@nylorun/cli 0.6.0-beta → 0.8.0-beta

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # @nylorun/cli
 
+## 0.8.0-beta
+
+### Minor Changes
+
+- 4b9906f: **Breaking: "Tenant" replaces "stack", and `nylorun start` works anywhere.** Each local installation holds one Tenant, and its name is the Tenant's name, so help, output, errors and docs say Tenant. See MIGRATION.md.
+
+  - **Breaking (`nylorun`): selection.** Every command acts on the Tenant `--tenant <name>` names (replaces `--name`, which is removed), else `NYLORUN_TENANT` (replaces `NYLORUN_STACK`), else the Project link's `tenant`; `start` in a project names a new one after the project directory. Outside a project, or with `start --no-link`, commands act on the Tenant `default`. In a project without a link, commands other than `start` exit 2 and list the machine's Tenants. A name starting with `tn_` (a Tenant id) is refused.
+  - **Breaking (`nylorun`): files.** Host roots are under `~/.nylorun/tenants/<name>/` (was `~/.nylorun/stacks/<name>/`) with `tenant.json` (was `stack.json`); the `.env` key is `NYLORUN_TENANT_NAME` (was `NYLORUN_STACK_NAME`); `NYLORUN_COMPOSE_PROJECT` replaces `NYLORUN_STACK_PROJECT`. Compose projects stay `nylorun-<name>`. Every command first moves 0.4 Host roots from `~/.nylorun/stacks/` to `~/.nylorun/tenants/` (renaming `stack.json` and the `.env` key), so they keep their volumes and keys. `nylorun ls` lists only directories with `tenant.json`.
+  - **Breaking (`nylorun`): removed.** `nylorun legacy` and all handling of the single stack of releases before 0.4; the hidden `nylorun stack <cmd>` alias; `nylorun doctor stack|runtime`. Output says Tenant: `ls` prints `TENANT` and JSON `{ "tenants": [...] }`, `status` prints the Tenant id on its own line, and `doctor`'s row is `tenant`.
+  - **Breaking: Project link format 3.** `.nylorun/link.json` is `{ "format": 3, "tenant", "tenantId", "hostUrl", "hostId" }`; `tenant` replaces `stack`. `@nylorun/agents`, `@nylorun/cli` and `@nylorun/admin` refuse an older link and name `npx nylorun start`, which rewrites it. `@nylorun/core`'s `ProjectLinkFileSchema` parses formats 0–3 with `tenant`.
+  - **Breaking (`@nylorun/admin`):** `createAdmin({ tenant })` replaces `{ stack }`, `tenantHostRoot(name)` replaces `stackHostRoot(name)`, and local resolution reads `NYLORUN_TENANT` and the link's `tenant`.
+  - `@nylorun/cli`: `status` and `endpoints` drop the `stack` line and JSON key; messages say Tenant. `@nylorun/agents`: a Runtime too old for the client says "update the Runtime (npx nylorun@latest start)". `@nylorun/studio`: setup hints say Tenant. `@nylorun/create-agent`: the next steps describe `npx nylorun@beta start` as this project's Tenant and its link.
+
+### Patch Changes
+
+- Pin agents to the tested release.
+- Pin admin to the tested release.
+- Updated dependencies [4b9906f]
+- Updated dependencies
+- Updated dependencies
+  - @nylorun/agents@0.12.0-beta
+  - @nylorun/admin@0.8.0-beta
+
+## 0.7.0-beta
+
+### Major Changes
+
+- 5ca1923: **Clients for one Tenant per installation: a stack per project, nothing selects a Tenant.** Upgrade these with the Runtime; they speak protocol 5. Existing stacks are left as they are: see MIGRATION.md.
+
+  - **Breaking (`nylorun`): one stack per project.** `nylorun start` in a project creates the project's stack (named after the project directory, or `--name`; Host root `~/.nylorun/stacks/<name>/`, Compose project `nylorun-<name>`, its own free ports and volumes), waits for its Runtime to create the stack's Tenant, writes the Project link (`.nylorun/link.json` format 2: `stack`, `hostUrl`, `hostId`, `tenantId`) and `.nylorun/credentials.json` (the key of the derived principal `project`, derived from the stack's admin key), and seeds the model provider from the project's `.env`. `nylorun ls` lists the machine's stacks and `nylorun delete <name>` removes one with its volumes and Host root. `nylorun status` shows the stack's Tenant; `nylorun studio` opens it. The old single stack under `~/.nylorun` is never touched: `start` notes it, and `nylorun legacy stop|delete` handles it. Every stack command takes `--name <stack>` (or `NYLORUN_STACK`, or the Project link's stack); `start --no-link` starts a stack without linking the directory; `nylorun reset` resets the selected stack only. The runtime container's healthcheck is now `/health`, so a Tenant that cannot open is reported by `start` from the Admin status at once instead of after a 300 s wait. `NYLORUN_HOME` still overrides the Host root. Stacks start and stop only when you say so.
+  - **Breaking (`@nylorun/cli`): no Tenant commands.** `nylo tenant create|use|list|current|delete` are removed; `nylo status`, `nylo reset` and `nylo endpoints` replace `nylo tenant status|reset|endpoints` on the linked installation. `nylo env` prints `NYLORUN_RUNTIME_URL` and `NYLORUN_SERVER_KEY` only. `nylo` no longer writes Project links.
+  - **Breaking (`@nylorun/agents`): no Tenant to name.** The `tenant` option (`createClient`, `Transport`, `resolveConnection`, `createActionHandler({ runtime })`, `JwksCache`) and `NYLORUN_TENANT` are gone, and no request sends `Nylorun-Tenant`; a connection is a URL and a key. A Project link of format 0 or 1 is refused with `connection_missing`, naming `npx nylorun start`. `verifyDeliveryToken`'s `tenantId` is optional: without it any Tenant issuer is accepted, since the installation's keys bind it. `TENANT_HEADER` is no longer re-exported.
+  - **Breaking (`@nylorun/admin`): status only.** `createTenant`, `listTenants`, `getTenant` and `deleteTenant` are removed; `status().tenant` names the Host's Tenant, and `deriveTenantKey` / `deriveStudioToken` derive its keys. Local Host resolution reads the stack's Host root (`stack` option, `NYLORUN_STACK`, or the Project link's `stack`); `NYLORUN_HOME` and `home` still override it. `stackHostRoot(name)` is exported.
+  - **Breaking (`@nylorun/studio`): Studio serves its installation's Tenant.** The Tenant picker, list and create are gone, with `/_studio/tenants`; `/` opens `/tenants/<id>`. The `/tenants/:tenant` routes and the login token's `tenant` claim stay for embedders and must name that Tenant. The proxy sends no `Nylorun-Tenant`.
+  - **`@nylorun/create-agent`:** the next steps are `npx nylorun start`, then `npm run dev`.
+  - `@nylorun/core`: `ProjectLinkFileSchema` accepts format 2 with `stack`, and `tenantId` is optional; `ERROR_CODES` loses `tenant_conflict` and `active_work`.
+
+- 5ca1923: **One Tenant per installation: a database per Tenant, protocol 5.** A Runtime serves exactly one Tenant, the one its Postgres database holds. Two Tenants are two installations.
+
+  - **Breaking: fresh start.** The Tenant's state is in the fixed schema `nylorun` of its own database and its record in `nylorun_streams`, keyed by session (no `tenant_id`). A database written by an earlier Runtime (`tenant_<id>` schemas, or a record keyed by Tenant) is refused: the Host stays up but not ready, and `/v1/admin/status` names the cause `database-layout-old`. Point the Runtime at a new database (with the local stack, a new stack); the old one is never changed.
+  - **The Host creates its Tenant** on first start, in the migration transaction: `NYLORUN_TENANT_ID` (default a new id), `NYLORUN_TENANT_NAME` (default `default`), the Studio principal and the derived principals of `NYLORUN_DERIVED_PRINCIPALS` (comma-separated, default `project`), whose keys the admin key derives (`deriveTenantKey`). Later starts open the same Tenant and add derived principals configured since.
+  - **Breaking: no Tenant catalog.** `/v1/admin/tenants` and `/v1/admin/tenants/{tenantId}` are gone (404). `AdminStatus.tenants[]` is replaced by `AdminStatus.tenant` (`id`, `name`, `state: open | unavailable`, `envelope`, and `cause` when it could not be opened). `CreateTenantRequestSchema`, `AdminTenantSchema`, `AdminTenantStatusSchema`, `AdminTenantListSchema` and `QuarantineSchema` leave `@nylorun/core`; `HostTenantSchema` and `TenantCauseSchema` replace them. `@nylorun/admin`'s `listTenants`, `getTenant`, `deleteTenant` and `createTenant` are removed (see below).
+  - **Readiness instead of quarantine.** A Tenant that cannot be opened (`schema-too-new`, `kek-missing`, `migration-failed`, `envelope-invalid`, `database-layout-old`, …) fails `/ready` (check `tenant`, which replaces `discovery`) and is reported with its repair in `/v1/admin/status` and the log; every Tenant request gets the opaque 404. A failure outside it (Postgres unreachable) is retried.
+  - **Protocol 5.** `PROTOCOL_VERSION = 5`; the Host serves protocols 4 and 5 for one release. Clients no longer require `runtime-tenants`; the Host still advertises it. No request needs `Nylorun-Tenant`: a request without it reaches the Host's Tenant, and one naming another Tenant (or a malformed one), or a publishable key of another Tenant, gets the opaque 404. The OpenAPI documents drop the header parameter and the Admin Tenant routes.
+  - **Paths.** The Tenant directory is `<Host root>/tenant/` (was `tenants/<id>/`); `trash/` and the SQLite move to it are gone. The gates service serves its database's Tenant, and its `Nylorun-Tenant` header is optional (when sent, it must name that Tenant).
+  - **Breaking: `startEphemeralRuntime` needs a database; the in-memory Session Store is removed.** `StartEphemeralRuntimeOptions.database` is required: a Postgres URL, for which the Runtime opens a pool and ends it on `close()`, or a pool the caller ends. It creates its Tenant in that database through the same bootstrap as a Host, or serves the Tenant the database already holds; the data stays after `close()`, so give each test Tenant a database of its own. Durable Streams and scheduling stay in process. See `MIGRATION.md`.
+
+### Patch Changes
+
+- Pin agents to the tested release.
+- Pin admin to the tested release.
+- Updated dependencies [5ca1923]
+- Updated dependencies [5ca1923]
+- Updated dependencies
+- Updated dependencies
+  - @nylorun/agents@0.11.0-beta
+  - @nylorun/admin@0.7.0-beta
+
 ## 0.6.0-beta
 
 ### Minor Changes

package/README.md

@@ -1,83 +1,74 @@
 # @nylorun/cli
 
-The Runtime client, command `nylo`: it acts on a Runtime's Tenants, the local
-stack's or any Runtime reachable by URL and key. Setting up and running the
-local stack is [`nylorun`](../nylorun/README.md)'s job; the two packages are
-independent and never call each other. Depends on `@nylorun/agents` and
-`@nylorun/admin` only among Nylorun packages. Vocabulary:
+The Runtime client, command `nylo`: it acts on the one Tenant of an
+installation, a local Tenant or any Runtime reachable by URL and key. Setting up
+and running local Tenants is [`nylorun`](../nylorun/README.md)'s job; the two
+packages are independent and never call each other. Depends on
+`@nylorun/agents` and `@nylorun/admin` only among Nylorun packages. Vocabulary:
 [runtime/src/CONTEXT.md](../runtime/src/CONTEXT.md).
 
 ```sh
-npx nylorun up                        # the local stack (nylorun)
-npx @nylorun/cli tenant create        # this project's Tenant, linked in .nylorun/
-npx @nylorun/cli tenant use <id>      # or: link a Tenant created in Studio
+npx nylorun start                     # in the project: its Tenant and the Project link
+npx @nylorun/cli status               # the linked Tenant
 ```
 
 ## Commands
 
 ```sh
-nylo tenant create [name]             # create a Tenant; in a Project, link it and seed it from .env
-nylo tenant current|list [--json]|use <name-or-id>|status [--json]|reset|delete
-nylo configure                        # set or replace the model provider on the linked Tenant
+nylo status [--json]                  # the Tenant, its checks and counts
+nylo reset [--sessions|--sandboxes|--all] [--yes]
+nylo endpoints [--json]|ping <agent>  # the registered Action endpoints and their health
+nylo access …                         # access policy, publishable and signing keys, subject tokens
+nylo configure                        # set or replace the Tenant's model provider
 nylo env                              # export lines for the linked Project
 nylo doctor sandbox [--json]          # sandbox backend via the Tenant API
 ```
 
-Local stack commands (`up`, `down`, `start`, `stop`, `status`, `logs`,
-`studio`, `reset`) exit 2 naming `npx nylorun <command>`. `nylorun dev` was
-removed: link once with `nylo tenant create`, then run the project's own
-`npm run dev` (`tsx watch src/main.ts`).
+Every command acts on the linked installation: the Project link and
+credentials (below), or `NYLORUN_RUNTIME_URL` and `NYLORUN_SERVER_KEY` when the
+Project has no link. An installation serves one Tenant, so nothing selects it.
 
-## `nylo tenant create`
+Local Tenant commands (`up`, `down`, `start`, `stop`, `logs`, `studio`) exit 2
+naming `npx nylorun <command>`. `nylo tenant …` exits 2: `npx nylorun start`
+creates the project's Tenant and the link, and `nylo status|reset|endpoints`
+replace `nylo tenant status|reset|endpoints`. `nylorun dev` was removed: run
+`npx nylorun start` once, then the project's own `npm run dev`
+(`tsx watch src/main.ts`).
 
-The Admin API connection resolves from `NYLORUN_ADMIN_URL` and
-`NYLORUN_ADMIN_KEY`, else from the local Host root (`NYLORUN_HOME` or
-`~/.nylorun`: `host.json` and the admin key that `nylorun up` wrote). With no
-Runtime answering, it exits 6 and names `npx nylorun up`.
+## `nylo status`
 
-Inside a Project (the nearest `.nylorun/` or `package.json`):
+Reads the Tenant API status (`GET /v1/tenant`) and prints the Tenant, the
+Runtime URL, the checks, the counts and the sandbox
+backend. When the Tenant is not open it does not answer; `nylo status` then
+asks the Admin API (`/v1/admin/status`, through the local Tenant's Host root or
+`NYLORUN_ADMIN_URL` and `NYLORUN_ADMIN_KEY`) and prints why, with the repair.
 
-1. Creates the Tenant, named after `package.json` unless a name is given.
-2. Writes the format-1 link and credentials (see below). A Project that is
-   already linked is refused: use `nylo tenant use` or `nylo tenant delete`.
-3. Seeds the Tenant from `.env`: `NYLORUN_SANDBOX`, and the model provider from
-   `MODEL_PROVIDER`, `MODEL`, `MODEL_PROVIDER_API_KEY` (or a credential in
-   `.nylorun/auth.json`) into the Tenant vault. Without them it says to set the
-   provider in Studio or with `nylo configure`.
+## `nylo reset`
 
-Outside a Project it creates the Tenant and prints the three `NYLORUN_*`
-exports once; the Host keeps only a hash of the application key.
-
-## `nylo tenant use <name-or-id>`
-
-Links the Project to another Tenant on the local Host. It uses the first key
-that the Tenant accepts:
-
-1. The Project's `.nylorun/credentials.json`.
-2. A key it kept when the Project last left that Tenant
-   (`.nylorun/credentials.<tenantId>.json`).
-3. The key of the derived principal `project`, computed from this machine's
-   admin key. Every Tenant created in Studio registers that principal, so
-   Studio's **Connect your code** step needs only this command.
-
-When it replaces an application key (shown only once, when the Tenant was
-created), it keeps that key as `.nylorun/credentials.<tenantId>.json`, so
-`nylo tenant use <that id>` switches back.
+Clears the Tenant's sessions (the default), its sandboxes, or all its data
+(`--all`), after draining work in flight. `--all` asks first; pass `--yes` when
+not in a terminal. The Project link and credentials are kept.
 
 ## Project link
 
-A **Project** stores only:
+`npx nylorun start` writes it; `nylo` only reads it. A **Project** stores only:
 
-- `.nylorun/link.json`: `{ format, hostUrl, hostId, tenantId }`
-- `.nylorun/credentials.json`: application key and principal id (0600)
+- `.nylorun/link.json`: `{ format: 3, tenant, hostUrl, hostId, tenantId }`
+  (`tenant` is the local Tenant's name; `tenantId` is information)
+- `.nylorun/credentials.json`: the key of the derived principal `project` and
+  its id (0600)
 - `.nylorun/.gitignore` containing `*`
 
-`createActionHandler` and `createClient` in `@nylorun/agents` read the link (or the three variables),
-so the project's `npm run dev` and `npm start` need no Nylorun tool.
+A link from an older nylorun (format 0 to 2): `nylo` refuses it and says to run
+`npx nylorun start`, which links the project again.
+
+`createActionHandler` and `createClient` in `@nylorun/agents` read the link (or
+the two variables), so the project's `npm run dev` and `npm start` need no
+Nylorun tool.
 
 ```sh
 eval "$(npx @nylorun/cli env)"
-# → NYLORUN_RUNTIME_URL, NYLORUN_SERVER_KEY, NYLORUN_TENANT
+# → NYLORUN_RUNTIME_URL, NYLORUN_SERVER_KEY
 ```
 
 ## Exit codes
@@ -94,8 +85,9 @@ eval "$(npx @nylorun/cli env)"
 
 | Symptom | What to do |
 | --- | --- |
-| No Runtime answers | `npx nylorun up`, then `npx nylorun status` |
-| Quarantined Tenant | `nylo tenant status` shows the reason and `repair` |
+| No Runtime answers | `npx nylorun start`, then `npx nylorun status` |
+| Tenant not open | `nylo status` shows the cause and its `repair` |
+| Old Project link refused | `npx nylorun start` in the project |
 | `426` from the Runtime | Upgrade the CLI, or pin a matching older set |
 
 See [MIGRATION.md](../MIGRATION.md).

package/dist/access/commands.js

@@ -46,11 +46,7 @@ async function linkedClient() {
     catch (error) {
         throw new CliError(error instanceof Error ? error.message : String(error), 1);
     }
-    return createClient({
-        url: connection.url,
-        key: connection.key,
-        tenant: connection.tenant,
-    });
+    return createClient({ url: connection.url, key: connection.key });
 }
 const print = (value) => console.log(JSON.stringify(value, null, 2));
 function option(args, name) {

package/dist/cli.js

@@ -5,16 +5,17 @@ import { putHostModel } from "./model/host-model.js";
 import { CliError } from "./errors.js";
 import { findProjectRoot } from "./project/root.js";
 import { printLinkedEnvExports } from "./project/env.js";
-import { readLink as readProjectLink } from "./project/link.js";
-import { readCredentials as readProjectCredentials } from "./project/credentials.js";
-import { tenantCommand } from "./tenant/commands.js";
+import { linkedConnection } from "./project/connection.js";
 import { accessCommand } from "./access/commands.js";
-const usage = `nylo <tenant|access|configure|env|doctor>
+import { endpointsCommand, resetCommand, statusCommand, } from "./installation/commands.js";
+const usage = `nylo <status|reset|endpoints|access|configure|env|doctor>
 
-Runtime client (the local stack's Runtime, or any Runtime by URL and key):
-  tenant create [name]                    create a Tenant; in a Project, link it and seed it from .env
-  tenant use <name-or-id>                 link this Project to a Tenant, e.g. one created in Studio
-  tenant current|list [--json]|status [--json]|reset|delete
+Runtime client for the linked installation and its one Tenant (the Project link that
+npx nylorun start writes, or NYLORUN_RUNTIME_URL and NYLORUN_SERVER_KEY):
+  status [--json]                         the Tenant, its checks and counts
+  reset [--sessions|--sandboxes|--all] [--yes]
+                                          clear the Tenant's sessions, sandboxes or all its data
+  endpoints [--json]|ping <agent>         the registered Action endpoints and their health
   access policy get|set <file>|init       the access policy for subject tokens (nylo access --help)
   access keys list|create|set-origins|revoke  publishable keys for web pages and apps
   access signing-keys list|rotate|revoke  the Tenant's token signing keys
@@ -24,11 +25,15 @@ Runtime client (the local stack's Runtime, or any Runtime by URL and key):
   env                                     print the linked Project's NYLORUN_* variables as exports
   doctor sandbox [--json]                 show which sandbox backend this Tenant's Host offers
 
-The local stack is managed by the nylorun package: npx nylorun up|down|status|logs|studio`;
-/** Local stack commands, which moved to the nylorun package. */
-const STACK_COMMANDS = new Set([
-    "up", "down", "start", "stop", "status", "logs", "studio", "reset", "stack", "runtime", "restart", "run",
+Local Tenants are run by the nylorun package: npx nylorun start in a project creates its
+Tenant and the Project link.`;
+/** Local Tenant commands, which the nylorun package runs. */
+const LOCAL_COMMANDS = new Set([
+    "up", "down", "start", "stop", "logs", "studio", "runtime", "restart", "run",
 ]);
+const TENANT_REMOVED = `nylo tenant was removed: an installation serves one Tenant.
+Run "npx nylorun start" in your project to create its Tenant and the Project link.
+Then use nylo status, nylo reset and nylo endpoints on the linked installation.`;
 function parseFlags(args, allowed = {}) {
     const booleans = new Set();
     const values = new Map();
@@ -64,25 +69,6 @@ function parseFlags(args, allowed = {}) {
     return { rest, booleans, values };
 }
 const usageError = (message) => new CliError(message, 2);
-async function resolveLinkedAuth(projectRoot) {
-    const link = await readProjectLink(projectRoot);
-    const credentials = await readProjectCredentials(projectRoot);
-    if (link && credentials) {
-        return {
-            url: link.hostUrl,
-            key: credentials.applicationKey,
-            tenantId: link.tenantId,
-            tenantName: link.tenantId,
-        };
-    }
-    const url = process.env.NYLORUN_RUNTIME_URL?.trim();
-    const key = process.env.NYLORUN_SERVER_KEY?.trim();
-    const tenantId = process.env.NYLORUN_TENANT?.trim();
-    if (url && key && tenantId) {
-        return { url, key, tenantId, tenantName: tenantId };
-    }
-    throw new CliError(`No Project link in ${projectRoot}. Run nylo tenant create, or set NYLORUN_RUNTIME_URL, NYLORUN_SERVER_KEY and NYLORUN_TENANT.`, 1);
-}
 async function main() {
     const [command, ...args] = process.argv.slice(2);
     if (!command || command === "--help" || command === "-h")
@@ -90,7 +76,13 @@ async function main() {
     if (process.platform === "win32")
         throw new CliError("Nylorun does not run on native Windows. Use WSL2: install Node 24 and Docker (Docker Desktop's WSL integration) inside your WSL distribution and run nylorun there (https://learn.microsoft.com/windows/wsl/install).", 1);
     if (command === "tenant")
-        return await tenantCommand(args);
+        throw usageError(TENANT_REMOVED);
+    if (command === "status")
+        return await statusCommand(args);
+    if (command === "reset")
+        return await resetCommand(args);
+    if (command === "endpoints")
+        return await endpointsCommand(args);
     if (command === "access") {
         if (args[0] === "--help" || args[0] === "-h" || args.length === 0) {
             const { accessUsage } = await import("./access/commands.js");
@@ -107,38 +99,34 @@ async function main() {
     if (command === "doctor") {
         const [topic, ...options] = args;
         if (topic !== "sandbox" || options.some((option) => option !== "--json"))
-            throw usageError("Usage: nylo doctor sandbox [--json]. Check the local stack with npx nylorun doctor.");
+            throw usageError("Usage: nylo doctor sandbox [--json]. Check the local Tenant with npx nylorun doctor.");
         const { doctorSandbox } = await import("./doctor.js");
         await doctorSandbox({ json: options.includes("--json") });
         return;
     }
     if (command === "dev")
-        throw usageError("nylorun dev was removed: run nylo tenant create once in your project, then your project's npm run dev.");
-    if (STACK_COMMANDS.has(command))
-        throw usageError(`The local stack moved to the nylorun package: npx nylorun ${command}`);
+        throw usageError('nylorun dev was removed: run "npx nylorun start" once in your project, then your project\'s npm run dev.');
+    if (LOCAL_COMMANDS.has(command))
+        throw usageError(`Local Tenants are run by the nylorun package: npx nylorun ${command}`);
     if (command === "configure") {
         const flags = parseFlags(args);
         if (flags.rest.length)
             throw usageError(usage);
         const projectRoot = findProjectRoot() ?? process.cwd();
-        const auth = await resolveLinkedAuth(projectRoot);
+        const auth = await linkedConnection(projectRoot);
         const controller = new AbortController();
         const cancel = (signal) => controller.abort(new ConfigurationCancelled(signal));
         process.once("SIGINT", () => cancel("SIGINT"));
         process.once("SIGTERM", () => cancel("SIGTERM"));
         const health = await fetch(`${auth.url}/health`).catch(() => undefined);
         if (!health?.ok)
-            throw new CliError(`No Runtime is listening at ${auth.url}. Start the local stack with "npx nylorun up".`, 6);
-        const catalog = await fetchModelCatalog({
-            url: auth.url,
-            key: auth.key,
-            tenantId: auth.tenantId,
-        });
+            throw new CliError(`No Runtime is listening at ${auth.url}. Start the local Tenant with "npx nylorun start".`, 6);
+        const catalog = await fetchModelCatalog({ url: auth.url, key: auth.key });
         const prompted = await configureProvider({
             signal: controller.signal,
             catalog,
         });
-        await putHostModel(auth.url, auth.key, prompted, auth.tenantId);
+        await putHostModel(auth.url, auth.key, prompted);
         return;
     }
     throw usageError(usage);

package/dist/doctor.js

@@ -11,11 +11,7 @@ function platformLine() {
 }
 async function fetchSandboxReport(options) {
     const connection = await resolveConnection(options);
-    const client = createClient({
-        url: connection.url,
-        key: connection.key,
-        tenant: connection.tenant,
-    });
+    const client = createClient({ url: connection.url, key: connection.key });
     return client.transport.json("/v1/tenant/sandbox", "GET", undefined);
 }
 /** `nylo doctor sandbox`: Tenant sandbox report via the Tenant API (F2-4). */
@@ -42,7 +38,7 @@ export async function doctorSandbox(options) {
     rows.push([
         "preference",
         report.preference === "auto"
-            ? "auto (seed Tenant sandbox.backend via nylo tenant create / .env NYLORUN_SANDBOX)"
+            ? "auto (npx nylorun start seeds the Tenant's sandbox.backend from .env NYLORUN_SANDBOX)"
             : report.preference,
     ]);
     if (report.config)

package/dist/home.d.ts

@@ -1,6 +1,6 @@
 /**
- * The Host root: an explicit home, `NYLORUN_HOME`, or `~/.nylorun`. The stack
- * bind-mounts it into the Runtime and Studio containers, and `@nylorun/admin`
- * reads `host.json` and the admin key from it.
+ * Where `nylo` keeps its own files (the installation id): an explicit home,
+ * `NYLORUN_HOME`, or `~/.nylorun`, which holds the local Tenants' Host roots
+ * (`tenants/<name>/`). `@nylorun/admin` resolves a Tenant's Host root itself.
  */
 export declare function resolveHome(home?: string, env?: Readonly<Record<string, string | undefined>>): string;

package/dist/home.js

@@ -1,9 +1,9 @@
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 /**
- * The Host root: an explicit home, `NYLORUN_HOME`, or `~/.nylorun`. The stack
- * bind-mounts it into the Runtime and Studio containers, and `@nylorun/admin`
- * reads `host.json` and the admin key from it.
+ * Where `nylo` keeps its own files (the installation id): an explicit home,
+ * `NYLORUN_HOME`, or `~/.nylorun`, which holds the local Tenants' Host roots
+ * (`tenants/<name>/`). `@nylorun/admin` resolves a Tenant's Host root itself.
  */
 export function resolveHome(home, env = process.env) {
     if (home !== undefined && home.trim() !== "")

package/dist/installation/commands.d.ts

@@ -0,0 +1,20 @@
+/** `nylo status [--json]`: the Tenant, its checks and counts; the Host's cause when it is not open. */
+export declare function statusCommand(args: readonly string[]): Promise<void>;
+/** `nylo reset [--sessions|--sandboxes|--all] [--yes]`; `--all` asks first. */
+export declare function resetCommand(args: readonly string[]): Promise<void>;
+/** `nylo endpoints [--json]` and `nylo endpoints ping <agent>`. */
+export declare function endpointsCommand(args: readonly string[]): Promise<void>;
+/** One line of `nylo endpoints`: the agent, its URL and version, and how it is doing. */
+export declare function endpointLine(endpoint: {
+    agentId: string;
+    url: string;
+    implementationVersion: string;
+    health: {
+        consecutiveFailures: number;
+        lastSuccessAt?: string;
+        lastError?: {
+            code: string;
+            message: string;
+        };
+    };
+}): string;

package/dist/installation/commands.js

@@ -0,0 +1,141 @@
+/**
+ * `nylo status`, `nylo reset` and `nylo endpoints`: the linked installation's one Tenant,
+ * through the Tenant API with the Project's application key.
+ */
+import { createInterface } from "node:readline/promises";
+import { randomUUID } from "node:crypto";
+import { createAdmin } from "@nylorun/admin";
+import { createClient } from "@nylorun/agents";
+import { CliError } from "../errors.js";
+import { linkedConnection } from "../project/connection.js";
+import { findProjectRoot } from "../project/root.js";
+const projectRoot = () => findProjectRoot() ?? process.cwd();
+const clientFor = (connection) => createClient({ url: connection.url, key: connection.key });
+/** `nylo status [--json]`: the Tenant, its checks and counts; the Host's cause when it is not open. */
+export async function statusCommand(args) {
+    const json = args.includes("--json");
+    if (args.some((a) => a !== "--json"))
+        throw new CliError("Usage: nylo status [--json]", 2);
+    const root = projectRoot();
+    const connection = await linkedConnection(root);
+    let reason;
+    try {
+        const body = await clientFor(connection).transport.json("/v1/tenant", "GET");
+        if (json) {
+            console.log(JSON.stringify(body, null, 2));
+            return;
+        }
+        console.log(`${body.tenant.name}  ${body.tenant.id}`);
+        console.log(`runtime  ${connection.url}`);
+        console.log(`path     ${body.path}`);
+        console.log(`checks   ${Object.entries(body.checks)
+            .map(([k, v]) => `${k}=${v ? "ok" : "fail"}`)
+            .join(" ")}`);
+        console.log(`counts   sessions=${body.counts.sessions} running=${body.counts.runningSessions} pending=${body.counts.pendingActions}`);
+        console.log(`sandbox  ${body.sandbox.backend ?? "none"}`);
+        return;
+    }
+    catch (error) {
+        // A Tenant that is not open does not answer: the Admin API says why.
+        reason = error;
+    }
+    let tenant;
+    try {
+        tenant = (await createAdmin({ cwd: root }).status()).tenant;
+    }
+    catch {
+        throw new CliError(reason instanceof Error
+            ? reason.message
+            : `The Tenant at ${connection.url} is not reachable.`, 1);
+    }
+    if (json) {
+        console.log(JSON.stringify({ tenant }, null, 2));
+        return;
+    }
+    console.log(`${tenant.name ?? "(unreadable)"}  ${tenant.id ?? "(unknown)"}  ${tenant.state}`);
+    console.log(`runtime  ${connection.url}`);
+    if (tenant.cause) {
+        console.log(`reason   ${tenant.cause.code}: ${tenant.cause.message}`);
+        console.log(`repair   ${tenant.cause.repair}`);
+    }
+}
+const RESET_USAGE = "Usage: nylo reset [--sessions|--sandboxes|--all] [--yes]";
+const SCOPES = { "--sessions": "sessions", "--sandboxes": "sandboxes", "--all": "all" };
+/** `nylo reset [--sessions|--sandboxes|--all] [--yes]`; `--all` asks first. */
+export async function resetCommand(args) {
+    const yes = args.includes("--yes");
+    const flags = args.filter((a) => a !== "--yes");
+    if (flags.some((f) => !(f in SCOPES)) || args.filter((a) => a === "--yes").length > 1)
+        throw new CliError(RESET_USAGE, 2);
+    if (flags.length > 1)
+        throw new CliError("Pass only one of --sessions, --sandboxes, --all.", 2);
+    const scope = flags.length ? SCOPES[flags[0]] : "sessions";
+    const connection = await linkedConnection(projectRoot());
+    const tenant = connection.link?.tenant;
+    const target = tenant ? `Tenant ${tenant} (${connection.url})` : `the Tenant on ${connection.url}`;
+    if (scope === "all" && !yes)
+        await confirmOrThrow(`Reset ALL data of ${target}? The Project link and credentials are kept. [y/N] `);
+    try {
+        await clientFor(connection).transport.json("/v1/tenant/reset", "POST", {
+            requestId: randomUUID(),
+            scope,
+            activeWork: "drain",
+        });
+    }
+    catch (error) {
+        throw new CliError(error instanceof Error ? error.message : `Tenant reset failed: ${String(error)}`, 1);
+    }
+    console.log(`Reset ${target} (${scope}).`);
+}
+async function confirmOrThrow(prompt) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new CliError("Confirmation required; pass --yes for non-interactive use.", 2);
+    }
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = (await rl.question(prompt)).trim().toLowerCase();
+        if (answer !== "y" && answer !== "yes") {
+            throw new CliError("Cancelled.", 1);
+        }
+    }
+    finally {
+        rl.close();
+    }
+}
+/** `nylo endpoints [--json]` and `nylo endpoints ping <agent>`. */
+export async function endpointsCommand(args) {
+    if (args[0] === "ping") {
+        const agentId = args[1];
+        if (!agentId || args.length > 2)
+            throw new CliError("Usage: nylo endpoints ping <agent>", 2);
+        const client = clientFor(await linkedConnection(projectRoot()));
+        const answer = await client.transport.json(`/v1/endpoints/${encodeURIComponent(agentId)}/ping`, "POST");
+        console.log(`${answer.agentId}  serves ${answer.implementationVersion}${answer.manifestHash ? `  ${answer.manifestHash}` : ""}`);
+        return;
+    }
+    const json = args.includes("--json");
+    if (args.some((a) => a !== "--json"))
+        throw new CliError("Usage: nylo endpoints [--json] | nylo endpoints ping <agent>", 2);
+    const client = clientFor(await linkedConnection(projectRoot()));
+    const body = await client.transport.json("/v1/endpoints", "GET");
+    if (json) {
+        console.log(JSON.stringify(body, null, 2));
+        return;
+    }
+    if (body.endpoints.length === 0) {
+        console.log("No Action endpoints. Register one with createActionHandler(...).register({ url }).");
+        return;
+    }
+    for (const endpoint of body.endpoints)
+        console.log(endpointLine(endpoint));
+}
+/** One line of `nylo endpoints`: the agent, its URL and version, and how it is doing. */
+export function endpointLine(endpoint) {
+    const { health } = endpoint;
+    const state = health.consecutiveFailures > 0
+        ? `failing (${health.consecutiveFailures}): ${health.lastError?.message || health.lastError?.code || "unknown"}`
+        : health.lastSuccessAt
+            ? `ok (last ${health.lastSuccessAt})`
+            : "no deliveries yet";
+    return `${endpoint.agentId}  ${endpoint.url}  ${endpoint.implementationVersion}  ${state}`;
+}

package/dist/model/configure.d.ts

@@ -41,7 +41,6 @@ export type Selection = Readonly<{
 export declare function fetchModelCatalog(options: {
     url: string;
     key: string;
-    tenantId: string;
     fetchImpl?: typeof fetch;
 }): Promise<ModelCatalog>;
 export declare function configureProvider(options?: {

package/dist/model/configure.js

@@ -112,11 +112,10 @@ function modelsFor(selection, credentials, catalog) {
 /** Fetch GET /v1/tenant/models when a connection is available. */
 export async function fetchModelCatalog(options) {
     const fetchImpl = options.fetchImpl ?? fetch;
-    const { PROTOCOL_HEADER, PROTOCOL_VERSION, TENANT_HEADER } = await import("@nylorun/agents");
+    const { PROTOCOL_HEADER, PROTOCOL_VERSION } = await import("@nylorun/agents");
     const response = await fetchImpl(`${options.url.replace(/\/$/, "")}/v1/tenant/models`, {
         headers: {
             authorization: `Bearer ${options.key}`,
-            [TENANT_HEADER]: options.tenantId,
             [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
             Accept: "application/json",
         },

package/dist/model/host-model.d.ts

@@ -1,4 +1,4 @@
-import { type PromptedModel } from "./configure.js";
+import type { PromptedModel } from "./configure.js";
 /** Wire shape of GET/PUT `/v1/tenant/model` — local copy so CLI stays off `@nylorun/core`. */
 type HostModelView = {
     readonly configured: false;
@@ -13,14 +13,6 @@ type HostModelView = {
         maxTokens?: number;
     };
 };
-export declare function getHostModel(runtimeUrl: string, serverKey: string, tenantId?: string): Promise<HostModelView>;
-export declare function putHostModel(runtimeUrl: string, serverKey: string, model: PromptedModel, tenantId?: string): Promise<HostModelView>;
-export declare function ensureHostModel(options: {
-    runtimeUrl: string;
-    serverKey: string;
-    tenantId: string;
-    root?: string;
-    env?: Readonly<Record<string, string>>;
-    signal?: AbortSignal;
-}): Promise<void>;
+/** Set the installation's Tenant model provider (`PUT /v1/tenant/model`). */
+export declare function putHostModel(runtimeUrl: string, serverKey: string, model: PromptedModel, fetchImpl?: typeof fetch): Promise<HostModelView>;
 export {};