@nylorun/runtime 0.9.0-beta → 0.11.0-beta

package/dist/infra/workers.js

@@ -0,0 +1,31 @@
+/** Whether a process in `role` serves the Worker endpoint. */
+export function servesWorker(role) {
+    return role !== "api";
+}
+/** What `stopWorker` needs for a handle that serves the endpoint. */
+const started = new WeakMap();
+/**
+ * Starts delivering Restate invocations to `handlers` when `role` is `worker`
+ * or `all` (serving and registering the Worker endpoint, for Restate). For
+ * `api` it does nothing. Rejects if the endpoint cannot listen or register.
+ */
+export async function startWorker(input) {
+    const { role, execution, handlers } = input;
+    const handle = Object.freeze({ role, serving: servesWorker(role) });
+    if (!handle.serving)
+        return handle;
+    await execution.start(handlers);
+    started.set(handle, { execution });
+    return handle;
+}
+/**
+ * Stops a Worker started by `startWorker`: aborts running advances' signals
+ * and waits for them. Idempotent; a no-op for the api role.
+ */
+export async function stopWorker(handle) {
+    const worker = started.get(handle);
+    if (!worker)
+        return;
+    worker.stopped ??= worker.execution.stop();
+    await worker.stopped;
+}

package/dist/mcp/connect.d.ts

@@ -11,6 +11,7 @@ export declare function openMcpServer(input: {
     authorize?: (url: string) => Promise<AuthorizeResult>;
     pluginRoot?: string;
     pluginData: string;
+    childEnv?: Readonly<Record<string, string>>;
 }): Promise<LiveConnection>;
 export declare function listMcpTools(client: Client, input: {
     capabilityId: string;

package/dist/mcp/connect.js

@@ -10,11 +10,13 @@ export async function openMcpServer(input) {
         const launch = prepareStdioLaunch(input.server, {
             pluginRoot: input.pluginRoot,
             pluginData: input.pluginData,
+            childEnv: input.childEnv,
         });
         const transport = new StdioClientTransport({
             command: launch.command,
             args: [...launch.args],
             cwd: launch.cwd,
+            // Full explicit env so HOME/TMPDIR from the Tenant override getDefaultEnvironment().
             env: { ...launch.env },
             stderr: "pipe",
         });

package/dist/mcp/pool.d.ts

@@ -6,7 +6,9 @@ export declare class McpPool {
     private readonly options;
     private readonly live;
     constructor(options: {
-        readonly dataDir: string;
+        /** Absolute Tenant `plugin-data` directory. */
+        readonly pluginData: string;
+        readonly childEnv: Readonly<Record<string, string>>;
         readonly authorize: (sessionId: string, request: {
             url: string;
             serverName: string;

package/dist/mcp/pool.js

@@ -122,7 +122,8 @@ export class McpPool {
             const connection = await openMcpServer({
                 server: declared.server,
                 pluginRoot: input.pluginRoots[pluginKey(declared)],
-                pluginData: join(this.options.dataDir, "plugin-data", ...pluginKey(declared).split("/")),
+                pluginData: join(this.options.pluginData, ...pluginKey(declared).split("/")),
+                childEnv: this.options.childEnv,
                 authorize: declared.server.type === "stdio"
                     ? undefined
                     : (url) => this.options.authorize(input.sessionId, {

package/dist/mcp/stdio.d.ts

@@ -12,4 +12,6 @@ export declare function prepareStdioLaunch(server: Extract<McpServerManifest, {
 }>, options: {
     readonly pluginRoot?: string;
     readonly pluginData: string;
+    /** Allowlisted base env (Tenant HOME/TMPDIR/PATH). Manifest env overlays it (A9). */
+    readonly childEnv?: Readonly<Record<string, string>>;
 }): StdioLaunch;

package/dist/mcp/stdio.js

@@ -38,7 +38,9 @@ export function prepareStdioLaunch(server, options) {
     const cwd = server.cwd
         ? resolveContainedCwd(server.cwd, pluginRoot, pluginData)
         : (pluginRoot ?? pluginData);
-    const env = {};
+    // childEnv under manifest env; HOME/TMPDIR from childEnv override Host defaults
+    // that StdioClientTransport merges via getDefaultEnvironment() (R2).
+    const env = { ...(options.childEnv ?? {}) };
     for (const [key, value] of Object.entries(server.env ?? {}))
         env[key] = expand(value, pluginRoot, pluginData);
     if (pluginRoot)

package/dist/model/auth-store.d.ts

@@ -3,7 +3,7 @@ export declare class ProjectCredentialStore implements CredentialStore {
     #private;
     private readonly file;
     private readonly legacyFile?;
-    constructor(file?: string, legacyFile?: string | undefined);
+    constructor(file: string, legacyFile?: string | undefined);
     read(providerId: string): Promise<Credential | undefined>;
     list(): Promise<readonly CredentialInfo[]>;
     modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;

package/dist/model/auth-store.js

@@ -1,11 +1,11 @@
 var _a;
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { dirname } from "node:path";
 export class ProjectCredentialStore {
     file;
     legacyFile;
     #chain = Promise.resolve();
-    constructor(file = join(process.cwd(), ".nylorun", "auth.json"), legacyFile) {
+    constructor(file, legacyFile) {
         this.file = file;
         this.legacyFile = legacyFile;
     }

package/dist/model/models.d.ts

@@ -6,6 +6,10 @@ export type Selection = Readonly<{
         baseUrl: string;
     }>;
 }>;
+/**
+ * Build the pi-ai model registry from explicit credentials only.
+ * Ambient process environment / provider env auth is never consulted (A7, A10).
+ */
 export declare function modelsFor(selection: Selection, credentials: CredentialStore, options?: {
     environment?: boolean;
 }): import("@earendil-works/pi-ai").MutableModels;

package/dist/model/models.js

@@ -1,31 +1,15 @@
-import { createProvider, defaultProviderAuthContext, envApiKeyAuth, } from "@earendil-works/pi-ai";
+import { createProvider, } from "@earendil-works/pi-ai";
 import { stream, streamSimple, } from "@earendil-works/pi-ai/api/openai-completions";
 import { builtinModels } from "@earendil-works/pi-ai/providers/all";
+/**
+ * Build the pi-ai model registry from explicit credentials only.
+ * Ambient process environment / provider env auth is never consulted (A7, A10).
+ */
 export function modelsFor(selection, credentials, options = {}) {
-    const environmentFirst = {
-        async read(providerId, options) {
-            const explicit = process.env.MODEL_PROVIDER_API_KEY;
-            if (explicit &&
-                (!selection.provider || selection.provider === providerId))
-                return { type: "api_key", key: explicit };
-            const provider = models
-                .getProviders()
-                .find((item) => item.id === providerId);
-            const ambient = await provider?.auth.apiKey?.resolve({
-                ctx: defaultProviderAuthContext(),
-                signal: options?.signal ?? new AbortController().signal,
-            });
-            if (ambient)
-                return undefined;
-            return credentials.read(providerId, options);
-        },
-        list: (options) => credentials.list(options),
-        modify: (id, fn, options) => credentials.modify(id, fn, options),
-        delete: (id, options) => credentials.delete(id, options),
-    };
-    const models = builtinModels({
-        credentials: options.environment === false ? credentials : environmentFirst,
-    });
+    if (options.environment) {
+        throw new Error("Ambient model environment is not supported; pass credentials explicitly");
+    }
+    const models = builtinModels({ credentials });
     if (!selection.custom)
         return models;
     const model = {
@@ -45,7 +29,19 @@ export function modelsFor(selection, credentials, options = {}) {
         name: "Custom OpenAI-compatible",
         baseUrl: selection.custom.baseUrl,
         auth: {
-            apiKey: envApiKeyAuth("Custom API key", ["MODEL_PROVIDER_API_KEY"]),
+            apiKey: {
+                label: "Custom API key",
+                schemas: [],
+                async resolve() {
+                    const credential = await credentials.read("custom");
+                    if (!credential || credential.type !== "api_key")
+                        return undefined;
+                    const key = credential.key;
+                    if (!key)
+                        return undefined;
+                    return { type: "api_key", auth: { apiKey: key } };
+                },
+            },
         },
         models: [model],
         api: { stream, streamSimple },

package/dist/model/pi-model.d.ts

@@ -10,8 +10,8 @@ export interface PiModelOptions {
     readonly root?: string;
     readonly onPreview?: (preview: ModelPreview) => void;
     readonly media?: Pick<RuntimeMedia, "dataUrl">;
-    readonly readHostModel?: () => HostModelSecret | undefined;
-    readonly writeHostCredential?: (credential: Credential) => void;
+    readonly readHostModel?: () => HostModelSecret | undefined | Promise<HostModelSecret | undefined>;
+    readonly writeHostCredential?: (credential: Credential) => void | Promise<void>;
 }
 /** Node model adapter. Local provider configuration is read only when invoked. */
 export declare function piModel(options?: PiModelOptions): RuntimeModelAdapter;

package/dist/model/pi-model.js

@@ -13,10 +13,10 @@ const emptyUsage = () => ({
 export function piModel(options = {}) {
     return async (call, context) => {
         context.signal.throwIfAborted();
-        const root = options.root ?? process.cwd();
-        const stored = options.readHostModel?.();
+        const root = options.root ?? "";
+        const stored = await options.readHostModel?.();
         if (!stored)
-            throw new Error("Model provider is not configured. Start nylorun dev in a terminal, or set it in Studio.");
+            throw new Error("Model provider is not configured. Set it in Studio, or run nylo configure (npx @nylorun/cli configure).");
         const requested = call.model?.id;
         const selection = {
             provider: stored.provider,
@@ -28,7 +28,7 @@ export function piModel(options = {}) {
         const registry = modelsFor(selection, hostCredentialStore(stored, options.writeHostCredential), { environment: false });
         const selected = registry.getModel(selection.provider, selection.model);
         if (!selected)
-            throw new Error("Unknown model. Run nylorun configure.");
+            throw new Error("Unknown model. Run nylo configure (npx @nylorun/cli configure).");
         const signatureFor = (part) => {
             const metadata = "providerMetadata" in part ? part.providerMetadata?.pi : undefined;
             if (!metadata || typeof metadata !== "object" || Array.isArray(metadata))
@@ -290,12 +290,12 @@ function hostCredentialStore(stored, write) {
             const next = await fn(current);
             if (next === undefined)
                 return current;
-            write?.(next);
+            await write?.(next);
             current = next;
             return next;
         },
         async delete() {
-            throw new Error("Replace the model provider through nylorun dev or Studio.");
+            throw new Error("Replace the model provider in Studio, or with nylo configure.");
         },
     };
 }

package/dist/model/settings.d.ts

@@ -1 +1,5 @@
-export declare function projectSecrets(root?: string): readonly string[];
+/**
+ * Collect likely secret strings from an explicit env map and optional auth.json
+ * under `root`. Callers must pass values; no ambient environment or cwd (A7).
+ */
+export declare function projectSecrets(root: string, env?: Readonly<Record<string, string | undefined>>): readonly string[];

package/dist/model/settings.js

@@ -1,7 +1,11 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-export function projectSecrets(root = process.cwd()) {
-    const values = Object.entries(process.env)
+/**
+ * Collect likely secret strings from an explicit env map and optional auth.json
+ * under `root`. Callers must pass values; no ambient environment or cwd (A7).
+ */
+export function projectSecrets(root, env = {}) {
+    const values = Object.entries(env)
         .filter(([key]) => /key|token|secret|password|credential/i.test(key))
         .flatMap(([, value]) => (value ? [value] : []));
     for (const directory of [".nylorun", ".env"])

package/dist/sandbox/manager.d.ts

@@ -1,5 +1,5 @@
 import { type AgentManifest, type CapabilityManifest, type SandboxToolName } from "@nylorun/core/define";
-import type { Store } from "../core/store.js";
+import type { SessionStore } from "../store/types.js";
 import { type SandboxSelection, type SandboxSelectionReport } from "./select.js";
 import { type SandboxToolOutcome } from "./tools.js";
 import type { SandboxBackend } from "./types.js";
@@ -18,16 +18,23 @@ interface SandboxRecord {
     createdAt: string;
     updatedAt: string;
 }
+export interface SandboxSweepOptions {
+    /** The sweep's clock, in ms since the epoch. Defaults to `Date.now()`. */
+    readonly now?: number;
+    /** Whether a session still exists; sandboxes of deleted sessions are removed. */
+    readonly sessionExists: (sessionId: string) => boolean | Promise<boolean>;
+}
 export interface SandboxManagerOptions {
     /** Distinguishes this Runtime's sandboxes from other Runtimes on the same machine. */
     readonly scope: string;
-    readonly store: Store;
+    readonly store: SessionStore;
     readonly backends: readonly SandboxBackend[];
-    /** `auto`, `microsandbox` or `virtual`. Undefined means an invalid NYLORUN_SANDBOX value. */
+    /** `auto` or `virtual`. Undefined means an invalid NYLORUN_SANDBOX value. */
     readonly preference: string | undefined;
     /** Delete sandboxes on close (the Runtime's store does not outlive the process). */
     readonly ephemeral: boolean;
-    readonly emit: (sessionId: string, turnId: string | null, type: string, payload: unknown) => void;
+    /** Writes a session event in its own transaction; never called inside one. */
+    readonly emit: (sessionId: string, turnId: string | null, type: string, payload: unknown) => void | Promise<void>;
 }
 /** The sandbox capability that owns this tool call, when the call is a built-in sandbox tool. */
 export declare function sandboxCapabilityOf(manifest: AgentManifest | undefined, capabilityId: string | undefined, toolName: string | undefined): CapabilityManifest | undefined;
@@ -37,25 +44,36 @@ export declare class SandboxManager {
     private readonly live;
     private readonly prefix;
     private closing;
+    private reconciled;
     constructor(options: SandboxManagerOptions);
+    /**
+     * One Tenant sweep pass:
+     * - stops sandboxes idle for at least their idle timeout (their files remain; the next
+     *   call reattaches);
+     * - marks records whose compute this process does not hold as stopped (compute is gone
+     *   after a Runtime restart);
+     * - on the first pass of this process, removes sandboxes whose session no longer exists
+     *   (skipped for ephemeral Runtimes, which delete theirs on close).
+     */
+    sweep(options: SandboxSweepOptions): Promise<void>;
     /** Backends are probed once, on first use, and the choice holds for the life of the Runtime. */
     get ready(): Promise<SandboxSelection>;
     /** Whether any sandbox was ever recorded, so startup can skip probing for agents without one. */
-    hasRecords(): boolean;
+    hasRecords(): Promise<boolean>;
     keyOf(sessionId: string): string;
     report(): Promise<SandboxSelectionReport & {
         readonly defaultImage: string;
     }>;
     run(session: SandboxSessionRef, capability: CapabilityManifest, toolName: SandboxToolName, input: unknown, signal: AbortSignal): Promise<SandboxToolOutcome>;
     private execute;
+    private executeOpen;
     private open;
-    private armIdle;
     private stop;
     private record;
     /** The sandbox record for a session, if one was ever created. */
-    status(sessionId: string): SandboxRecord | undefined;
+    status(sessionId: string): Promise<SandboxRecord | undefined>;
     /** Delete sandboxes this Runtime owns whose session no longer exists. */
-    reconcile(sessionExists: (sessionId: string) => boolean): Promise<void>;
+    reconcile(sessionExists: (sessionId: string) => boolean | Promise<boolean>): Promise<void>;
     close(): Promise<void>;
 }
 export {};

package/dist/sandbox/manager.js

@@ -2,6 +2,10 @@
  * Sandbox Manager: owns sandbox lifecycle for the Runtime. One sandbox per session, created on
  * the first sandbox tool call, stopped after its idle timeout, reattached on the next call.
  * Commands against one sandbox run one at a time.
+ *
+ * The manager keeps no timers. The Tenant sweep calls `sweep`, which stops sandboxes idle
+ * past their timeout, marks records of compute this process no longer holds as stopped
+ * (after a restart), and, once per process, removes sandboxes whose session is gone.
  */
 import { createHash } from "node:crypto";
 import { isSandboxToolName, } from "@nylorun/core/define";
@@ -24,15 +28,53 @@ export class SandboxManager {
     live = new Map();
     prefix;
     closing = false;
+    reconciled = false;
     constructor(options) {
         this.options = options;
         this.prefix = `nylorun-${options.scope}-`;
-        // Compute is gone after a Runtime restart; files remain and the next call reattaches.
-        options.store.tx(() => {
-            for (const record of options.store.all("sandboxes"))
-                if (record.state !== "stopped")
-                    options.store.put("sandboxes", record.key, { ...record, state: "stopped" });
+    }
+    /**
+     * One Tenant sweep pass:
+     * - stops sandboxes idle for at least their idle timeout (their files remain; the next
+     *   call reattaches);
+     * - marks records whose compute this process does not hold as stopped (compute is gone
+     *   after a Runtime restart);
+     * - on the first pass of this process, removes sandboxes whose session no longer exists
+     *   (skipped for ephemeral Runtimes, which delete theirs on close).
+     */
+    async sweep(options) {
+        if (this.closing)
+            return;
+        const now = options.now ?? Date.now();
+        const idle = (live) => !!live.handle && live.active === 0 && now - live.lastUsedAt >= live.idleMs;
+        const stops = [];
+        for (const [key, live] of this.live) {
+            if (!idle(live))
+                continue;
+            // Queued behind any call already waiting; checked again when its turn comes.
+            live.tail = live.tail
+                .then(() => (idle(live) ? this.stop(key, live) : undefined))
+                .catch(() => undefined);
+            stops.push(live.tail);
+        }
+        await Promise.all(stops);
+        await this.options.store.tx(async (t) => {
+            for (const record of await t.listSandboxes()) {
+                if (record.state === "stopped")
+                    continue;
+                const live = this.live.get(record.key);
+                if (live && (live.handle || live.active > 0))
+                    continue;
+                await t.put("sandboxes", record.key, { ...record, state: "stopped" });
+            }
         });
+        if (this.reconciled || this.options.ephemeral)
+            return;
+        this.reconciled = true;
+        if (!(await this.hasRecords()))
+            return;
+        await this.reconcile(async (sessionId) => [...this.live.values()].some((live) => live.sessionId === sessionId) ||
+            (await options.sessionExists(sessionId)));
     }
     /** Backends are probed once, on first use, and the choice holds for the life of the Runtime. */
     get ready() {
@@ -42,15 +84,15 @@ export class SandboxManager {
                 ? selectSandboxBackend(this.options.backends, preference)
                 : Promise.resolve({
                     preference: "auto",
-                    reason: `NYLORUN_SANDBOX='${this.options.preference}' is not valid; use auto, microsandbox or virtual`,
+                    reason: `NYLORUN_SANDBOX='${this.options.preference}' is not valid; use auto or virtual`,
                     probes: [],
                 });
         }
         return this.selection;
     }
     /** Whether any sandbox was ever recorded, so startup can skip probing for agents without one. */
-    hasRecords() {
-        return this.options.store.all("sandboxes").length > 0;
+    async hasRecords() {
+        return (await this.options.store.tx((t) => t.counts())).sandboxes > 0;
     }
     keyOf(sessionId) {
         return this.prefix + createHash("sha256").update(sessionId).digest("hex").slice(0, 16);
@@ -84,7 +126,14 @@ export class SandboxManager {
             };
         let live = this.live.get(key);
         if (!live) {
-            live = { sessionId: session.id, backend, idleMs: idleMsOf(capability.sandbox), tail: Promise.resolve() };
+            live = {
+                sessionId: session.id,
+                backend,
+                idleMs: idleMsOf(capability.sandbox),
+                active: 0,
+                lastUsedAt: Date.now(),
+                tail: Promise.resolve(),
+            };
             this.live.set(key, live);
         }
         const entry = live;
@@ -97,15 +146,24 @@ export class SandboxManager {
             throw new Error("Turn cancelled");
         if (this.closing)
             throw new Error("Runtime is shutting down");
-        clearTimeout(live.timer);
+        live.active += 1;
+        try {
+            return await this.executeOpen(live, session, spec, toolName, input, signal);
+        }
+        finally {
+            live.active -= 1;
+            live.lastUsedAt = Date.now();
+        }
+    }
+    async executeOpen(live, session, spec, toolName, input, signal) {
         if (!live.handle) {
             try {
                 live.handle = await this.open(live, session, spec);
             }
             catch (error) {
                 const message = error instanceof Error ? error.message : String(error);
-                this.record(spec.key, session.id, live.backend.name, spec.image, "stopped");
-                this.options.emit(session.id, session.activeTurnId, "sandbox.state", {
+                await this.record(spec.key, session.id, live.backend.name, spec.image, "stopped");
+                await this.options.emit(session.id, session.activeTurnId, "sandbox.state", {
                     state: "stopped",
                     backend: live.backend.name,
                     error: message,
@@ -124,7 +182,7 @@ export class SandboxManager {
             const outcome = await runSandboxTool(live.handle, toolName, (input ?? {}), signal, (value) => {
                 report = value;
             });
-            this.options.emit(session.id, session.activeTurnId, "sandbox.exec", {
+            await this.options.emit(session.id, session.activeTurnId, "sandbox.exec", {
                 tool: toolName,
                 ...report,
                 ...(report.command ? { command: report.command.slice(0, 500) } : {}),
@@ -145,38 +203,26 @@ export class SandboxManager {
                 message: error instanceof Error ? error.message : String(error),
             };
         }
-        finally {
-            this.armIdle(spec.key, live);
-        }
     }
     async open(live, session, spec) {
-        const existing = this.options.store.get("sandboxes", spec.key);
+        const existing = await this.options.store.tx((t) => t.get("sandboxes", spec.key));
         const payload = {
             backend: live.backend.name,
             isolation: live.backend.isolation,
             image: spec.image,
             network: describeNetwork(spec.network),
         };
-        this.record(spec.key, session.id, live.backend.name, spec.image, "creating", existing);
-        this.options.emit(session.id, session.activeTurnId, "sandbox.state", {
+        await this.record(spec.key, session.id, live.backend.name, spec.image, "creating", existing);
+        await this.options.emit(session.id, session.activeTurnId, "sandbox.state", {
             state: "creating",
             ...payload,
             ...(existing ? { reattach: true } : {}),
         });
         const handle = await live.backend.open(spec);
-        this.record(spec.key, session.id, live.backend.name, spec.image, "running", existing);
-        this.options.emit(session.id, session.activeTurnId, "sandbox.state", { state: "running", ...payload });
+        await this.record(spec.key, session.id, live.backend.name, spec.image, "running", existing);
+        await this.options.emit(session.id, session.activeTurnId, "sandbox.state", { state: "running", ...payload });
         return handle;
     }
-    armIdle(key, live) {
-        clearTimeout(live.timer);
-        if (this.closing)
-            return;
-        live.timer = setTimeout(() => {
-            live.tail = live.tail.then(() => this.stop(key, live)).catch(() => undefined);
-        }, live.idleMs);
-        live.timer.unref();
-    }
     async stop(key, live) {
         const handle = live.handle;
         if (!handle)
@@ -186,25 +232,28 @@ export class SandboxManager {
             await handle.stop();
         }
         finally {
-            this.record(key, live.sessionId, live.backend.name, undefined, "stopped");
-            this.options.emit(live.sessionId, null, "sandbox.state", { state: "stopped", backend: live.backend.name });
+            await this.record(key, live.sessionId, live.backend.name, undefined, "stopped");
+            await this.options.emit(live.sessionId, null, "sandbox.state", { state: "stopped", backend: live.backend.name });
         }
     }
-    record(key, sessionId, backend, image, state, existing = this.options.store.get("sandboxes", key)) {
+    async record(key, sessionId, backend, image, state, known) {
         const now = new Date().toISOString();
-        this.options.store.tx(() => this.options.store.put("sandboxes", key, {
-            key,
-            sessionId,
-            backend,
-            image: image ?? existing?.image ?? "",
-            state,
-            createdAt: existing?.createdAt ?? now,
-            updatedAt: now,
-        }));
+        await this.options.store.tx(async (t) => {
+            const existing = known ?? (await t.get("sandboxes", key));
+            await t.put("sandboxes", key, {
+                key,
+                sessionId,
+                backend,
+                image: image ?? existing?.image ?? "",
+                state,
+                createdAt: existing?.createdAt ?? now,
+                updatedAt: now,
+            });
+        });
     }
     /** The sandbox record for a session, if one was ever created. */
     status(sessionId) {
-        return this.options.store.get("sandboxes", this.keyOf(sessionId));
+        return this.options.store.tx((t) => t.get("sandboxes", this.keyOf(sessionId)));
     }
     /** Delete sandboxes this Runtime owns whose session no longer exists. */
     async reconcile(sessionExists) {
@@ -212,11 +261,11 @@ export class SandboxManager {
         if (!backend)
             return;
         for (const key of await backend.list(this.prefix)) {
-            const record = this.options.store.get("sandboxes", key);
-            if (record && sessionExists(record.sessionId))
+            const record = await this.options.store.tx((t) => t.get("sandboxes", key));
+            if (record && (await sessionExists(record.sessionId)))
                 continue;
             await backend.remove(key);
-            this.options.store.tx(() => this.options.store.delete("sandboxes", key));
+            await this.options.store.tx((t) => t.delete("sandboxes", key));
         }
     }
     async close() {
@@ -224,7 +273,6 @@ export class SandboxManager {
         if (!this.selection)
             return;
         const tasks = [...this.live.entries()].map(async ([key, live]) => {
-            clearTimeout(live.timer);
             await live.tail;
             if (this.options.ephemeral) {
                 live.handle = undefined;

package/dist/sandbox/select.d.ts

@@ -7,7 +7,7 @@ export interface SandboxSelection {
     readonly reason: string;
     readonly probes: readonly SandboxProbe[];
 }
-/** Serializable view of a selection for the CLI and `GET /v1/host/sandbox`. */
+/** Serializable view of a selection for the CLI and `GET /v1/tenant/sandbox`. */
 export interface SandboxSelectionReport {
     readonly preference: SandboxPreference;
     readonly backend: SandboxBackendName | null;
@@ -15,7 +15,7 @@ export interface SandboxSelectionReport {
     readonly reason: string;
     readonly probes: readonly SandboxProbe[];
 }
-/** The default order: strongest isolation first, then the backend that always works. */
+/** The backends a Runtime probes, in order. `auto` picks the first available one. */
 export declare function defaultSandboxBackends(options: {
     readonly root: string;
 }): SandboxBackend[];
@@ -27,9 +27,10 @@ export declare function parseSandboxPreference(value: string | undefined): Sandb
 export declare function selectSandboxBackend(backends: readonly SandboxBackend[], preference: SandboxPreference): Promise<SandboxSelection>;
 export declare function reportSelection(selection: SandboxSelection): SandboxSelectionReport;
 /**
- * Probe this machine the way a Runtime would at startup. Used by `nylorun doctor sandbox`.
- * Nothing is created or booted.
+ * Probe backends the way a Tenant Runtime would at open.
+ * Callers must pass an explicit probe root; no ambient env or OS temp (A7).
  */
 export declare function probeSandboxBackends(options?: {
     readonly preference?: string;
+    readonly root?: string;
 }): Promise<SandboxSelectionReport>;