@nylorun/cli 0.2.1-beta → 0.4.0-beta

package/CHANGELOG.md

@@ -1,5 +1,88 @@
 # @nylorun/cli
 
+## 0.4.0-beta
+
+### Minor Changes
+
+- bf1c2da: **The local Runtime and Studio run as a Docker Compose stack that the CLI manages; Studio ships only as its image (breaking beta).**
+
+  - `nylorun start` writes `<Host root>/stack/compose.yaml` and `.env` (mode 0600) and starts Postgres, Restate, s2-lite, the Runtime and Studio on loopback ports, with the Runtime and Studio images this CLI pins (`nylorun.runtime`, `nylorun.studio`; `NYLORUN_RUNTIME_IMAGE` and `NYLORUN_STUDIO_IMAGE` override them). `nylorun stop` keeps the volumes; `nylorun status [--json] [--env]` reports services and health; `nylorun reset [--yes]` deletes the volumes and every Tenant.
+  - `nylorun dev` starts the stack if it is not running, creates the Project's Tenant on first run, opens Studio on that Tenant through a single-use login URL (`next=/tenants/<id>`), and runs the application with `NYLORUN_RUNTIME_URL=http://localhost:<port>`. `--no-open` prints the URL only; `--no-studio` skips Studio. `--local-ui` is removed (exit 2).
+  - `nylorun logs` and `nylorun studio` are the stack commands (`nylorun stack <command>` still works). `nylorun studio` lands on the linked Project's Tenant.
+  - `nylorun runtime up|down|restart|run|status|logs` and the `up`/`down` aliases are removed; they exit 2 and name `nylorun start|stop|status|logs`. `nylorun runtime status --env` is now `nylorun status --env`.
+  - `nylorun doctor` checks Node 24+, Docker, Compose v2 and the stack's health; `doctor runtime` is an alias of it.
+  - `@nylorun/studio` is private and ships only as `ghcr.io/nylorun/studio`: `startStudio`, the hosted (`local.nylorun.studio`) and local UI modes, pairing, the `nylorun-studio` bin and the UI bundle download are removed.
+  - `npm create @nylorun/agent` no longer adds `@nylorun/studio` or a `studio` script, checks for Docker with Compose v2 instead of a global `@nylorun/runtime`, and accepts `--no-studio` only as a deprecated no-op.
+
+- bf1c2da: **`nylorun dev --ephemeral` runs on the Docker stack, with a Tenant-level fixture model (breaking beta).**
+
+  - `nylorun dev --ephemeral` creates a temporary Tenant through `@nylorun/admin` (no Project link written), seeds it from `.env` with the fixture model, opens Studio on it and runs the watcher; the Tenant is deleted with its active work cancelled when the watcher ends, Ctrl-C included. It needs a Runtime that advertises `tenant-fixture-model`.
+  - `PUT /v1/tenant/config/seed` accepts `fixtureModel: true`, stored as Tenant setting `model.fixture`: that Tenant's model calls use the Runtime's fixture model while other Tenants on the Host keep theirs. `HOST_PROTOCOL` advertises the new optional feature `tenant-fixture-model` (`OPTIONAL_HOST_FEATURES` in `@nylorun/core/compatibility`); clients do not require it.
+  - `startEphemeralRuntime()` keeps its signature but its Tenants live in memory instead of SQLite under the Host root; nothing survives `close()`.
+  - Closing a Tenant waits for running advances at most the advance grace period (30 s by default) and then abandons them; their lease lapses and the next advance takes over.
+  - A Worker stop, Tenant close or ended Restate attempt no longer fails or cancels the turn it interrupts: outcomes already returned are recorded, nothing is settled, and the next advance resumes the turn from its checkpoint. Only a user cancel settles `cancelled`; an advance deadline fails the turn with the deadline's message.
+
+- ba1b239: **`nylorun` sets up the local stack; `@nylorun/cli` becomes the Runtime client `nylo` (breaking beta).**
+
+  - New unscoped package **`nylorun`**: `npx nylorun up` sets up the Docker stack on the first run and starts it after that, from any directory; `npx nylorun down` stops it (volumes are kept). `up` and `down` are aliases of `start` and `stop`. It also owns `status`, `logs`, `studio`, `reset` and `doctor`, pins the Runtime and Studio images (`package.json` `nylorun.runtime` / `nylorun.studio`), depends on `@nylorun/core` only, and never creates Tenants.
+  - **`@nylorun/cli`** is the Runtime client with the command **`nylo`**: `nylo tenant create [name]` (creates the Tenant; in a project, writes the Project link and seeds the model provider and sandbox from `.env`), `nylo tenant current|list|use|status|reset|delete`, `nylo configure`, `nylo env` (was `nylorun status --env`) and `nylo doctor sandbox`. It no longer provides the `nylorun` command or the stack commands.
+  - **Removed:** `nylorun dev` and `nylorun dev --ephemeral`. Link once with `nylo tenant create`, then run the project's own `npm run dev`. Moved commands exit 2 and name their replacement.
+  - **Starter:** the generated project depends on `@nylorun/agents` only (no Nylorun devDependency); `dev` is `tsx watch --env-file-if-exists=.env src/main.ts`. `npm create @nylorun/agent` installs the project and prints the next steps (`npx nylorun up`, `npx @nylorun/cli tenant create`, `npm run dev`) instead of starting development; `--no-open` is accepted and ignored.
+  - `connectAgents` names those steps when it finds no Runtime connection. Runtime repair hints, model errors and core's sandbox message name `nylo` and `nylorun up`.
+
+- bf1c2da: **The microsandbox backend is removed; the Runtime runs sandbox tools on the virtual backend only.** The optional `microsandbox` dependency is gone. `sandbox.backend` and `NYLORUN_SANDBOX` accept `auto` or `virtual`, and `auto` selects `virtual`. A Tenant that stored `microsandbox` reads it as `auto`. `nylorun doctor sandbox` and the `nylorun dev` banner report only the virtual shell.
+- bf1c2da: **Tenants can register a Studio principal.** `CreateTenantRequest` gains optional `studioCredentialHash` behind the new protocol feature `studio-principal`; the Runtime stores it as application principal `studio`, and idempotent create compares it too. `@nylorun/admin` exports `deriveStudioToken(adminKey, tenantId)` (HMAC-SHA256 over `nylorun/studio/v1`, NUL, Tenant id) and `createTenant` sends the hash of that key, so Studio can reach any Tenant's API with a key derived from the admin key. Clients require the new feature, so upgrade the Runtime with them.
+- 1d84b3e: **Native Windows is no longer supported; Windows developers use WSL2.** Nylorun runs on macOS and Linux. On native Windows, `nylorun` and `npm create @nylorun/agent` stop with WSL2 guidance. Install Node 24 and Docker (Docker Desktop's WSL integration) inside your WSL distribution and keep projects in its Linux filesystem. The Windows-only process handling (`taskkill`, `.cmd` shims, `npm.cmd`) is removed. `nylorun doctor` reports WSL as `Linux (WSL: <distribution>)`.
+
+### Patch Changes
+
+- 1d84b3e: Opening the browser no longer crashes the CLI when no opener is installed (no `xdg-open` on a minimal Linux or WSL): it reports that and leaves the printed Studio URL to open by hand. Inside WSL, the CLI opens the Windows browser with `wslview`.
+- Pin agents to the tested release.
+- Pin admin to the tested release.
+- Updated dependencies [ba1b239]
+- Updated dependencies [bf1c2da]
+- Updated dependencies [bf1c2da]
+- Updated dependencies
+- Updated dependencies
+  - @nylorun/agents@0.7.0-beta
+  - @nylorun/admin@0.3.0-beta
+
+## 0.3.0-beta
+
+### Minor Changes
+
+- c49efed: **Breaking (pre-1.0 minor):** CLI reaches the local Runtime only through the installed Runtime's launcher.
+
+  - Dependencies: `@nylorun/agents` and `@nylorun/admin` only (no `@nylorun/runtime`, no `@nylorun/studio`).
+  - `nylorun runtime …` finds `nylorun-runtime` on PATH and checks its launcher and Host protocol; a missing or incompatible Runtime exits 1 with the install command for the recommended version (`package.json` `nylorun.runtime`). Nothing is downloaded. `nylorun doctor runtime` checks the prerequisites.
+  - `nylorun dev` runs the application entry under `tsx watch`; creates Tenants through `@nylorun/admin`.
+  - **Removed:** `nylorun serve` and the in-process Project runner. `nylorun studio`
+    remains the Project-aware Studio command, and `nylorun dev --no-studio`
+    remains the headless development path.
+  - Install as a **devDependency**; production `start` is `node dist/src/main.js`.
+
+- c49efed: **Breaking (pre-1.0 minor):** Replace a single SQLite Runtime per Project or home directory with a **Runtime Host** that serves isolated **Tenants**, selected by `Nylorun-Tenant` and negotiated with `Nylorun-Protocol` (protocol `2`, feature `runtime-tenants`). Vocabulary: Host root + Tenant + Project link.
+
+  - **core:** `PROTOCOL_VERSION = 2`, `HOST_PROTOCOL`, `TENANT_HEADER`, `PROTOCOL_HEADER`, `newTenantId` / `isTenantId`, `checkCompatibility`; health schema gains `hostId` + `protocol` (`service: "nylorun-runtime"`); Tenant/admin wire schemas; Tenant model routes under `/v1/tenant/*`.
+  - **runtime:** Host process + Tenant module; Tenant model routes under `/v1/tenant/*`; `startEphemeralRuntime` for tests/embeds; executors via `PUT /v1/executors`; sandbox prefix `nylorun-<tenant-id>-`.
+  - **agents:** `createClient({ url, key, tenant })`; Transport sends Tenant + protocol headers; `/health` compatibility cache; `IncompatibleRuntimeError` with upgrade remedies.
+  - **cli:** Host root lifecycle (`runtime up|down|status|logs|restart|run`); Project link (`.nylorun/link.json` + `credentials.json`); `tenant` commands; `runtime status --env` exports `NYLORUN_RUNTIME_URL`, `NYLORUN_SERVER_KEY`, `NYLORUN_TENANT`; removed Project/home SQLite selectors.
+  - **studio:** `startStudio({ …, tenant: { id, name } })`; proxy forwards Tenant + protocol headers; UI shows Tenant name/short id.
+
+### Patch Changes
+
+- Pin agents to the tested release.
+- Pin admin to the tested release.
+- Pin runtime to the tested release.
+- Updated dependencies [c49efed]
+- Updated dependencies [c49efed]
+- Updated dependencies [c49efed]
+- Updated dependencies [fd9fd87]
+- Updated dependencies
+- Updated dependencies
+  - @nylorun/agents@0.6.0-beta
+  - @nylorun/admin@0.2.0-beta
+
 ## 0.2.1-beta
 
 ### Patch Changes

package/README.md

@@ -1,61 +1,85 @@
 # @nylorun/cli
 
-The local `nylorun` executable. Requires Node 24+.
+The Runtime client, command `nylo`: it acts on a Runtime's Tenants, the local
+stack's or any Runtime reachable by URL and key. Setting up and running the
+local stack is [`nylorun`](../nylorun/README.md)'s job; the two packages are
+independent and never call each other. Depends on `@nylorun/agents` and
+`@nylorun/admin` only among Nylorun packages. Vocabulary:
+[runtime/src/CONTEXT.md](../runtime/src/CONTEXT.md).
 
 ```sh
-nylorun up                  # start the local Runtime (alias for "nylorun runtime start")
-nylorun dev                 # watch agents/index.ts, open Studio
-nylorun dev --no-studio
-nylorun serve [entry]       # run the compiled build, default dist/agents/index.js
-nylorun configure
-nylorun studio
-nylorun runtime status
-nylorun down                # stop the Runtime, keeping SQLite and credentials
+npx nylorun up                        # the local stack (nylorun)
+npx @nylorun/cli tenant create        # this project's Tenant, linked in .nylorun/
 ```
 
-## The Runtime is a separate, persistent process
+## Commands
 
-`nylorun up` starts `@nylorun/runtime/server` in the background and returns the
-terminal. `dev` and `serve` attach to it, registering the project's exported
-agents and connecting scoped executors through `PUT /v1/executors`. They start
-the Runtime themselves when nothing is listening, and they leave it running on
-exit, so a watch restart re-registers agents without losing sessions. Pass
-`--no-autostart` to fail instead, which is what CI should do. `--foreground`
-keeps `runtime start` attached for logs.
+```sh
+nylo tenant create [name]             # create a Tenant; in a Project, link it and seed it from .env
+nylo tenant current|list [--json]|use <name-or-id>|status [--json]|reset|delete
+nylo configure                        # set or replace the model provider on the linked Tenant
+nylo env                              # export lines for the linked Project
+nylo doctor sandbox [--json]          # sandbox backend via the Tenant API
+```
+
+Local stack commands (`up`, `down`, `start`, `stop`, `status`, `logs`,
+`studio`, `reset`) exit 2 naming `npx nylorun <command>`. `nylorun dev` was
+removed: link once with `nylo tenant create`, then run the project's own
+`npm run dev` (`tsx watch src/main.ts`).
+
+## `nylo tenant create`
+
+The Admin API connection resolves from `NYLORUN_ADMIN_URL` and
+`NYLORUN_ADMIN_KEY`, else from the local Host root (`NYLORUN_HOME` or
+`~/.nylorun`: `host.json` and the admin key that `nylorun up` wrote). With no
+Runtime answering, it exits 6 and names `npx nylorun up`.
+
+Inside a Project (the nearest `.nylorun/` or `package.json`):
+
+1. Creates the Tenant, named after `package.json` unless a name is given.
+2. Writes the format-1 link and credentials (see below). A Project that is
+   already linked is refused: use `nylo tenant use` or `nylo tenant delete`.
+3. Seeds the Tenant from `.env`: `NYLORUN_SANDBOX`, and the model provider from
+   `MODEL_PROVIDER`, `MODEL`, `MODEL_PROVIDER_API_KEY` (or a credential in
+   `.nylorun/auth.json`) into the Tenant vault. Without them it says to set the
+   provider in Studio or with `nylo configure`.
 
-## Scope
+Outside a Project it creates the Tenant and prints the three `NYLORUN_*`
+exports once; the Host keeps only a hash of the application key.
 
-A project is the default scope: the Runtime's SQLite, credentials, log and pid
-live in `.nylorun/` beside the nearest `package.json`, created on first use and
-added to an existing `.gitignore`. `--global` (and running outside a project)
-uses `~/.nylorun` instead, relocatable with `NYLORUN_HOME`. Both default to
-`127.0.0.1:8787`; `--port` beats `NYLORUN_PORT`, then `PORT`, then the port
-recorded for a running Runtime. `--db` or `NYLORUN_SQLITE_PATH` moves the
-database. `nylorun runtime status --output json` prints the resolved scope for
-scripts, and `nylorun logs [-f]` tails the Runtime's own output.
+## Project link
 
-Runtime and executor credentials remain separate. On first `configure`, `dev` or
-`serve`, an interactive terminal saves the model provider credential into the
-Runtime vault; `configure` replaces it while the Runtime is already running.
+A **Project** stores only:
+
+- `.nylorun/link.json`: `{ format, hostUrl, hostId, tenantId }`
+- `.nylorun/credentials.json`: application key and principal id (0600), no
+  executor tokens
+- `.nylorun/.gitignore` containing `*`
+
+`connectAgents` in `@nylorun/agents` reads the link (or the three variables),
+so the project's `npm run dev` and `npm start` need no Nylorun tool.
+
+```sh
+eval "$(npx @nylorun/cli env)"
+# → NYLORUN_RUNTIME_URL, NYLORUN_SERVER_KEY, NYLORUN_TENANT
+```
 
 ## Exit codes
 
 | Code | Meaning |
 | --- | --- |
-| 0 | Success, including `down` when nothing was running |
+| 0 | Success |
 | 1 | Generic failure |
-| 2 | Usage error |
-| 3 | `runtime status` or `logs`: not running |
-| 4 | Port held by another process or another scope |
-| 5 | The running Runtime does not match this CLI |
-| 6 | `--no-autostart` and nothing is listening |
-| 7 | The Runtime did not become healthy |
+| 2 | Usage error, or a moved or removed command |
+| 6 | No Runtime at the linked or local URL |
 | 130 / 143 | SIGINT / SIGTERM |
 
-`dev` loads `agents/index.ts` using project-installed `tsx` and watches changes.
-Studio and `tsx` are optional development dependencies; the CLI is a production
-dependency when the application's `start` script uses it.
+## Troubleshooting
+
+| Symptom | What to do |
+| --- | --- |
+| No Runtime answers | `npx nylorun up`, then `npx nylorun status` |
+| Quarantined Tenant | `nylo tenant status` shows the reason and `repair` |
+| `426` from the Runtime | Upgrade the CLI, or pin a matching older set |
 
-Reusable provider configuration is imported from `@nylorun/runtime/configuration`;
-interactive prompts and process supervision belong here. Neither runtime nor
-harness depends on this package. See [package architecture](../docs/design/package-architecture.md).
+See [MIGRATION.md](../MIGRATION.md).

package/dist/baseline.d.ts

@@ -0,0 +1,2 @@
+/** Frozen map captured when this module first loads. */
+export declare function baselineEnv(): Readonly<Record<string, string | undefined>>;

package/dist/baseline.js

@@ -0,0 +1,10 @@
+/**
+ * Snapshot of the process environment at CLI module load.
+ */
+const snapshot = Object.freeze({
+    ...process.env,
+});
+/** Frozen map captured when this module first loads. */
+export function baselineEnv() {
+    return snapshot;
+}

package/dist/cli.d.ts

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-export {};
+import "./baseline.js";

package/dist/cli.js

@@ -1,46 +1,42 @@
 #!/usr/bin/env node
-import { join } from "node:path";
-import { pathToFileURL } from "node:url";
-import { createRequire } from "node:module";
-import { ConfigurationCancelled, configureProvider, } from "./model/configure.js";
+import "./baseline.js";
+import { ConfigurationCancelled, configureProvider, fetchModelCatalog, } from "./model/configure.js";
 import { putHostModel } from "./model/host-model.js";
-import { develop, developmentPreflight } from "./dev.js";
 import { CliError } from "./errors.js";
-import { loadScopeEnvironment, resolveScope, } from "./scope.js";
-import { cliRuntimeVersion, ensureRuntime, hostStatus, startHost, stopHost, tailLog, warnIncompatible, } from "./runtime-host.js";
-import { localCredentials } from "./project-runner.js";
-const usage = `nylorun <runtime|up|down|logs|dev|serve|configure|studio|doctor>
+import { findProjectRoot } from "./project/root.js";
+import { printLinkedEnvExports } from "./project/env.js";
+import { readLink as readProjectLink } from "./project/link.js";
+import { readCredentials as readProjectCredentials } from "./project/credentials.js";
+import { tenantCommand } from "./tenant/commands.js";
+const usage = `nylo <tenant|configure|env|doctor>
 
-  runtime start [--foreground] [--restart] [--port <n>] [--db <path>] [--global]
-  runtime stop [--global] [--timeout <seconds>]
-  runtime status [--output json] [--global]
-  runtime logs [-f] [-n <lines>] [--global]
-  up                       alias for "runtime start"
-  down                     alias for "runtime stop"
-  logs                     alias for "runtime logs"
+Runtime client (the local stack's Runtime, or any Runtime by URL and key):
+  tenant create [name]                    create a Tenant; in a Project, link it and seed it from .env
+  tenant current|list [--json]|use <name-or-id>|status [--json]|reset|delete
+  configure                               set the linked Tenant's model provider
+  env                                     print the linked Project's NYLORUN_* variables as exports
+  doctor sandbox [--json]                 show which sandbox backend this Tenant's Host offers
 
-  dev [--no-studio] [--no-open] [--no-autostart] [--port <n>]
-  serve [entry] [--no-autostart] [--port <n>]
-  configure [--global]
-  studio [--runtime-url <http(s)-url>] [--port <n>] [--no-open]
-  doctor sandbox [--json]  show which sandbox backend this machine offers`;
-/**
- * Flags are parsed before the scope is resolved so --port can win over a PORT in .env, which
- * is only loaded once the project root is known.
- */
+The local stack is managed by the nylorun package: npx nylorun up|down|status|logs|studio`;
+/** Local stack commands, which moved to the nylorun package. */
+const STACK_COMMANDS = new Set([
+    "up", "down", "start", "stop", "status", "logs", "studio", "reset", "stack", "runtime", "restart", "run",
+]);
 function parseFlags(args, allowed = {}) {
     const booleans = new Set();
     const values = new Map();
     const rest = [];
-    const scope = {};
-    const booleanNames = new Set(["--global", ...(allowed.booleans ?? [])]);
-    const valueNames = new Set(["--port", "--db", ...(allowed.values ?? [])]);
+    const booleanNames = new Set(allowed.booleans ?? []);
+    const valueNames = new Set(allowed.values ?? []);
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (!arg.startsWith("-")) {
             rest.push(arg);
             continue;
         }
+        if (arg === "--global" || arg === "--db") {
+            throw usageError(`${arg} was removed. Use the Runtime Host root (NYLORUN_HOME) and a Project link instead.`);
+        }
         if (booleanNames.has(arg)) {
             if (booleans.has(arg))
                 throw usageError(`${arg} may only be supplied once.`);
@@ -58,246 +54,81 @@ function parseFlags(args, allowed = {}) {
         }
         throw usageError(usage);
     }
-    if (booleans.has("--global"))
-        scope.global = true;
-    if (values.has("--port"))
-        scope.port = parsePort(values.get("--port"));
-    if (values.has("--db"))
-        scope.db = values.get("--db");
-    return { scope, rest, booleans, values };
+    return { rest, booleans, values };
 }
 const usageError = (message) => new CliError(message, 2);
-function parsePort(value) {
-    if (value === undefined)
-        return undefined;
-    const port = Number(value);
-    if (!Number.isInteger(port) || port < 1 || port > 65535)
-        throw usageError("--port must be an integer between 1 and 65535.");
-    return port;
-}
-async function serverKeyFor(scope) {
-    return (process.env.NYLORUN_SERVER_KEY ??
-        (await localCredentials(scope.credentialsPath)).serverKey);
-}
-async function startStudio(agentServerUrl, serverKey, open, port) {
-    let entry;
-    try {
-        entry = createRequire(join(process.cwd(), "package.json")).resolve("@nylorun/studio");
+async function resolveLinkedAuth(projectRoot) {
+    const link = await readProjectLink(projectRoot);
+    const credentials = await readProjectCredentials(projectRoot);
+    if (link && credentials) {
+        return {
+            url: link.hostUrl,
+            key: credentials.applicationKey,
+            tenantId: link.tenantId,
+            tenantName: link.tenantId,
+        };
     }
-    catch {
-        throw new Error("Install @nylorun/studio to use the Studio dashboard.");
+    const url = process.env.NYLORUN_RUNTIME_URL?.trim();
+    const key = process.env.NYLORUN_SERVER_KEY?.trim();
+    const tenantId = process.env.NYLORUN_TENANT?.trim();
+    if (url && key && tenantId) {
+        return { url, key, tenantId, tenantName: tenantId };
     }
-    const studio = await import(pathToFileURL(entry).href);
-    return studio.startStudio({
-        runtimeUrl: agentServerUrl,
-        serverKey,
-        open,
-        ...(port === undefined ? {} : { port }),
-    });
-}
-function printStatus(status) {
-    const { scope, runtime } = status;
-    const lines = [
-        ["Scope", `${scope.kind} (${scope.kind === "project" ? scope.root : scope.dataDir})`],
-        ["State", status.state],
-        ["URL", scope.url],
-        ["PID", runtime?.pid ? String(runtime.pid) : status.pid ? String(status.pid) : undefined],
-        ["Runtime", status.version],
-        ["CLI expects", cliRuntimeVersion()],
-        ["Database", scope.sqlitePath],
-        ["Log", scope.logPath],
-        ["Started", runtime?.startedAt],
-    ];
-    const width = Math.max(...lines.map(([label]) => label.length));
-    for (const [label, value] of lines)
-        if (value !== undefined)
-            console.log(`${label.padEnd(width)}  ${value}`);
-}
-async function runtimeCommand(args) {
-    const [verb, ...rest] = args;
-    if (verb === "start") {
-        const flags = parseFlags(rest, { booleans: ["--foreground", "--restart"] });
-        if (flags.rest.length)
-            throw usageError(usage);
-        const scope = resolveScope(flags.scope);
-        loadScopeEnvironment(scope);
-        const before = await hostStatus(scope);
-        if (before.state === "running" && !flags.booleans.has("--restart")) {
-            console.log(`Runtime already running for ${scope.label} at ${scope.url} (pid ${before.runtime?.pid ?? before.pid}).`);
-            warnIncompatible(scope, before);
-            return;
-        }
-        const status = await startHost(scope, {
-            foreground: flags.booleans.has("--foreground"),
-            restart: flags.booleans.has("--restart"),
-        });
-        printStatus(status);
-        console.log(`\n→ npx nylorun dev`);
-        return;
-    }
-    if (verb === "stop") {
-        const flags = parseFlags(rest, { values: ["--timeout"] });
-        if (flags.rest.length)
-            throw usageError(usage);
-        const scope = resolveScope(flags.scope);
-        const seconds = flags.values.has("--timeout")
-            ? Number(flags.values.get("--timeout"))
-            : undefined;
-        if (seconds !== undefined && (!Number.isFinite(seconds) || seconds <= 0))
-            throw usageError("--timeout must be a positive number of seconds.");
-        const result = await stopHost(scope, {
-            ...(seconds === undefined ? {} : { timeoutMs: seconds * 1000 }),
-        });
-        console.log(result === "stopped"
-            ? `Stopped the Runtime for ${scope.label}. SQLite and credentials are kept in ${scope.dataDir}.`
-            : `No Runtime is running for ${scope.label}.`);
-        return;
-    }
-    if (verb === "status") {
-        const flags = parseFlags(rest, { values: ["--output"] });
-        if (flags.rest.length)
-            throw usageError(usage);
-        const output = flags.values.get("--output") ?? "text";
-        if (output !== "text" && output !== "json")
-            throw usageError("--output must be text or json.");
-        const scope = resolveScope(flags.scope);
-        const status = await hostStatus(scope);
-        if (output === "json")
-            console.log(JSON.stringify({
-                scope: scope.kind,
-                root: scope.kind === "project" ? scope.root : scope.dataDir,
-                url: scope.url,
-                state: status.state,
-                pid: status.runtime?.pid ?? status.pid ?? null,
-                runtimeVersion: status.version ?? null,
-                cliVersion: cliRuntimeVersion() ?? null,
-                scopeId: status.scopeId ?? null,
-                sqlitePath: scope.sqlitePath,
-                logPath: scope.logPath,
-                startedAt: status.runtime?.startedAt ?? null,
-            }, null, 2));
-        else
-            printStatus(status);
-        if (status.state !== "running")
-            process.exitCode = status.state === "port-conflict" ? 4 : 3;
-        return;
-    }
-    if (verb === "logs") {
-        const flags = parseFlags(rest, { booleans: ["-f"], values: ["-n"] });
-        if (flags.rest.length)
-            throw usageError(usage);
-        const lines = flags.values.has("-n") ? Number(flags.values.get("-n")) : 200;
-        if (!Number.isInteger(lines) || lines < 1)
-            throw usageError("-n must be a positive integer.");
-        await tailLog(resolveScope(flags.scope), {
-            follow: flags.booleans.has("-f"),
-            lines,
-        });
-        return;
-    }
-    throw usageError(usage);
+    throw new CliError(`No Project link in ${projectRoot}. Run nylo tenant create, or set NYLORUN_RUNTIME_URL, NYLORUN_SERVER_KEY and NYLORUN_TENANT.`, 1);
 }
 async function main() {
-    const [rawCommand, ...rawArgs] = process.argv.slice(2);
-    if (!rawCommand || rawCommand === "--help" || rawCommand === "-h")
+    const [command, ...args] = process.argv.slice(2);
+    if (!command || command === "--help" || command === "-h")
         return void console.log(usage);
-    const aliases = {
-        up: "start",
-        down: "stop",
-        logs: "logs",
-    };
-    const command = rawCommand in aliases ? "runtime" : rawCommand;
-    const args = rawCommand in aliases ? [aliases[rawCommand], ...rawArgs] : rawArgs;
-    if (command === "runtime")
-        return await runtimeCommand(args);
+    if (process.platform === "win32")
+        throw new CliError("Nylorun does not run on native Windows. Use WSL2: install Node 24 and Docker (Docker Desktop's WSL integration) inside your WSL distribution and run nylorun there (https://learn.microsoft.com/windows/wsl/install).", 1);
+    if (command === "tenant")
+        return await tenantCommand(args);
+    if (command === "env") {
+        if (args.length)
+            throw usageError("Usage: nylo env");
+        await printLinkedEnvExports(findProjectRoot() ?? process.cwd());
+        return;
+    }
     if (command === "doctor") {
         const [topic, ...options] = args;
         if (topic !== "sandbox" || options.some((option) => option !== "--json"))
-            throw usageError("Usage: nylorun doctor sandbox [--json]");
+            throw usageError("Usage: nylo doctor sandbox [--json]. Check the local stack with npx nylorun doctor.");
         const { doctorSandbox } = await import("./doctor.js");
         await doctorSandbox({ json: options.includes("--json") });
         return;
     }
-    if (command === "dev") {
-        const flags = parseFlags(args, {
-            booleans: ["--no-studio", "--no-open", "--no-autostart"],
-        });
-        if (flags.rest.length)
-            throw usageError(usage);
-        const scope = resolveScope(flags.scope);
-        loadScopeEnvironment(scope);
-        // The port is re-resolved after .env so a project file can set PORT, while --port wins.
-        const resolved = resolveScope(flags.scope);
-        process.env.PORT = String(resolved.port);
-        developmentPreflight([...flags.booleans]);
-        // The supervisor checks the host before spawning tsx so port conflicts, version skew and
-        // --no-autostart surface with their own exit codes instead of a generic watcher failure.
-        await ensureRuntime(resolved, {
-            autostart: !flags.booleans.has("--no-autostart"),
-        });
-        process.exitCode = await develop([...flags.booleans]);
-        return;
-    }
-    if (command === "serve") {
-        const flags = parseFlags(args, { booleans: ["--no-autostart"] });
-        if (flags.rest.length > 1)
-            throw usageError(usage);
-        const scope = resolveScope(flags.scope);
-        loadScopeEnvironment(scope);
-        const resolved = resolveScope(flags.scope);
-        // serve runs the project in this process, so runProject's own errors carry their exit
-        // codes out; it validates the agent registry before it touches the host.
-        await (await import("./launcher.js")).serve(flags.rest[0], {
-            autostart: !flags.booleans.has("--no-autostart"),
-            scope: resolved,
-        });
-        return;
-    }
+    if (command === "dev")
+        throw usageError("nylorun dev was removed: run nylo tenant create once in your project, then your project's npm run dev.");
+    if (STACK_COMMANDS.has(command))
+        throw usageError(`The local stack moved to the nylorun package: npx nylorun ${command}`);
     if (command === "configure") {
         const flags = parseFlags(args);
         if (flags.rest.length)
             throw usageError(usage);
-        const scope = resolveScope(flags.scope);
-        loadScopeEnvironment(scope);
+        const projectRoot = findProjectRoot() ?? process.cwd();
+        const auth = await resolveLinkedAuth(projectRoot);
         const controller = new AbortController();
         const cancel = (signal) => controller.abort(new ConfigurationCancelled(signal));
         process.once("SIGINT", () => cancel("SIGINT"));
         process.once("SIGTERM", () => cancel("SIGTERM"));
-        const serverKey = await serverKeyFor(scope);
-        const health = await fetch(`${scope.url}/health`).catch(() => undefined);
+        const health = await fetch(`${auth.url}/health`).catch(() => undefined);
         if (!health?.ok)
-            throw new CliError(`No Runtime is listening at ${scope.url} for ${scope.label}. Start one with "nylorun up".`, 6);
-        const prompted = await configureProvider({ signal: controller.signal });
-        await putHostModel(scope.url, serverKey, prompted);
+            throw new CliError(`No Runtime is listening at ${auth.url}. Start the local stack with "npx nylorun up".`, 6);
+        const catalog = await fetchModelCatalog({
+            url: auth.url,
+            key: auth.key,
+            tenantId: auth.tenantId,
+        });
+        const prompted = await configureProvider({
+            signal: controller.signal,
+            catalog,
+        });
+        await putHostModel(auth.url, auth.key, prompted, auth.tenantId);
         return;
     }
-    if (command !== "studio")
-        throw usageError(usage);
-    const flags = parseFlags(args, {
-        booleans: ["--no-open"],
-        values: ["--runtime-url", "--studio-port"],
-    });
-    if (flags.rest.length)
-        throw usageError(usage);
-    const scope = resolveScope(flags.scope);
-    const runtimeUrl = flags.values.get("--runtime-url") ?? scope.url;
-    const studioPort = flags.values.has("--studio-port")
-        ? parsePort(flags.values.get("--studio-port"))
-        : flags.scope.port !== undefined && flags.values.has("--runtime-url")
-            ? flags.scope.port
-            : undefined;
-    const dashboard = await startStudio(runtimeUrl, await serverKeyFor(scope), !flags.booleans.has("--no-open"), studioPort);
-    console.log(`Studio on ${dashboard.address}`);
-    await new Promise((resolve, reject) => {
-        const close = () => void dashboard.close().then(resolve, reject);
-        process.once("SIGINT", close);
-        process.once("SIGTERM", close);
-    });
+    throw usageError(usage);
 }
-/**
- * Probing a port that answers but is not a Runtime can leave a pooled connection holding the
- * event loop open, so a finished command exits explicitly once its output has drained.
- */
 async function finish(code) {
     process.exitCode = code;
     for (const stream of [process.stdout, process.stderr])

package/dist/doctor.d.ts

@@ -1,7 +1,18 @@
-import type { AgentManifest } from "@nylorun/agents";
-/** `nylorun doctor sandbox`: what this machine offers and what a Runtime here would pick. */
+export type SandboxReport = {
+    preference: string;
+    backend: string | null;
+    isolation?: string;
+    reason?: string;
+    probes: {
+        name: string;
+        isolation: string;
+        available: boolean;
+        reason?: string;
+        version?: string;
+    }[];
+    defaultImage?: string;
+};
+/** `nylo doctor sandbox`: Tenant sandbox report via the Tenant API (F2-4). */
 export declare function doctorSandbox(options: {
     json: boolean;
 }): Promise<void>;
-/** One line for the dev banner, or undefined when no connected agent declares a sandbox. */
-export declare function sandboxBanner(runtimeUrl: string, serverKey: string, manifests: readonly AgentManifest[]): Promise<string | undefined>;