@nylorun/cli 0.2.1-beta → 0.3.0-beta

package/dist/tenant/commands.js

@@ -0,0 +1,262 @@
+import { createInterface } from "node:readline/promises";
+import { randomUUID } from "node:crypto";
+import { createAdmin } from "@nylorun/admin";
+import { createClient, isTenantId } from "@nylorun/agents";
+import { CliError } from "../errors.js";
+import { resolveHome } from "../runtime/launcher.js";
+import { readCredentials, removeCredentials, } from "../project/credentials.js";
+import { readLink, removeLink, writeLink, } from "../project/link.js";
+import { requireProjectRoot } from "../project/root.js";
+/** Exact-and-unique name or id match. */
+export function matchTenant(tenants, nameOrId) {
+    if (isTenantId(nameOrId)) {
+        const byId = tenants.find((t) => t.id === nameOrId);
+        if (!byId)
+            throw new CliError(`No Tenant with id ${nameOrId}.`, 1);
+        return byId;
+    }
+    const matches = tenants.filter((t) => t.name === nameOrId);
+    if (matches.length === 0) {
+        throw new CliError(`No Tenant named ${JSON.stringify(nameOrId)}.`, 1);
+    }
+    if (matches.length > 1) {
+        throw new CliError(`Tenant name ${JSON.stringify(nameOrId)} is not unique (${matches.length} matches). Use the Tenant id.`, 1);
+    }
+    return matches[0];
+}
+function localAdmin(home) {
+    return createAdmin(home ? { home } : undefined);
+}
+export async function tenantCommand(args) {
+    const [verb, ...rest] = args;
+    if (!verb || verb === "--help" || verb === "-h") {
+        console.log(`nylorun tenant current|list [--json]|use <name-or-id>|status [--json]|reset [--sessions|--sandboxes|--all] [--yes]|delete <name-or-id> [--yes]`);
+        return;
+    }
+    const home = resolveHome();
+    if (verb === "current") {
+        const root = requireProjectRoot();
+        const link = await readLink(root);
+        if (!link) {
+            console.log("No Project link. Run nylorun dev to create one.");
+            return;
+        }
+        const admin = localAdmin(home);
+        const tenants = await admin.listTenants();
+        const match = tenants.find((t) => t.id === link.tenantId);
+        const name = match?.name ?? match?.envelope?.name ?? "(unknown)";
+        console.log(`${name}  ${link.tenantId}`);
+        console.log(`Host  ${link.hostUrl}  ${link.hostId}`);
+        return;
+    }
+    if (verb === "list") {
+        const json = rest.includes("--json");
+        if (rest.some((a) => a !== "--json")) {
+            throw new CliError("Usage: nylorun tenant list [--json]", 2);
+        }
+        const admin = localAdmin(home);
+        const tenants = await admin.listTenants();
+        if (json) {
+            console.log(JSON.stringify(tenants, null, 2));
+            return;
+        }
+        if (tenants.length === 0) {
+            console.log("No Tenants on this Host.");
+            return;
+        }
+        for (const tenant of tenants) {
+            const name = tenant.name ?? "(unreadable)";
+            console.log(`${name}  ${tenant.id}  ${tenant.state}`);
+        }
+        return;
+    }
+    if (verb === "use") {
+        const nameOrId = rest[0];
+        if (!nameOrId || rest.length > 1) {
+            throw new CliError("Usage: nylorun tenant use <name-or-id>", 2);
+        }
+        const root = requireProjectRoot();
+        const admin = localAdmin(home);
+        const status = await admin.status();
+        const hostId = status.host?.hostId;
+        if (!hostId) {
+            throw new CliError(`Host at ${admin.url} did not report hostId in admin status.`, 1);
+        }
+        const tenants = await admin.listTenants();
+        const selected = matchTenant(tenants, nameOrId);
+        console.warn("Sharing a Tenant shares executor registrations across Projects that link to it.");
+        const credentials = await readCredentials(root);
+        if (!credentials) {
+            throw new CliError("No Project credentials. Run nylorun dev to create a Tenant first, or copy credentials for the target Tenant.", 1);
+        }
+        const client = createClient({
+            url: admin.url,
+            key: credentials.applicationKey,
+            tenant: selected.id,
+        });
+        try {
+            await client.transport.json("/v1/tenant", "GET");
+        }
+        catch {
+            throw new CliError(`Credentials do not authorize Tenant ${selected.id}. Create a new Tenant with nylorun dev instead of reusing another Project's Tenant without its key.`, 1);
+        }
+        await writeLink(root, {
+            format: 1,
+            hostUrl: admin.url,
+            hostId,
+            tenantId: selected.id,
+        });
+        console.log(`Linked to ${selected.name ?? selected.id}  ${selected.id}`);
+        return;
+    }
+    if (verb === "status") {
+        const json = rest.includes("--json");
+        if (rest.some((a) => a !== "--json")) {
+            throw new CliError("Usage: nylorun tenant status [--json]", 2);
+        }
+        const root = requireProjectRoot();
+        const link = await readLink(root);
+        const credentials = await readCredentials(root);
+        if (!link || !credentials) {
+            throw new CliError("No Project link. Run nylorun dev to create one.", 1);
+        }
+        const client = createClient({
+            url: link.hostUrl,
+            key: credentials.applicationKey,
+            tenant: link.tenantId,
+        });
+        try {
+            const body = await client.transport.json("/v1/tenant", "GET");
+            if (json) {
+                console.log(JSON.stringify(body, null, 2));
+                return;
+            }
+            console.log(`${body.tenant.name}  ${body.tenant.id}`);
+            console.log(`path     ${body.path}`);
+            console.log(`checks   ${Object.entries(body.checks)
+                .map(([k, v]) => `${k}=${v ? "ok" : "fail"}`)
+                .join(" ")}`);
+            console.log(`counts   sessions=${body.counts.sessions} running=${body.counts.runningSessions} pending=${body.counts.pendingActions}`);
+            console.log(`sandbox  ${body.sandbox.backend ?? "none"}`);
+            return;
+        }
+        catch {
+            // Quarantined / opaque — fall back to admin status.
+        }
+        const admin = localAdmin(home);
+        try {
+            const body = await admin.getTenant(link.tenantId);
+            if (json) {
+                console.log(JSON.stringify(body, null, 2));
+                return;
+            }
+            console.log(`${body.name ?? "(unreadable)"}  ${body.id}  ${body.state}`);
+            if (body.quarantine) {
+                console.log(`reason   ${body.quarantine.code}: ${body.quarantine.message}`);
+                console.log(`repair   ${body.quarantine.repair}`);
+            }
+            return;
+        }
+        catch (error) {
+            throw new CliError(error instanceof Error
+                ? error.message
+                : `Tenant ${link.tenantId} is not reachable.`, 1);
+        }
+    }
+    if (verb === "reset") {
+        const yes = rest.includes("--yes");
+        const flags = rest.filter((a) => a !== "--yes");
+        let scope = "sessions";
+        if (flags.includes("--all"))
+            scope = "all";
+        else if (flags.includes("--sandboxes"))
+            scope = "sandboxes";
+        else if (flags.includes("--sessions") || flags.length === 0)
+            scope = "sessions";
+        else
+            throw new CliError("Usage: nylorun tenant reset [--sessions|--sandboxes|--all] [--yes]", 2);
+        if (flags.filter((f) => ["--sessions", "--sandboxes", "--all"].includes(f)).length > 1) {
+            throw new CliError("Pass only one of --sessions, --sandboxes, --all.", 2);
+        }
+        const root = requireProjectRoot();
+        const link = await readLink(root);
+        const credentials = await readCredentials(root);
+        if (!link || !credentials) {
+            throw new CliError("No Project link. Run nylorun dev first.", 1);
+        }
+        const admin = localAdmin(home);
+        const tenants = await admin.listTenants();
+        const match = tenants.find((t) => t.id === link.tenantId);
+        const name = match?.name ?? link.tenantId;
+        if (scope === "all" && !yes) {
+            await confirmOrThrow(`Reset ALL data for Tenant ${name} (${link.tenantId})? Link and credentials are kept. [y/N] `);
+        }
+        const client = createClient({
+            url: link.hostUrl,
+            key: credentials.applicationKey,
+            tenant: link.tenantId,
+        });
+        try {
+            await client.transport.json("/v1/tenant/reset", "POST", {
+                requestId: randomUUID(),
+                scope,
+                activeWork: "drain",
+            });
+        }
+        catch (error) {
+            throw new CliError(error instanceof Error
+                ? error.message
+                : `Tenant reset failed: ${String(error)}`, 1);
+        }
+        console.log(`Reset Tenant ${name} (${scope}).`);
+        return;
+    }
+    if (verb === "delete") {
+        const yes = rest.includes("--yes");
+        const nameOrId = rest.find((a) => a !== "--yes");
+        if (!nameOrId || rest.filter((a) => a !== "--yes").length !== 1) {
+            throw new CliError("Usage: nylorun tenant delete <name-or-id> [--yes]", 2);
+        }
+        const root = requireProjectRoot();
+        const admin = localAdmin(home);
+        const tenants = await admin.listTenants();
+        const selected = matchTenant(tenants, nameOrId);
+        if (!yes) {
+            await confirmOrThrow(`Delete Tenant ${selected.name ?? selected.id} (${selected.id})?\nThe KEK moves to trash with the Tenant directory. [y/N] `);
+        }
+        try {
+            await admin.deleteTenant(selected.id, { activeWork: "refuse" });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (/active_work|409|live work/i.test(message)) {
+                throw new CliError(`Tenant ${selected.id} has live work. Retry with the Host idle, or drain sessions first.`, 1);
+            }
+            throw new CliError(message, 1);
+        }
+        const link = await readLink(root);
+        if (link?.tenantId === selected.id) {
+            await removeLink(root);
+            await removeCredentials(root);
+            console.log("Removed Project link and credentials for the deleted Tenant.");
+        }
+        console.log(`Deleted Tenant ${selected.name ?? selected.id}.`);
+        return;
+    }
+    throw new CliError(`Unknown tenant command ${verb}.\nUsage: nylorun tenant current|list|use|status|reset|delete`, 2);
+}
+async function confirmOrThrow(prompt) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new CliError("Confirmation required; pass --yes for non-interactive use.", 2);
+    }
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = (await rl.question(prompt)).trim().toLowerCase();
+        if (answer !== "y" && answer !== "yes") {
+            throw new CliError("Cancelled.", 1);
+        }
+    }
+    finally {
+        rl.close();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/cli",
-  "version": "0.2.1-beta",
+  "version": "0.3.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Nylorun local development CLI",
@@ -30,8 +30,8 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@nylorun/agents": "0.5.0-beta",
-    "@nylorun/runtime": "0.9.0-beta",
+    "@nylorun/agents": "0.6.0-beta",
+    "@nylorun/admin": "0.2.0-beta",
     "@earendil-works/pi-ai": "0.85.1"
   },
   "devDependencies": {
@@ -41,5 +41,8 @@
   },
   "bin": {
     "nylorun": "dist/cli.js"
+  },
+  "nylorun": {
+    "runtime": "0.10.0-beta"
   }
 }

package/dist/project-runner.d.ts

@@ -1,20 +0,0 @@
-import { type Scope } from "./scope.js";
-export interface LocalCredentials {
-    serverKey: string;
-    executors: Record<string, string>;
-}
-export declare function localCredentials(path: string): Promise<LocalCredentials>;
-export interface ExecutorScopeToken {
-    token: string;
-    agentId: string;
-    implementationVersion: string;
-}
-/** Registers or rotates this project's executor credentials on the running host. */
-export declare function putExecutors(url: string, serverKey: string, executors: readonly ExecutorScopeToken[]): Promise<void>;
-export interface RunProjectOptions {
-    studio?: boolean;
-    open?: boolean;
-    autostart?: boolean;
-    scope?: Scope;
-}
-export declare function runProject(entry: string, options?: RunProjectOptions): Promise<void>;

package/dist/project-runner.js

@@ -1,141 +0,0 @@
-import { createRequire } from "node:module";
-import { randomBytes } from "node:crypto";
-import { mkdir, readFile, writeFile, chmod } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-import { createClient, connectAgents, } from "@nylorun/agents";
-import { ensureHostModel } from "./model/host-model.js";
-import { CliError } from "./errors.js";
-import { ensureDataDir, loadScopeEnvironment, probeHealth, resolveScope, } from "./scope.js";
-import { ensureRuntime } from "./runtime-host.js";
-export async function localCredentials(path) {
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    try {
-        const value = JSON.parse(await readFile(path, "utf8"));
-        if (typeof value.serverKey !== "string" || !value.executors)
-            throw new Error("Invalid local credentials");
-        await chmod(path, 0o600);
-        return value;
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-        const value = { serverKey: randomBytes(32).toString("hex"), executors: {} };
-        await writeFile(path, JSON.stringify(value), { mode: 0o600, flag: "wx" });
-        return value;
-    }
-}
-/** Registers or rotates this project's executor credentials on the running host. */
-export async function putExecutors(url, serverKey, executors) {
-    const response = await fetch(`${url}/v1/executors`, {
-        method: "PUT",
-        headers: {
-            authorization: `Bearer ${serverKey}`,
-            "content-type": "application/json",
-        },
-        body: JSON.stringify({ executors }),
-    });
-    if (!response.ok)
-        throw new CliError(`The Runtime at ${url} rejected this project's executors (${response.status}): ${await response
-            .text()
-            .catch(() => "")}`);
-}
-export async function runProject(entry, options = {}) {
-    const scope = options.scope ?? resolveScope();
-    loadScopeEnvironment(scope);
-    const registry = await import(pathToFileURL(resolve(entry)).href);
-    if (!Array.isArray(registry.agents) || !registry.agents.length)
-        throw new Error(`${entry} must export a non-empty agents array`);
-    const agents = registry.agents;
-    await ensureDataDir(scope);
-    const credentials = await localCredentials(scope.credentialsPath);
-    const version = process.env.NYLORUN_IMPLEMENTATION_VERSION ?? "dev";
-    const scopes = agents.map((agent) => {
-        const token = (credentials.executors[agent.id] ??=
-            randomBytes(32).toString("hex"));
-        return { token, agentId: agent.id, implementationVersion: version };
-    });
-    await writeFile(scope.credentialsPath, JSON.stringify(credentials), {
-        mode: 0o600,
-    });
-    const url = scope.url;
-    let studio;
-    const connections = [];
-    let watchdog;
-    let stopping;
-    const close = () => (stopping ??= (async () => {
-        if (watchdog)
-            clearInterval(watchdog);
-        await Promise.allSettled(connections.map((c) => c.close()));
-        await studio?.close().catch(() => { });
-        for (const agent of agents)
-            await agent.close?.();
-    })());
-    // The Runtime is a separate, persistent process now, so shutting this one down leaves it up.
-    const stop = () => void close().finally(() => (process.exitCode = 0));
-    process.on("SIGINT", stop);
-    process.on("SIGTERM", stop);
-    try {
-        await ensureRuntime(scope, { autostart: options.autostart !== false });
-        await putExecutors(url, credentials.serverKey, scopes);
-        if (process.env.NYLORUN_DEV_MODEL !== "fixture")
-            await ensureHostModel({ runtimeUrl: url, serverKey: credentials.serverKey });
-        const client = createClient({ url, key: credentials.serverKey });
-        for (let index = 0; index < agents.length; index++) {
-            await client.saveAgent(agents[index], {
-                implementationVersion: version,
-            });
-            const connection = connectAgents({
-                agents: [agents[index]],
-                implementationVersion: version,
-                runtime: { url, key: scopes[index].token },
-                onError: (error) => console.error("Executor:", error instanceof Error ? error.message : error),
-            });
-            connections.push(connection);
-            await connection.ready;
-        }
-        if (options.studio) {
-            const modulePath = createRequire(join(process.cwd(), "package.json")).resolve("@nylorun/studio");
-            const module = await import(pathToFileURL(modulePath).href);
-            studio = await module.startStudio({
-                runtimeUrl: url,
-                serverKey: credentials.serverKey,
-                open: options.open !== false,
-            });
-            console.log(`Studio on ${studio.address}`);
-        }
-        console.log(`Local project ready at ${url}; ${agents.length} connected agent(s).`);
-        const sandbox = await (await import("./doctor.js")).sandboxBanner(url, credentials.serverKey, agents.map((agent) => agent.manifest));
-        if (sandbox)
-            console.log(sandbox);
-        await new Promise((settle) => {
-            const finish = () => {
-                if (!stopping)
-                    void close();
-                settle();
-            };
-            process.once("SIGINT", finish);
-            process.once("SIGTERM", finish);
-            // Without a child to watch, a Runtime that dies would leave this process connected to
-            // nothing; three consecutive failed probes end the run with a pointer to the log.
-            let failures = 0;
-            watchdog = setInterval(async () => {
-                if (stopping)
-                    return;
-                if ((await probeHealth(url, 2000)).health)
-                    return void (failures = 0);
-                if (++failures < 3)
-                    return;
-                console.error('Runtime stopped unexpectedly; see "nylorun logs".');
-                process.exitCode = 1;
-                finish();
-            }, 5000);
-            watchdog.unref();
-        });
-    }
-    finally {
-        process.removeListener("SIGINT", stop);
-        process.removeListener("SIGTERM", stop);
-        await close();
-    }
-}

package/dist/runtime-host.d.ts

@@ -1,39 +0,0 @@
-import { type RuntimeState, type Scope } from "./scope.js";
-export type HostState = "running" | "stopped" | "stale" | "unhealthy" | "pid-recycled" | "port-conflict";
-export interface Status {
-    state: HostState;
-    scope: Scope;
-    runtime?: RuntimeState;
-    version?: string;
-    scopeId?: string;
-    pid?: number;
-}
-/**
- * Derived from the resolved server entry rather than a "./package.json" export, so the version
- * is readable for every installed Runtime — including one too old to declare that export,
- * which is exactly when skew detection matters.
- */
-export declare const cliRuntimeVersion: () => string | undefined;
-export declare function hostStatus(scope: Scope): Promise<Status>;
-export declare function startHost(scope: Scope, options?: {
-    foreground?: boolean;
-    restart?: boolean;
-}): Promise<Status>;
-export declare function stopHost(scope: Scope, options?: {
-    timeoutMs?: number;
-}): Promise<"stopped" | "not-running">;
-export interface EnsureOptions {
-    autostart: boolean;
-    quiet?: boolean;
-}
-export declare function ensureRuntime(scope: Scope, options: EnsureOptions): Promise<Status>;
-/**
- * A daemon from an older install would reject executor registration with a bare 404, so the
- * commands that depend on that route fail early with the remedy instead.
- */
-export declare function assertCompatible(scope: Scope, status: Status): void;
-export declare function warnIncompatible(scope: Scope, status: Status): void;
-export declare function tailLog(scope: Scope, options: {
-    follow: boolean;
-    lines: number;
-}): Promise<void>;