProtocolRejected, sendRejected, } from "./http.js";
+import { RUNTIME_VERSION } from "../version.js";
+function hashUtf8(value) {
+    return createHash("sha256").update(value, "utf8").digest();
+}
+/** Constant-time comparison of SHA-256 digests of the presented and stored admin keys. */
+export function adminKeyMatches(presented, adminKey) {
+    if (presented === undefined)
+        return false;
+    const a = hashUtf8(presented);
+    const b = hashUtf8(adminKey);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function headerValue(headers, name) {
+    const raw = headers[name.toLowerCase()];
+    if (Array.isArray(raw))
+        return raw[0];
+    return raw;
+}
+function parseProtocolVersion(raw) {
+    if (raw === undefined)
+        return undefined;
+    const trimmed = raw.trim();
+    if (!/^\d+$/.test(trimmed))
+        return undefined;
+    return Number(trimmed);
+}
+function protocolAccepted(raw) {
+    const version = parseProtocolVersion(raw);
+    if (version === undefined)
+        return false;
+    return checkCompatibility({ version, required: [] }, HOST_PROTOCOL).ok;
+}
+export function createHost(options) {
+    const { hostRoot, module, config, credentials, logger, coreVersion, } = options;
+    const pid = options.pid ?? process.pid;
+    const containerListen = options.listen;
+    const bindHost = containerListen?.host ?? config.host;
+    const bindPort = containerListen?.port ?? config.port;
+    let server;
+    let url = "";
+    let listenPort = bindPort;
+    let closing = false;
+    let closePromise;
+    const adminStatusBody = async () => {
+        const tenants = await module.list();
+        const aggregate = await module.summarize();
+        return AdminStatusSchema.parse({
+            service: "nylorun-runtime",
+            version: RUNTIME_VERSION,
+            protocol: {
+                min: HOST_PROTOCOL.min,
+                max: HOST_PROTOCOL.max,
+                features: [...HOST_PROTOCOL.features],
+            },
+            tenants,
+            aggregate,
+            host: {
+                hostId: config.hostId,
+                url: options.publicUrl ?? url,
+                pid,
+            },
+        });
+    };
+    const requireAdmin = (request, response) => {
+        const token = readBearer(headerValue(request.headers, "authorization"));
+        if (!adminKeyMatches(token, credentials.adminKey)) {
+            sendOpaqueNotFound(response);
+            return false;
+        }
+        return true;
+    };
+    const handleAdmin = async (request, response, urlObj, segments) => {
+        const method = request.method ?? "GET";
+        // /v1/admin/...
+        if (segments[2] === "tenants") {
+            if (segments.length === 3 && method === "GET") {
+                const tenants = await module.list();
+                return sendJson(response, 200, tenants);
+            }
+            if (segments.length === 3 && method === "POST") {
+                const body = CreateTenantRequestSchema.parse(await readJsonBody(request));
+                try {
+                    const result = await module.create({
+                        tenantId: body.tenantId,
+                        name: body.name,
+                        principalId: body.principalId,
+                        credentialHash: body.credentialHash,
+                        idempotencyKey: body.idempotencyKey,
+                        ...(body.studioCredentialHash
+                            ? { studioCredentialHash: body.studioCredentialHash }
+                            : {}),
+                    });
+                    return sendJson(response, result.created ? 201 : 200, result.envelope);
+                }
+                catch (error) {
+                    const code = error.code;
+                    if (error instanceof TenantConflictError ||
+                        error.name === "TenantConflictError" ||
+                        code === "conflict" ||
+                        code === "tenant_conflict") {
+                        return sendRejected(response, 409, "tenant_conflict", error instanceof Error ? error.message : "Tenant conflict");
+                    }
+                    throw error;
+                }
+            }
+            if (segments.length === 4 && segments[3]) {
+                const id = segments[3];
+                if (method === "GET") {
+                    const status = await module.status(id);
+                    if (!status)
+                        return sendOpaqueNotFound(response);
+                    return sendJson(response, 200, status);
+                }
+                if (method === "DELETE") {
+                    const activeWork = urlObj.searchParams.get("activeWork") ?? "refuse";
+                    if (activeWork !== "refuse" &&
+                        activeWork !== "drain" &&
+                        activeWork !== "cancel") {
+                        return sendJson(response, 400, {
+                            status: "rejected",
+                            code: "invalid_request",
+                            message: "activeWork must be refuse, drain, or cancel",
+                        });
+                    }
+                    try {
+                        await module.delete(id, activeWork);
+                        response.writeHead(204);
+                        response.end();
+                        return;
+                    }
+                    catch (error) {
+                        if (error instanceof TenantNotFoundError)
+                            return sendOpaqueNotFound(response);
+                        const code = error.code;
+                        if (error instanceof TenantBusyError ||
+                            error.name === "TenantBusyError" ||
+                            code === "active_work" ||
+                            code === "conflict") {
+                            return sendRejected(response, 409, "active_work", error instanceof Error ? error.message : "Active work");
+                        }
+                        throw error;
+                    }
+                }
+            }
+        }
+        // D12: /v1/admin/status and /v1/admin/host share one handler.
+        if ((segments[2] === "host" || segments[2] === "status") &&
+            segments.length === 3 &&
+            method === "GET") {
+            return sendJson(response, 200, await adminStatusBody());
+        }
+        if (segments[2] === "host" &&
+            segments.length === 4 &&
+            segments[3] === "shutdown" &&
+            method === "POST") {
+            sendJson(response, 200, { status: "shutting_down" });
+            void close();
+            return;
+        }
+        return sendRejected(response, 404, "not_found", "Route not found");
+    };
+    const handle = async (request, response) => {
+        const started = Date.now();
+        let tenantId;
+        let statusCode = 500;
+        try {
+            const urlObj = new URL(request.url ?? "/", "http://runtime.local");
+            const pathname = urlObj.pathname;
+            // D§11: Host, Origin, then Content-Type — before any other processing.
+            const hostHeader = headerValue(request.headers, "host");
+            if (!isAllowedRequestHost(hostHeader, {
+                port: listenPort,
+                host: config.host,
+                allowNonLoopback: config.allowNonLoopback,
+                ...(containerListen
+                    ? { allowedHosts: containerListen.allowedHosts }
+                    : {}),
+            })) {
+                sendRejected(response, 421, "host_rejected", "Host header is not an allowed loopback or configured address");
+                statusCode = 421;
+                return;
+            }
+            if (headerValue(request.headers, "origin") !== undefined) {
+                sendRejected(response, 403, "origin_rejected", "Browser Origin headers are not accepted");
+                statusCode = 403;
+                return;
+            }
+            if (requestHasBody(request) &&
+                !isJsonContentType(headerValue(request.headers, "content-type"))) {
+                sendRejected(response, 415, "unsupported_media_type", "Request bodies must use application/json");
+                statusCode = 415;
+                return;
+            }
+            if (pathname === "/health") {
+                sendJson(response, 200, {
+                    status: "ok",
+                    service: "nylorun-runtime",
+                    version: RUNTIME_VERSION,
+                    protocol: {
+                        min: HOST_PROTOCOL.min,
+                        max: HOST_PROTOCOL.max,
+                        features: [...HOST_PROTOCOL.features],
+                    },
+                    coreVersion,
+                    hostId: config.hostId,
+                    pid,
+                });
+                statusCode = 200;
+                return;
+            }
+            if (pathname === "/ready") {
+                const listener = Boolean(server?.listening);
+                const discovery = module.started;
+                const infra = await options.readiness?.();
+                const ready = listener && discovery && !closing && (infra?.ok ?? true);
+                sendJson(response, ready ? 200 : 503, {
+                    status: ready ? "ready" : "not_ready",
+                    service: "nylorun-runtime",
+                    checks: { listener, discovery, ...infra?.checks },
+                });
+                statusCode = ready ? 200 : 503;
+                return;
+            }
+            const segments = pathname.split("/").filter(Boolean);
+            const isAdmin = segments[0] === "v1" && segments[1] === "admin";
+            if (isAdmin) {
+                const protocolHeader = headerValue(request.headers, PROTOCOL_HEADER);
+                if (!protocolAccepted(protocolHeader)) {
+                    sendProtocolRejected(response);
+                    statusCode = 426;
+                    return;
+                }
+                if (!requireAdmin(request, response)) {
+                    statusCode = 404;
+                    return;
+                }
+                await handleAdmin(request, response, urlObj, segments);
+                statusCode = response.statusCode || 200;
+                return;
+            }
+            // Tenant-scoped routes: header pattern → protocol → resolve → Tenant handle.
+            const tenantHeader = headerValue(request.headers, TENANT_HEADER);
+            if (tenantHeader === undefined || tenantHeader.trim() === "") {
+                sendJson(response, 400, {
+                    status: "rejected",
+                    code: "invalid_request",
+                    message: `${TENANT_HEADER} header is required`,
+                });
+                statusCode = 400;
+                return;
+            }
+            if (!isTenantId(tenantHeader)) {
+                sendJson(response, 400, {
+                    status: "rejected",
+                    code: "invalid_request",
+                    message: `${TENANT_HEADER} header is malformed`,
+                });
+                statusCode = 400;
+                return;
+            }
+            tenantId = tenantHeader;
+            const protocolHeader = headerValue(request.headers, PROTOCOL_HEADER);
+            if (!protocolAccepted(protocolHeader)) {
+                sendProtocolRejected(response);
+                statusCode = 426;
+                return;
+            }
+            const resolution = await module.resolve(tenantId);
+            if (resolution.kind !== "open") {
+                if (resolution.kind === "quarantined") {
+                    logger.warn("tenant_quarantined", {
+                        tenantId,
+                        code: resolution.quarantine.code,
+                        repair: resolution.quarantine.repair,
+                    });
+                }
+                sendOpaqueNotFound(response);
+                statusCode = 404;
+                return;
+            }
+            await resolution.handle.handle(request, response, urlObj);
+            statusCode = response.statusCode || 200;
+        }
+        catch (error) {
+            const status = error.status;
+            if (typeof status === "number" && status >= 400 && status < 600) {
+                sendJson(response, status, {
+                    status: "rejected",
+                    code: status === 400 ? "invalid_request" : "request_rejected",
+                    message: error instanceof Error ? error.message : "Request rejected",
+                });
+                statusCode = status;
+            }
+            else if (error &&
+                typeof error === "object" &&
+                "name" in error &&
+                error.name === "ZodError") {
+                sendJson(response, 400, {
+                    status: "rejected",
+                    code: "invalid_request",
+                    message: "Invalid request body",
+                });
+                statusCode = 400;
+            }
+            else {
+                logger.error("request_failed", {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                if (!response.headersSent) {
+                    sendJson(response, 500, {
+                        status: "rejected",
+                        code: "internal_error",
+                        message: "Internal error",
+                    });
+                }
+                statusCode = 500;
+            }
+        }
+        finally {
+            if (pathnameIsLogged(request.url)) {
+                logger.info("request", {
+                    status: statusCode,
+                    tenantId,
+                    durationMs: Date.now() - started,
+                    path: redactRoutePath(new URL(request.url ?? "/", "http://runtime.local").pathname),
+                    method: request.method,
+                });
+            }
+        }
+    };
+    async function listen() {
+        if (server)
+            throw new Error("Already listening");
+        // Container mode binds a non-loopback address behind an explicit Host
+        // allowlist; otherwise only loopback unless host.json allows more.
+        if (!containerListen &&
+            !config.allowNonLoopback &&
+            !isLoopbackHost(config.host)) {
+            throw new HostListenError(`Refusing to bind non-loopback host ${config.host} without allowNonLoopback`, EXIT_NON_LOOPBACK);
+        }
+        server = createServer((req, res) => {
+            void handle(req, res);
+        });
+        await new Promise((resolve, reject) => {
+            server.once("error", (error) => {
+                if (error.code === "EADDRINUSE") {
+                    reject(new HostListenError(`Port ${bindPort} on ${bindHost} is already in use`, EXIT_PORT_IN_USE, error));
+                    return;
+                }
+                reject(error);
+            });
+            server.listen(bindPort, bindHost, resolve);
+        });
+        const address = server.address();
+        listenPort =
+            typeof address === "object" && address ? address.port : bindPort;
+        url = `http://${bindHost}:${listenPort}`;
+        await module.start();
+        logger.info("host_listening", {
+            hostId: config.hostId,
+            url,
+            pid,
+        });
+    }
+    const step = async (name, run) => {
+        try {
+            await run?.();
+        }
+        catch (error) {
+            logger.error("host_shutdown_step_failed", {
+                step: name,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    };
+    let settleClosed;
+    const closed = new Promise((resolve) => {
+        settleClosed = resolve;
+    });
+    async function close() {
+        if (closePromise)
+            return closePromise;
+        closePromise = (async () => {
+            closing = true;
+            logger.info("host_shutdown", { hostId: config.hostId });
+            if (server) {
+                await new Promise((resolve) => {
+                    server.close(() => resolve());
+                    server.closeIdleConnections?.();
+                });
+                server = undefined;
+            }
+            await step("beforeTenants", options.shutdown?.beforeTenants);
+            await step("tenants", () => module.close());
+            await step("afterTenants", options.shutdown?.afterTenants);
+        })().finally(settleClosed);
+        return closePromise;
+    }
+    return {
+        listen,
+        close,
+        closed,
+        get url() {
+            return url;
+        },
+    };
+}
+function pathnameIsLogged(rawUrl) {
+    if (!rawUrl)
+        return true;
+    const pathname = new URL(rawUrl, "http://runtime.local").pathname;
+    return pathname !== "/health" && pathname !== "/ready";
+}

package/dist/host/environment.d.ts

@@ -0,0 +1,13 @@
+import type { HostConfigFile } from "./config.js";
+import type { HostPaths } from "../tenant/paths.js";
+import type { TenantPaths } from "../tenant/types.js";
+/**
+ * Allowlisted ambient keys for Host and Tenant child processes.
+ * `NODE_OPTIONS` is never copied.
+ */
+export declare function baselineEnvironment(env: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>): Record<string, string>;
+export type HostProcessPathInputs = Pick<HostPaths, "root" | "home" | "tmp">;
+/** Environment for the Runtime Host process itself (CLI spawn / `runtime run`). */
+export declare function hostProcessEnvironment(baseline: Readonly<Record<string, string>>, hostConfig: HostConfigFile, paths: HostProcessPathInputs): Record<string, string>;
+/** Environment for Tenant-owned children (MCP stdio, sandboxes). */
+export declare function tenantChildEnvironment(baseline: Readonly<Record<string, string>>, hostConfig: HostConfigFile, tenantPaths: TenantPaths): Record<string, string>;

package/dist/host/environment.js

@@ -0,0 +1,53 @@
+const BASELINE_KEYS = new Set(["PATH", "LANG", "TZ"]);
+function isBaselineKey(key) {
+    return BASELINE_KEYS.has(key) || key.startsWith("LC_");
+}
+/**
+ * Allowlisted ambient keys for Host and Tenant child processes.
+ * `NODE_OPTIONS` is never copied.
+ */
+export function baselineEnvironment(env) {
+    const out = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (value === undefined)
+            continue;
+        if (key === "NODE_OPTIONS")
+            continue;
+        if (!isBaselineKey(key))
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+function proxyEnv(hostConfig) {
+    const out = {};
+    const proxy = hostConfig.proxy;
+    if (!proxy)
+        return out;
+    if (proxy.httpsProxy)
+        out.HTTPS_PROXY = proxy.httpsProxy;
+    if (proxy.noProxy)
+        out.NO_PROXY = proxy.noProxy;
+    if (proxy.nodeExtraCaCerts)
+        out.NODE_EXTRA_CA_CERTS = proxy.nodeExtraCaCerts;
+    return out;
+}
+/** Environment for the Runtime Host process itself (CLI spawn / `runtime run`). */
+export function hostProcessEnvironment(baseline, hostConfig, paths) {
+    return {
+        ...baseline,
+        ...proxyEnv(hostConfig),
+        HOME: paths.home,
+        TMPDIR: paths.tmp,
+        NYLORUN_HOME: paths.root,
+    };
+}
+/** Environment for Tenant-owned children (MCP stdio, sandboxes). */
+export function tenantChildEnvironment(baseline, hostConfig, tenantPaths) {
+    return {
+        ...baseline,
+        ...proxyEnv(hostConfig),
+        HOME: tenantPaths.home,
+        TMPDIR: tenantPaths.tmp,
+    };
+}