@nylorun/studio 0.5.0-beta → 0.6.0-beta

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.6.0-beta
+
+### Minor Changes
+
+- 41e613c: Ship the local SDK registry workflow with an independent SQLite Runtime, connected tool executor, authenticated Studio proxy, and a text-and-tool starter. Replace the legacy Hono starter and AG-UI transport. Require Node 24 and include the SDK in exact release compatibility pins.
+
+  Break the Harness execution import from `/engine` to `/run` and rename hosted execution APIs to durable execution APIs, including RunBinding, BoundRunOptions, and createRunState. Update all consumers without compatibility aliases; retain persisted checkpoint fields and version pins.
+
+### Patch Changes
+
+- 2898d02: Extract shared definitions and contracts into core and local orchestration into
+  CLI. Harness becomes execution-only; the SDK no longer installs the engine and
+  Runtime no longer depends on the SDK. Author applications through agents and
+  install cli for the unchanged nylorun commands. See the package architecture and
+  migration guide. Cloud installs published packages from npm independently.
+- Pin agents to the tested release.
+- Updated dependencies [41e613c]
+- Updated dependencies [2898d02]
+- Updated dependencies
+  - @nylorun/agents@0.2.0-beta
+
 ## 0.5.0-beta
 
 ### Minor Changes

package/README.md

@@ -1,11 +1,13 @@
-# `@nylorun/studio`
+# @nylorun/studio
 
-Local developer Studio for Nylorun agents.
+Local session dashboard for the OSS Runtime. Requires Node 24.
 
-See [docs.nylorun.com](https://docs.nylorun.com) for installation, configuration, and usage.
+The starter's `npm run dev` starts Studio automatically. To attach to an already running local project, use `npm run studio`, or `nylorun studio --runtime-url http://127.0.0.1:8787`.
 
-## Package independence
+Studio lists registered agents and sessions, sends text, displays completed assistant responses and tool inputs/results, restores history, observes canonical SSE events, and cancels a turn. Each session shows chat beside an **Events** inspector (history `/items` + live SSE `/events`) and an optional Agent Manifest tab. Responses appear when complete; token streaming, media, approvals UI, and remote deployment are deferred.
 
-Studio exposes `startStudio()` and has no engine or Runtime dependency. The `nylorun` executable is supplied by `@nylorun/runtime`; Studio no longer publishes `nylo`. Runtime loads the application-installed Studio for development or dashboard attachment. Studio accepts neutral version-2 manifests as well as legacy `harness.manifest` documents.
+The local Node host proxies a small allowlist of Runtime HTTP/SSE routes. It holds the server credential, stamps local ownership, and excludes executor claims/results. The browser never receives Runtime or executor credentials. Studio binds loopback and accepts only a loopback Runtime destination.
 
-Repository development: [contributing](../CONTRIBUTING.md). Package publication: [releasing](../RELEASING.md).
+Programmatic hosts use `startStudio({ runtimeUrl, serverKey, open: false })` and await the returned handle's `close()`. Studio uses `@nylorun/agents/client`; its browser bundle contains no harness engine. The CLI belongs to `@nylorun/cli`.
+
+For repository development and publication, see [CONTRIBUTING](../CONTRIBUTING.md) and [RELEASING](../RELEASING.md).

package/dist/host.d.ts

@@ -1,17 +1,18 @@
 export type StudioOptions = Readonly<{
-    agentServerUrl?: string;
+    runtimeUrl?: string;
+    serverKey?: string;
     port?: number;
     open?: boolean;
 }>;
 export type StudioHost = Readonly<{
     address: string;
-    readonly agentServerUrl: string;
-    setAgentServerUrl(url: string | undefined): void;
+    readonly runtimeUrl: string;
     open(): void;
     close(): Promise<void>;
 }>;
 export type StudioConfig = Readonly<{
-    agentServerUrl?: string;
+    runtimeUrl: string;
+    local: true;
 }>;
 export declare function parseAgentServerUrl(value: string): string;
 /** Serves the packaged React distribution and a non-secret in-memory runtime configuration. */

package/dist/host.js

@@ -1,4 +1,5 @@
-import { createServer } from "node:http";
+import { proxyRuntime } from "./proxy.js";
+import { createServer, } from "node:http";
 import { readFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { dirname, extname, join, resolve, sep } from "node:path";
@@ -15,7 +16,7 @@ const MIME_TYPES = Object.freeze({
     ".webmanifest": "application/manifest+json; charset=utf-8",
     ".svg": "image/svg+xml",
     ".webp": "image/webp",
-    ".woff2": "font/woff2"
+    ".woff2": "font/woff2",
 });
 export function parseAgentServerUrl(value) {
     let url;
@@ -23,23 +24,33 @@ export function parseAgentServerUrl(value) {
         url = new URL(value);
     }
     catch {
-        throw new Error("--agent-server-url must be an absolute http(s) URL.");
+        throw new Error("--runtime-url must be an absolute http(s) URL.");
     }
     if (url.protocol !== "http:" && url.protocol !== "https:")
-        throw new Error("--agent-server-url must use http or https.");
+        throw new Error("--runtime-url must use http or https.");
     if (url.username !== "" || url.password !== "")
-        throw new Error("--agent-server-url must not contain credentials.");
+        throw new Error("--runtime-url must not contain credentials.");
     if (url.search !== "" || url.hash !== "")
-        throw new Error("--agent-server-url must not contain a query string or fragment.");
+        throw new Error("--runtime-url must not contain a query string or fragment.");
     return url.href.replace(/\/$/u, "");
 }
 function json(response, status, value) {
-    response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", "x-content-type-options": "nosniff" });
+    response.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store",
+        "x-content-type-options": "nosniff",
+    });
     response.end(`${JSON.stringify(value)}\n`);
 }
-function reject(response, status, message) { json(response, status, { error: { message } }); }
+function reject(response, status, message) {
+    json(response, status, { error: { message } });
+}
 function browser(address) {
-    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const command = process.platform === "darwin"
+        ? "open"
+        : process.platform === "win32"
+            ? "cmd"
+            : "xdg-open";
     const args = process.platform === "win32" ? ["/c", "start", "", address] : [address];
     const child = spawn(command, args, { detached: true, stdio: "ignore" });
     child.unref();
@@ -55,14 +66,18 @@ function staticPath(root, pathname) {
     if (decoded.includes("\0"))
         return undefined;
     const candidate = resolve(root, decoded.replace(/^\/+/, "") || "index.html");
-    return candidate === root || candidate.startsWith(`${root}${sep}`) ? candidate : undefined;
+    return candidate === root || candidate.startsWith(`${root}${sep}`)
+        ? candidate
+        : undefined;
 }
 function staticHeaders(file) {
     const immutable = file.includes(`${sep}assets${sep}`);
     return {
         "content-type": MIME_TYPES[extname(file)] ?? "application/octet-stream",
-        "cache-control": immutable ? "public, max-age=31536000, immutable" : "no-store",
-        "x-content-type-options": "nosniff"
+        "cache-control": immutable
+            ? "public, max-age=31536000, immutable"
+            : "no-store",
+        "x-content-type-options": "nosniff",
     };
 }
 async function sendFile(response, method, file) {
@@ -92,7 +107,9 @@ async function listenOn(host, port, handle) {
     return server;
 }
 function ipv6Optional(error) {
-    return error instanceof Error && "code" in error && ["EADDRNOTAVAIL", "EAFNOSUPPORT", "EPERM"].includes(String(error.code));
+    return (error instanceof Error &&
+        "code" in error &&
+        ["EADDRNOTAVAIL", "EAFNOSUPPORT", "EPERM"].includes(String(error.code)));
 }
 async function bindLoopback(handle, port) {
     const ipv4 = await listenOn("127.0.0.1", port, handle);
@@ -102,11 +119,20 @@ async function bindLoopback(handle, port) {
         throw new Error("Studio did not report a TCP address.");
     }
     try {
-        return Object.freeze({ port: address.port, servers: Object.freeze([ipv4, await listenOn("::1", address.port, handle)]) });
+        return Object.freeze({
+            port: address.port,
+            servers: Object.freeze([
+                ipv4,
+                await listenOn("::1", address.port, handle),
+            ]),
+        });
     }
     catch (error) {
         if (ipv6Optional(error))
-            return Object.freeze({ port: address.port, servers: Object.freeze([ipv4]) });
+            return Object.freeze({
+                port: address.port,
+                servers: Object.freeze([ipv4]),
+            });
         ipv4.close();
         throw error;
     }
@@ -121,7 +147,9 @@ async function listenForStudio(handle, port) {
         }
         catch (error) {
             lastError = error;
-            if (!(error instanceof Error) || !("code" in error) || error.code !== "EADDRINUSE")
+            if (!(error instanceof Error) ||
+                !("code" in error) ||
+                error.code !== "EADDRINUSE")
                 throw error;
         }
     }
@@ -130,22 +158,33 @@ async function listenForStudio(handle, port) {
 /** Serves the packaged React distribution and a non-secret in-memory runtime configuration. */
 export async function startStudio(options = {}) {
     const root = resolve(dirname(fileURLToPath(import.meta.url)), "..", "dist", "web");
-    const requestedAgentServerUrl = options.agentServerUrl === undefined ? undefined : parseAgentServerUrl(options.agentServerUrl);
+    const requestedAgentServerUrl = options.runtimeUrl === undefined
+        ? undefined
+        : parseAgentServerUrl(options.runtimeUrl);
+    if (!requestedAgentServerUrl || !options.serverKey)
+        throw new Error("Studio requires runtimeUrl and a serverKey");
+    if (!["localhost", "127.0.0.1", "[::1]"].includes(new URL(requestedAgentServerUrl).hostname))
+        throw new Error("This Studio release connects only to a loopback Runtime");
     let origin = "";
     let agentServerUrl = requestedAgentServerUrl;
     const handle = (request, response) => {
         void (async () => {
             const url = new URL(request.url ?? "/", origin || "http://localhost");
-            if (origin === "" || !loopbackHosts(Number(new URL(origin).port)).has(request.headers.host ?? "")) {
+            if (origin === "" ||
+                !loopbackHosts(Number(new URL(origin).port)).has(request.headers.host ?? "")) {
                 reject(response, 421, "Studio only accepts its own loopback Host header.");
                 return;
             }
-            if (url.pathname === "/_studio" || url.pathname.startsWith("/_studio/")) {
-                reject(response, 404, "Studio has no API routes.");
+            if (url.pathname.startsWith("/_studio/runtime/")) {
+                await proxyRuntime(request, response, {
+                    origin: `http://${request.headers.host}`,
+                    runtimeUrl: agentServerUrl,
+                    serverKey: options.serverKey,
+                });
                 return;
             }
             if (url.pathname === CONFIG_PATH && request.method === "GET") {
-                json(response, 200, agentServerUrl === undefined ? {} : { agentServerUrl });
+                json(response, 200, { runtimeUrl: "/_studio/runtime", local: true });
                 return;
             }
             if (request.method !== "GET" && request.method !== "HEAD") {
@@ -165,22 +204,28 @@ export async function startStudio(options = {}) {
             }
             if (!(await sendFile(response, request.method, join(root, "index.html"))))
                 reject(response, 500, "Studio distribution is missing. Reinstall or rebuild @nylorun/studio.");
-        })();
+        })().catch(() => {
+            if (!response.headersSent)
+                reject(response, 500, "Studio request failed");
+            else
+                response.end();
+        });
     };
     const bound = await listenForStudio(handle, options.port);
     origin = `http://localhost:${bound.port}`;
     const address = origin;
     const host = Object.freeze({
         address,
-        get agentServerUrl() { return agentServerUrl ?? ""; },
-        setAgentServerUrl: (url) => { agentServerUrl = url === undefined ? undefined : parseAgentServerUrl(url); },
+        get runtimeUrl() {
+            return agentServerUrl;
+        },
         open: () => browser(address),
         close: async () => {
             await Promise.all(bound.servers.map((server) => new Promise((done, reject) => {
                 server.closeAllConnections();
                 server.close((error) => error === undefined ? done() : reject(error));
             })));
-        }
+        },
     });
     if (options.open !== false)
         host.open();

package/dist/index.d.ts

@@ -1,3 +1,2 @@
-export { parseAgentServerUrl, startStaticStudio, startStudio } from "./host.js";
+export { startStudio } from "./host.js";
 export type { StudioConfig, StudioHost, StudioOptions } from "./host.js";
-export type { StudioAgentManifest, StudioCapabilityManifest, StudioDiscoveryDocument, StudioDiscoveryEntry, StudioEndpointSet, StudioManifestTool, } from "./protocol.js";

package/dist/index.js

@@ -1 +1 @@
-export { parseAgentServerUrl, startStaticStudio, startStudio } from "./host.js";
+export { startStudio } from "./host.js";

package/dist/proxy.d.ts

@@ -0,0 +1,7 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+/** Local tooling proxy: credentials stay in this process, not the browser. */
+export declare function proxyRuntime(request: IncomingMessage, response: ServerResponse, options: {
+    origin: string;
+    runtimeUrl: string;
+    serverKey: string;
+}): Promise<void>;

package/dist/proxy.js

@@ -0,0 +1,90 @@
+/** Local tooling proxy: credentials stay in this process, not the browser. */
+export async function proxyRuntime(request, response, options) {
+    const incoming = new URL(request.url, options.origin);
+    const path = incoming.pathname.slice("/_studio/runtime".length);
+    const method = request.method ?? "GET";
+    const fail = (status, message) => {
+        response.writeHead(status, { "content-type": "application/json" });
+        response.end(JSON.stringify({ message }));
+    };
+    const read = method === "GET" &&
+        (/^\/v1\/(agents|sessions)$/.test(path) ||
+            /^\/v1\/sessions\/[^/]+(?:\/(items|events))?$/.test(path));
+    const write = (method === "PUT" && /^\/v1\/sessions\/[^/]+$/.test(path)) ||
+        (method === "POST" && /^\/v1\/sessions\/[^/]+\/commands$/.test(path));
+    if (!read && !write)
+        return fail(404, "Unsupported Studio operation");
+    if (write && request.headers.origin !== options.origin)
+        return fail(403, "Studio mutations require a same-origin request");
+    let body;
+    if (write) {
+        if (!request.headers["content-type"]?.startsWith("application/json"))
+            return fail(415, "JSON required");
+        let text = "";
+        for await (const chunk of request) {
+            text += chunk;
+            if (Buffer.byteLength(text) > 1024 * 1024)
+                return fail(413, "Request too large");
+        }
+        let value;
+        try {
+            value = JSON.parse(text);
+        }
+        catch {
+            return fail(400, "Invalid JSON");
+        }
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return fail(400, "JSON object required");
+        if (method === "PUT")
+            value.ownerUserId = "local-developer";
+        else if (!["message", "cancel"].includes(value.type))
+            return fail(400, "This Studio release supports message and cancel commands");
+        body = JSON.stringify(value);
+    }
+    const controller = new AbortController();
+    response.on("close", () => controller.abort());
+    try {
+        const upstream = await fetch(options.runtimeUrl + path + incoming.search, {
+            method,
+            body,
+            redirect: "error",
+            signal: controller.signal,
+            headers: {
+                authorization: `Bearer ${options.serverKey}`,
+                ...(body ? { "content-type": "application/json" } : {}),
+                ...(request.headers["last-event-id"]
+                    ? { "last-event-id": String(request.headers["last-event-id"]) }
+                    : {}),
+                accept: request.headers.accept ?? "application/json",
+            },
+        });
+        response.writeHead(upstream.status, {
+            "content-type": upstream.headers.get("content-type") ?? "application/json",
+            "cache-control": "no-store",
+            "x-accel-buffering": "no",
+        });
+        response.flushHeaders();
+        if (upstream.body)
+            for await (const chunk of upstream.body) {
+                if (!response.write(chunk))
+                    await new Promise((resolve) => {
+                        const done = () => {
+                            response.off("drain", done);
+                            response.off("close", done);
+                            resolve();
+                        };
+                        response.once("drain", done);
+                        response.once("close", done);
+                    });
+                if (controller.signal.aborted)
+                    break;
+            }
+        response.end();
+    }
+    catch {
+        if (!response.headersSent)
+            fail(502, "Local Runtime is unavailable");
+        else
+            response.end();
+    }
+}