@nylorun/runtime 0.7.0-beta → 0.9.0-beta

package/dist/core/store.d.ts

@@ -1,6 +1,14 @@
 import { DatabaseSync } from "node:sqlite";
 import type { LiveEvent } from "@nylorun/core/contracts";
 export declare function canonical(value: unknown): string;
+export interface ExecutorRow {
+    agentId: string;
+    tokenHash: string;
+    implementationVersion: string;
+    manifestHash?: string;
+    createdAt: string;
+    updatedAt: string;
+}
 export declare class Store {
     readonly db: DatabaseSync;
     constructor(path: string);
@@ -8,9 +16,14 @@ export declare class Store {
     get<T = any>(table: string, id: string): T | undefined;
     all<T = any>(table: string): T[];
     put(table: string, id: string, body: unknown): void;
+    delete(table: string, id: string): void;
+    allExecutors(): ExecutorRow[];
+    putExecutor(row: Omit<ExecutorRow, "createdAt">): void;
+    deleteExecutor(agentId: string): void;
     event(sessionId: string, turnId: string | null, type: string, payload: unknown): LiveEvent;
     credentialCount(): number;
-    history(sessionId: string, cursor?: string): {
+    /** `agent` keeps only events of one agent used as a tool, by delegationId or path. */
+    history(sessionId: string, cursor?: string, agent?: string): {
         items: LiveEvent[];
         cursor: string | null;
     };

package/dist/core/store.js

@@ -25,6 +25,7 @@ export class Store {
       CREATE TABLE IF NOT EXISTS checkpoints(id TEXT PRIMARY KEY, body TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS effects(id TEXT PRIMARY KEY, body TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS actions(id TEXT PRIMARY KEY, body TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS sandboxes(id TEXT PRIMARY KEY, body TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS events(sequence INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, body TEXT NOT NULL);
       CREATE INDEX IF NOT EXISTS events_session ON events(session_id, sequence);
       CREATE TABLE IF NOT EXISTS vaults(
@@ -32,7 +33,8 @@ export class Store {
         name TEXT NOT NULL,
         owner_user_id TEXT NOT NULL,
         metadata_json TEXT,
-        created_at TEXT NOT NULL
+        created_at TEXT NOT NULL,
+        scope TEXT NOT NULL DEFAULT 'user'
       );
       CREATE INDEX IF NOT EXISTS vaults_owner ON vaults(owner_user_id);
       CREATE TABLE IF NOT EXISTS vault_credentials(
@@ -65,7 +67,16 @@ export class Store {
         id TEXT PRIMARY KEY,
         body_hash TEXT NOT NULL,
         response TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS executors(
+        agent_id TEXT PRIMARY KEY,
+        token_hash TEXT NOT NULL UNIQUE,
+        implementation_version TEXT NOT NULL,
+        manifest_hash TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
       );`);
+        migrateVaultScope(this.db);
     }
     tx(fn) {
         this.db.exec("BEGIN IMMEDIATE");
@@ -94,6 +105,38 @@ export class Store {
             .prepare(`INSERT INTO ${table}(id,body) VALUES(?,?) ON CONFLICT(id) DO UPDATE SET body=excluded.body`)
             .run(id, JSON.stringify(body));
     }
+    delete(table, id) {
+        this.db.prepare(`DELETE FROM ${table} WHERE id=?`).run(id);
+    }
+    // Executors carry a bearer secret, so they use typed columns with a database-enforced unique
+    // token hash instead of flowing through the generic JSON document helpers above.
+    allExecutors() {
+        return this.db
+            .prepare("SELECT agent_id,token_hash,implementation_version,manifest_hash,created_at,updated_at FROM executors")
+            .all()
+            .map((r) => ({
+            agentId: String(r.agent_id),
+            tokenHash: String(r.token_hash),
+            implementationVersion: String(r.implementation_version),
+            manifestHash: r.manifest_hash == null ? undefined : String(r.manifest_hash),
+            createdAt: String(r.created_at),
+            updatedAt: String(r.updated_at),
+        }));
+    }
+    putExecutor(row) {
+        this.db
+            .prepare(`INSERT INTO executors(agent_id,token_hash,implementation_version,manifest_hash,created_at,updated_at)
+         VALUES(?,?,?,?,?,?)
+         ON CONFLICT(agent_id) DO UPDATE SET
+           token_hash=excluded.token_hash,
+           implementation_version=excluded.implementation_version,
+           manifest_hash=excluded.manifest_hash,
+           updated_at=excluded.updated_at`)
+            .run(row.agentId, row.tokenHash, row.implementationVersion, row.manifestHash ?? null, row.updatedAt, row.updatedAt);
+    }
+    deleteExecutor(agentId) {
+        this.db.prepare("DELETE FROM executors WHERE agent_id=?").run(agentId);
+    }
     event(sessionId, turnId, type, payload) {
         const base = {
             eventId: randomUUID(),
@@ -121,7 +164,8 @@ export class Store {
             .get();
         return Number(row.n);
     }
-    history(sessionId, cursor) {
+    /** `agent` keeps only events of one agent used as a tool, by delegationId or path. */
+    history(sessionId, cursor, agent) {
         let sequence = 0;
         if (cursor) {
             const decoded = Buffer.from(cursor, "base64url").toString();
@@ -134,7 +178,8 @@ export class Store {
         const items = this.db
             .prepare("SELECT body FROM events WHERE session_id=? AND sequence>? ORDER BY sequence")
             .all(sessionId, sequence)
-            .map((r) => JSON.parse(String(r.body)));
+            .map((r) => JSON.parse(String(r.body)))
+            .filter((event) => agent === undefined || belongsTo(event, agent));
         const last = this.db
             .prepare("SELECT body FROM events WHERE session_id=? ORDER BY sequence DESC LIMIT 1")
             .get(sessionId);
@@ -144,3 +189,14 @@ export class Store {
         };
     }
 }
+function belongsTo(event, agent) {
+    const ref = event.payload
+        ?.agent;
+    return ref?.delegationId === agent || ref?.path === agent;
+}
+function migrateVaultScope(db) {
+    const columns = db.prepare("PRAGMA table_info(vaults)").all();
+    if (!columns.some((column) => column.name === "scope"))
+        db.exec("ALTER TABLE vaults ADD COLUMN scope TEXT NOT NULL DEFAULT 'user'");
+    db.exec("CREATE UNIQUE INDEX IF NOT EXISTS vaults_one_host ON vaults(scope) WHERE scope = 'host'");
+}

package/dist/index.d.ts

@@ -1,6 +1,5 @@
 export { CoreRuntime, createRuntime, startRuntime, type RuntimeOptions } from "./core/runtime.js";
 export { scriptedModel, gatewayModel, type ModelProvider } from "./core/provider.js";
-export { httpModel, type HttpModelOptions, type ModelEnvironment } from "./model/http-model.js";
 export type { RuntimeAgent } from "./contracts.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes } from "./media.js";
 export type { RuntimeModelAdapter } from "./contracts.js";

package/dist/index.js

@@ -1,4 +1,3 @@
 export { CoreRuntime, createRuntime, startRuntime } from "./core/runtime.js";
 export { scriptedModel, gatewayModel } from "./core/provider.js";
-export { httpModel } from "./model/http-model.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes } from "./media.js";

package/dist/mcp/pool.d.ts

@@ -1,4 +1,4 @@
-import type { AgentManifest } from "@nylorun/core/define";
+import type { AgentManifest, McpServerManifest } from "@nylorun/core/define";
 import type { AuthorizeResult } from "../vault/service.js";
 import { callMcpTool } from "./connect.js";
 import { type McpDiagnostic, type McpSnapshot, type McpToolRecord } from "./snapshot.js";
@@ -31,6 +31,7 @@ export declare class McpPool {
     }): Promise<McpDiagnostic[]>;
     call(input: {
         sessionId: string;
+        agentId?: string;
         capabilityId: string;
         serverName: string;
         serverToolName: string;
@@ -43,3 +44,14 @@ export declare class McpPool {
     private liveKey;
     private connectDeclared;
 }
+interface DeclaredServer {
+    /** Absent for the session's root agent. */
+    readonly agentId?: string;
+    /** The manifest of the agent that declares the server. */
+    readonly manifest: AgentManifest;
+    readonly capabilityId: string;
+    readonly server: McpServerManifest;
+}
+/** Servers of the root agent, then of each agent it uses as a tool. */
+export declare function serversOf(manifest: AgentManifest): DeclaredServer[];
+export {};

package/dist/mcp/pool.js

@@ -1,4 +1,5 @@
 import { join } from "node:path";
+import { delegatesOf } from "@nylorun/core/define";
 import { callMcpTool, diagnosticFromError, listMcpTools, openMcpServer, } from "./connect.js";
 import { declaredToolNames, } from "./snapshot.js";
 export class McpPool {
@@ -8,7 +9,8 @@ export class McpPool {
         this.options = options;
     }
     async discover(input) {
-        const taken = declaredToolNames(input.manifest);
+        // Each agent names its own tools, so collisions are checked per agent.
+        const taken = new Map();
         const tools = [];
         const diagnostics = [];
         for (const declared of serversOf(input.manifest)) {
@@ -19,13 +21,16 @@ export class McpPool {
                 continue;
             }
             try {
+                if (!taken.has(declared.agentId))
+                    taken.set(declared.agentId, declaredToolNames(declared.manifest));
                 const listed = await listMcpTools(opened.connection.client, {
                     capabilityId: declared.capabilityId,
                     serverName: declared.server.name,
-                    taken,
+                    taken: taken.get(declared.agentId),
                 });
-                tools.push(...listed.tools);
+                tools.push(...listed.tools.map((tool) => owned(declared, tool)));
                 diagnostics.push({
+                    ...ownerOf(declared),
                     capabilityId: declared.capabilityId,
                     serverName: declared.server.name,
                     outcome: "connected",
@@ -37,7 +42,7 @@ export class McpPool {
             }
             catch (error) {
                 await opened.connection.close().catch(() => { });
-                diagnostics.push(diagnosticFromError(declared.capabilityId, declared.server.name, error));
+                diagnostics.push(owned(declared, diagnosticFromError(declared.capabilityId, declared.server.name, error)));
             }
         }
         return {
@@ -53,16 +58,17 @@ export class McpPool {
         const diagnostics = [];
         const seen = new Set();
         for (const tool of input.tools) {
-            const key = `${tool.capabilityId}\0${tool.serverName}`;
+            const key = this.liveKey(input.sessionId, tool.agentId, tool.capabilityId, tool.serverName);
             if (seen.has(key))
                 continue;
             seen.add(key);
-            if (this.live.has(this.liveKey(input.sessionId, tool.capabilityId, tool.serverName)))
+            if (this.live.has(key))
                 continue;
             input.signal?.throwIfAborted();
-            const declared = serversOf(input.manifest).find((item) => item.capabilityId === tool.capabilityId && item.server.name === tool.serverName);
+            const declared = findServer(input.manifest, tool.agentId, tool.capabilityId, tool.serverName);
             if (!declared) {
                 diagnostics.push({
+                    ...(tool.agentId === undefined ? {} : { agentId: tool.agentId }),
                     capabilityId: tool.capabilityId,
                     serverName: tool.serverName,
                     outcome: "failed",
@@ -80,10 +86,10 @@ export class McpPool {
         return diagnostics;
     }
     async call(input) {
-        const key = this.liveKey(input.sessionId, input.capabilityId, input.serverName);
+        const key = this.liveKey(input.sessionId, input.agentId, input.capabilityId, input.serverName);
         let live = this.live.get(key);
         if (!live) {
-            const declared = serversOf(input.manifest).find((item) => item.capabilityId === input.capabilityId && item.server.name === input.serverName);
+            const declared = findServer(input.manifest, input.agentId, input.capabilityId, input.serverName);
             if (!declared)
                 throw new Error(`MCP server '${input.serverName}' is not declared`);
             const opened = await this.connectDeclared(input, declared);
@@ -102,21 +108,21 @@ export class McpPool {
         await Promise.all(connections.map((item) => item.connection.close().catch(() => { })));
     }
     remember(sessionId, declared, connection) {
-        this.live.set(this.liveKey(sessionId, declared.capabilityId, declared.server.name), {
+        this.live.set(this.liveKey(sessionId, declared.agentId, declared.capabilityId, declared.server.name), {
             capabilityId: declared.capabilityId,
             serverName: declared.server.name,
             connection,
         });
     }
-    liveKey(sessionId, capabilityId, serverName) {
-        return JSON.stringify([sessionId, capabilityId, serverName]);
+    liveKey(sessionId, agentId, capabilityId, serverName) {
+        return JSON.stringify([sessionId, agentId ?? null, capabilityId, serverName]);
     }
     async connectDeclared(input, declared) {
         try {
             const connection = await openMcpServer({
                 server: declared.server,
-                pluginRoot: input.pluginRoots[declared.capabilityId],
-                pluginData: join(this.options.dataDir, "plugin-data", declared.capabilityId),
+                pluginRoot: input.pluginRoots[pluginKey(declared)],
+                pluginData: join(this.options.dataDir, "plugin-data", ...pluginKey(declared).split("/")),
                 authorize: declared.server.type === "stdio"
                     ? undefined
                     : (url) => this.options.authorize(input.sessionId, {
@@ -129,15 +135,43 @@ export class McpPool {
         catch (error) {
             return {
                 ok: false,
-                diagnostic: diagnosticFromError(declared.capabilityId, declared.server.name, error),
+                diagnostic: owned(declared, diagnosticFromError(declared.capabilityId, declared.server.name, error)),
             };
         }
     }
 }
-function serversOf(manifest) {
+/** Servers of the root agent, then of each agent it uses as a tool. */
+export function serversOf(manifest) {
     const servers = [];
-    for (const capability of manifest.capabilities)
-        for (const server of Object.values(capability.mcpServers ?? {}))
-            servers.push({ capabilityId: capability.id, server });
+    const add = (agent, agentId) => {
+        for (const capability of agent.capabilities)
+            for (const server of Object.values(capability.mcpServers ?? {}))
+                servers.push({
+                    ...(agentId === undefined ? {} : { agentId }),
+                    manifest: agent,
+                    capabilityId: capability.id,
+                    server,
+                });
+    };
+    add(manifest);
+    for (const child of delegatesOf(manifest))
+        add(child.manifest, child.manifest.id);
     return servers;
 }
+function findServer(manifest, agentId, capabilityId, serverName) {
+    return serversOf(manifest).find((item) => item.agentId === agentId &&
+        item.capabilityId === capabilityId &&
+        item.server.name === serverName);
+}
+/** Plugin roots of agents used as tools are registered as `<agent>/<capability>`. */
+function pluginKey(declared) {
+    return declared.agentId === undefined
+        ? declared.capabilityId
+        : `${declared.agentId}/${declared.capabilityId}`;
+}
+function ownerOf(declared) {
+    return declared.agentId === undefined ? {} : { agentId: declared.agentId };
+}
+function owned(declared, value) {
+    return { ...ownerOf(declared), ...value };
+}

package/dist/mcp/snapshot.d.ts

@@ -1,6 +1,8 @@
 import type { JsonObject } from "@nylorun/core/define";
 import type { AgentManifest } from "@nylorun/core/define";
 export interface McpToolRecord {
+    /** The agent used as a tool that declares the server; absent for the session's root agent. */
+    readonly agentId?: string;
     readonly capabilityId: string;
     readonly serverName: string;
     readonly serverToolName: string;
@@ -15,6 +17,8 @@ export interface McpSnapshot {
     readonly mcpTools: readonly McpToolRecord[];
 }
 export interface McpDiagnostic {
+    /** The agent used as a tool that declares the server; absent for the session's root agent. */
+    readonly agentId?: string;
     readonly capabilityId: string;
     readonly serverName: string;
     readonly outcome: "connected" | "refused" | "failed";

package/dist/model/catalog.d.ts

@@ -0,0 +1,12 @@
+export type HostModelCatalog = {
+    providers: {
+        id: string;
+        name: string;
+        models: {
+            id: string;
+            name: string;
+        }[];
+    }[];
+};
+/** Public provider and model names. No credentials. */
+export declare function hostModelCatalog(): HostModelCatalog;

package/dist/model/catalog.js

@@ -0,0 +1,29 @@
+import { modelsFor } from "./models.js";
+const emptyStore = {
+    async read() {
+        return undefined;
+    },
+    async list() {
+        return [];
+    },
+    async modify(_providerId, fn) {
+        return fn(undefined);
+    },
+    async delete() { },
+};
+/** Public provider and model names. No credentials. */
+export function hostModelCatalog() {
+    const models = modelsFor({ provider: "", model: "" }, emptyStore, {
+        environment: false,
+    });
+    return {
+        providers: models.getProviders().map((provider) => ({
+            id: provider.id,
+            name: provider.name,
+            models: models.getModels(provider.id).map((model) => ({
+                id: model.id,
+                name: model.name,
+            })),
+        })),
+    };
+}

package/dist/model/models.d.ts

@@ -6,4 +6,6 @@ export type Selection = Readonly<{
         baseUrl: string;
     }>;
 }>;
-export declare function modelsFor(selection: Selection, credentials: CredentialStore): import("@earendil-works/pi-ai").MutableModels;
+export declare function modelsFor(selection: Selection, credentials: CredentialStore, options?: {
+    environment?: boolean;
+}): import("@earendil-works/pi-ai").MutableModels;

package/dist/model/models.js

@@ -1,7 +1,7 @@
 import { createProvider, defaultProviderAuthContext, envApiKeyAuth, } from "@earendil-works/pi-ai";
 import { stream, streamSimple, } from "@earendil-works/pi-ai/api/openai-completions";
 import { builtinModels } from "@earendil-works/pi-ai/providers/all";
-export function modelsFor(selection, credentials) {
+export function modelsFor(selection, credentials, options = {}) {
     const environmentFirst = {
         async read(providerId, options) {
             const explicit = process.env.MODEL_PROVIDER_API_KEY;
@@ -23,7 +23,9 @@ export function modelsFor(selection, credentials) {
         modify: (id, fn, options) => credentials.modify(id, fn, options),
         delete: (id, options) => credentials.delete(id, options),
     };
-    const models = builtinModels({ credentials: environmentFirst });
+    const models = builtinModels({
+        credentials: options.environment === false ? credentials : environmentFirst,
+    });
     if (!selection.custom)
         return models;
     const model = {

package/dist/model/pi-model.d.ts

@@ -1,11 +1,17 @@
+import type { Credential } from "@earendil-works/pi-ai";
 import type { RuntimeModelAdapter } from "../contracts.js";
 import type { RuntimeMedia } from "../adapters/media.js";
-import { type Selection } from "./models.js";
+import type { HostModelSecret } from "../vault/service.js";
+export interface ModelPreview {
+    readonly invocationId: string;
+    readonly text: string;
+}
 export interface PiModelOptions {
     readonly root?: string;
-    readonly onPreview?: (preview: import("./defaults.js").ModelPreview) => void;
-    readonly selection?: Selection;
+    readonly onPreview?: (preview: ModelPreview) => void;
     readonly media?: Pick<RuntimeMedia, "dataUrl">;
+    readonly readHostModel?: () => HostModelSecret | undefined;
+    readonly writeHostCredential?: (credential: Credential) => void;
 }
 /** Node model adapter. Local provider configuration is read only when invoked. */
 export declare function piModel(options?: PiModelOptions): RuntimeModelAdapter;

package/dist/model/pi-model.js

@@ -1,8 +1,6 @@
-import { join } from "node:path";
 import { scrub } from "../redact.js";
-import { ProjectCredentialStore } from "./auth-store.js";
 import { modelsFor } from "./models.js";
-import { modelSelection, projectSecrets } from "./settings.js";
+import { projectSecrets } from "./settings.js";
 const emptyUsage = () => ({
     input: 0,
     output: 0,
@@ -16,15 +14,18 @@ export function piModel(options = {}) {
     return async (call, context) => {
         context.signal.throwIfAborted();
         const root = options.root ?? process.cwd();
-        const configured = options.selection ?? modelSelection(root);
+        const stored = options.readHostModel?.();
+        if (!stored)
+            throw new Error("Model provider is not configured. Start nylorun dev in a terminal, or set it in Studio.");
         const requested = call.model?.id;
         const selection = {
-            ...configured,
-            model: requested?.startsWith(`${configured.provider}/`)
-                ? requested.slice(configured.provider.length + 1)
-                : (requested ?? configured.model),
+            provider: stored.provider,
+            model: requested?.startsWith(`${stored.provider}/`)
+                ? requested.slice(stored.provider.length + 1)
+                : (requested ?? stored.model),
+            ...(stored.baseUrl ? { custom: { baseUrl: stored.baseUrl } } : {}),
         };
-        const registry = modelsFor(selection, new ProjectCredentialStore(join(root, ".nylorun", "auth.json"), join(root, ".env", "auth.json")));
+        const registry = modelsFor(selection, hostCredentialStore(stored, options.writeHostCredential), { environment: false });
         const selected = registry.getModel(selection.provider, selection.model);
         if (!selected)
             throw new Error("Unknown model. Run nylorun configure.");
@@ -176,7 +177,10 @@ export function piModel(options = {}) {
             messages,
             tools,
         };
-        const secrets = projectSecrets(root);
+        const secrets = [
+            ...projectSecrets(root),
+            ...credentialSecrets(stored.credential),
+        ];
         // Publish only portable references, never the materialized provider image bytes.
         context.reportPreparedCall?.({
             adapter: "runtime.pi-ai",
@@ -265,7 +269,39 @@ export function piModel(options = {}) {
             };
         }
         catch (error) {
-            throw new Error(String(scrub(error instanceof Error ? error.message : String(error), projectSecrets(root))));
+            throw new Error(String(scrub(error instanceof Error ? error.message : String(error), secrets)));
         }
     };
 }
+function hostCredentialStore(stored, write) {
+    let current = stored.credential;
+    return {
+        async read(providerId) {
+            if (providerId !== stored.provider)
+                return undefined;
+            return current;
+        },
+        async list() {
+            return [{ providerId: stored.provider, type: current.type }];
+        },
+        async modify(providerId, fn) {
+            if (providerId !== stored.provider)
+                return fn(undefined);
+            const next = await fn(current);
+            if (next === undefined)
+                return current;
+            write?.(next);
+            current = next;
+            return next;
+        },
+        async delete() {
+            throw new Error("Replace the model provider through nylorun dev or Studio.");
+        },
+    };
+}
+function credentialSecrets(credential) {
+    const values = [credential.key, credential.access, credential.refresh];
+    if (credential.env)
+        values.push(...Object.values(credential.env));
+    return values.filter((value) => Boolean(value));
+}

package/dist/model/settings.d.ts

@@ -1,3 +1 @@
-import type { Selection } from "./models.js";
-export declare function modelSelection(root?: string): Selection;
 export declare function projectSecrets(root?: string): readonly string[];

package/dist/model/settings.js

@@ -1,52 +1,5 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-export function modelSelection(root = process.cwd()) {
-    const { MODEL_PROVIDER: provider, MODEL: model, MODEL_PROVIDER_BASE_URL: baseUrl, } = process.env;
-    if (provider !== undefined || model !== undefined || baseUrl !== undefined) {
-        if (!provider?.trim() || !model?.trim())
-            throw new Error("Set both MODEL_PROVIDER and MODEL, or run nylorun configure.");
-        if (provider === "custom" && !baseUrl?.trim())
-            throw new Error("Set MODEL_PROVIDER_BASE_URL for MODEL_PROVIDER=custom.");
-        if (baseUrl && provider !== "custom")
-            throw new Error("MODEL_PROVIDER_BASE_URL requires MODEL_PROVIDER=custom.");
-        if (baseUrl) {
-            let url;
-            try {
-                url = new URL(baseUrl);
-            }
-            catch {
-                throw new Error("MODEL_PROVIDER_BASE_URL must be an HTTP(S) URL.");
-            }
-            if (!["http:", "https:"].includes(url.protocol))
-                throw new Error("MODEL_PROVIDER_BASE_URL must be an HTTP(S) URL.");
-        }
-        return { provider, model, ...(baseUrl ? { custom: { baseUrl } } : {}) };
-    }
-    try {
-        let contents;
-        try {
-            contents = readFileSync(join(root, ".env", "model.json"), "utf8");
-        }
-        catch (error) {
-            if (!(error instanceof Error) ||
-                !("code" in error) ||
-                !["ENOENT", "ENOTDIR"].includes(String(error.code)))
-                throw error;
-            contents = readFileSync(join(root, "config", "model.json"), "utf8");
-        }
-        const value = JSON.parse(contents);
-        if (typeof value.provider === "string" &&
-            value.provider &&
-            typeof value.model === "string" &&
-            value.model &&
-            (value.custom === undefined || typeof value.custom.baseUrl === "string"))
-            return value;
-    }
-    catch {
-        /* Report one actionable setup error without file or credential contents. */
-    }
-    throw new Error("Run nylorun configure to connect a model provider.");
-}
 export function projectSecrets(root = process.cwd()) {
     const values = Object.entries(process.env)
         .filter(([key]) => /key|token|secret|password|credential/i.test(key))

package/dist/node/index.d.ts

@@ -1,5 +1,5 @@
-export { localSessions } from "./local-sessions.js";
 export { localMedia, MediaStore } from "../adapters/media.js";
 export { jsonlObserver } from "../adapters/observe.js";
 export { piModel, type PiModelOptions } from "../model/pi-model.js";
 export { projectAsset } from "../assets.js";
+export { probeSandboxBackends, type SandboxSelectionReport, } from "../sandbox/select.js";

package/dist/node/index.js

@@ -1,5 +1,5 @@
-export { localSessions } from "./local-sessions.js";
 export { localMedia, MediaStore } from "../adapters/media.js";
 export { jsonlObserver } from "../adapters/observe.js";
 export { piModel } from "../model/pi-model.js";
 export { projectAsset } from "../assets.js";
+export { probeSandboxBackends, } from "../sandbox/select.js";