@zenera/cli 1.1.36 → 1.1.39

package/dist/sandbox.js

@@ -1,202 +1,12 @@
-import { DEFAULT_SANDBOX_IMAGE, GATEWAY_URL_ENV, SANDBOX_GROUP, SandboxPool, } from '@zenera/neo';
-import { mkdirSync } from 'node:fs';
-import { basename, join } from 'node:path';
-import { resolveBuild } from "./image.js";
-import { credentials } from "./keys.js";
 import { assertLocks, ensurePodmanReady } from "./podman.js";
-import { warn } from "./term.js";
-// ---------------------------------------------------------------------------
-// The sandbox, as this CLI wires it
-//
-// The library takes resolved values; the config states names and numbers. This
-// is the layer between the two, and it owns the two decisions the library has
-// no business making: which host variables are worth forwarding, and where the
-// container's home directory lives.
-//
-// It lives in the session directory, which is the whole point. A session is
-// already a self-contained thing — copy the directory and its conversation,
-// memory and blobs travel with it — and a `pip install --user` that vanished
-// on close would be the only part of a session that did not. So `$HOME` is a
-// bind mount into `.data/sandbox/home`, and what the agent installs for itself
-// is still there when the session is opened again. Everything *outside* the
-// mounts is throwaway, which is what keeps a stale container from becoming a
-// second, invisible configuration.
-// ---------------------------------------------------------------------------
-/** Where the persistent home lives, inside the container. */
-const HOME = '/home/agent';
-/** Where a credential *file* is mounted, inside the container. */
-const KEY_MOUNT = '/run/zenera/keys';
-/**
- * The credentials the run is using, in the form a container takes.
- *
- * Two shapes, two mechanisms. A secret is forwarded by *name* — podman reads
- * the value from its own environment, so nothing is written into an argv that
- * `ps` will show. A service-account file has to be present as a file, so the
- * one file is bind-mounted read-only and the variable is rewritten to where it
- * landed; mounting the directory it came from would drag in whatever else the
- * user keeps beside it.
- *
- * This is the part of the design that gives something away, and it should be
- * said plainly: the sandbox runs code the model wrote, and a key it can read
- * is a key it can send. `keys: false`, or `network: none`, is the answer for a
- * project where that is not an acceptable trade.
- */
-function forwarded() {
-    const secrets = [];
-    const env = {};
-    const mounts = [];
-    for (const cred of credentials()) {
-        if (cred.holds === 'file') {
-            const at = `${KEY_MOUNT}/${basename(cred.value)}`;
-            mounts.push({ host: cred.value, at, readOnly: true });
-            env[cred.env] = at;
-            continue;
-        }
-        secrets.push(cred.env);
-    }
-    // Not secrets, and useless without one: a service account says which
-    // project it belongs to but never which region to call, and a gateway key
-    // says nothing of where the gateway is.
-    for (const name of ['GOOGLE_CLOUD_PROJECT', 'GOOGLE_CLOUD_LOCATION', GATEWAY_URL_ENV]) {
-        const value = process.env[name];
-        if (value) {
-            env[name] = value;
-        }
-    }
-    return { secrets, env, mounts };
-}
-export function buildSandbox(opts) {
-    // An explicit --image is an answer, so there is nothing left to build.
-    const build = opts.image ? undefined : resolveBuild(opts.root, opts.config.sandbox);
-    const base = {
-        ...(opts.config.sandbox ?? {}),
-        ...((opts.image ?? build?.tag) ? { image: opts.image ?? build?.tag } : {}),
-        ...(opts.keys === false ? { keys: false } : {}),
-        ...(opts.persist === false ? { persist: false } : {}),
-    };
-    const home = join(opts.session.data, 'sandbox', 'home');
-    const mounts = [{ host: home, at: HOME }, ...(opts.mounts ?? [])];
-    const keys = base.keys === false ? undefined : forwarded();
-    if (keys) {
-        mounts.push(...keys.mounts);
-    }
-    // Skills and assets are mounted read-only, and a python script run from a
-    // read-only directory fails on writing its own `__pycache__` — a confusing
-    // error about a file nobody asked for.
-    // `ZENERA_AGENT` tells a `zen` run by `run_command` that no person is there.
-    const extra = { HOME, PYTHONDONTWRITEBYTECODE: '1', ZENERA_AGENT: '1', ...(keys?.env ?? {}) };
-    const spec = toSpec(base, extra, secretsOf(keys?.secrets, opts.env));
-    const agents = {};
-    for (const agent of opts.config.agents) {
-        if (agent.sandbox) {
-            const merged = merge(base, agent.sandbox);
-            if (opts.persist === false) {
-                merged.persist = false;
-            }
-            // An agent that opts out gets neither the variables nor the mount,
-            // but the mount is on the pool and cannot be taken back per agent —
-            // so the variable is what actually decides, and without it the file
-            // sitting there is not a credential anything will look for.
-            const own = merged.keys === false ? undefined : keys;
-            agents[agent.name] = toSpec(merged, { HOME, PYTHONDONTWRITEBYTECODE: '1', ZENERA_AGENT: '1', ...(own?.env ?? {}) }, own && secretsOf(own.secrets, opts.env));
-        }
-    }
-    const pool = new SandboxPool({
-        ...spec,
-        agents,
-        root: opts.workspace,
-        key: opts.session.id,
-        readOnly: opts.readOnly,
-        mounts,
-    });
-    return { pool, spec, image: spec.image ?? DEFAULT_SANDBOX_IMAGE, build, home, mounts };
-}
-/**
- * An agent's overrides on the project's block. `image` and `build` answer the
- * same question, so naming either one drops the other: a plain spread would
- * leave an agent's `image` sitting next to the project's `build`, and the
- * schema forbids exactly that combination when it is written down.
- */
-function merge(base, agent) {
-    const merged = { ...base, ...agent };
-    if (agent.image !== undefined) {
-        delete merged.build;
-    }
-    if (agent.build !== undefined) {
-        delete merged.image;
-    }
-    return merged;
-}
-/**
- * The two sources of forwarded names, as one list: the credentials the keyring
- * selected, and whatever the project's `.env` declares. Deduped, because the
- * same variable named twice is the same `--env` twice.
- *
- * `undefined` in means keys are withheld, and the file goes with them.
- */
-function secretsOf(secrets, env) {
-    if (!secrets) {
-        return undefined;
-    }
-    return [...new Set([...secrets, ...(env ?? [])])];
-}
-/**
- * Config names a variable; this reads it. A name that is not set on this host
- * is simply not forwarded — an empty string in the container is a different
- * thing from an absent one, and tools test for absence.
- *
- * A name that has already been answered with a value drops off the forwarded
- * list: `--env NAME=value` and `--env NAME` are the same variable twice, and
- * the one that carries a value is the one that was resolved on purpose. That
- * matters for `GOOGLE_APPLICATION_CREDENTIALS`, which is rewritten here to
- * where the key file was mounted — a `.env` naming it must not put the host's
- * path back, since that path does not exist inside the container.
- */
-function toSpec(config, extra, secrets) {
-    const env = { ...extra };
-    for (const name of config.env ?? []) {
-        const value = process.env[name];
-        if (value !== undefined && value !== '') {
-            env[name] = value;
-        }
-    }
-    return {
-        image: config.image,
-        cpus: config.cpus,
-        memory: config.memory,
-        network: config.network,
-        workdir: config.workdir,
-        timeout: config.timeout,
-        hardening: config.hardening,
-        user: config.user,
-        persist: config.persist,
-        env,
-        secrets: secrets?.filter((name) => !(name in env)),
-    };
-}
-/**
- * Whether anything in this project can reach a shell.
- *
- * Read off the *resolved* tool lists rather than off the config's selectors,
- * because `sandbox:*`, `*` and a bare name all mean the same thing by the time
- * the loader is done, and only one of those three is greppable.
- */
-export function usesSandbox(project) {
-    return project.agents.some((a) => a.tools.some((t) => t.group === SANDBOX_GROUP));
-}
 /**
  * Images this process has already settled. A batch opens the same project
  * dozens of times at once, and without this each one shells out to podman and
  * the concurrent copies race each other to pull the very same image.
  */
 const READY = new Set();
-/**
- * Asked before the first turn rather than at the first tool call, so a missing
- * container engine costs nothing instead of costing a round trip and half a
- * plan. A project that never shells out never gets here at all.
- */
+/** The engine's preflight on a terminal: podman is offered for install and started if needed. */
 export async function preflight(setup, yes) {
-    mkdirSync(setup.home, { recursive: true });
     if (READY.has(setup.image)) {
         return;
     }
@@ -211,13 +21,4 @@ export async function preflight(setup, yes) {
     await assertLocks(1, { reuses: setup.pool.for().name });
     READY.add(setup.image);
 }
-/** Best-effort teardown: losing a container must never lose a run. */
-export async function teardown(pool) {
-    try {
-        await pool.dispose();
-    }
-    catch (err) {
-        warn(`could not clean up the sandbox: ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
 //# sourceMappingURL=sandbox.js.map

package/dist/term.d.ts

@@ -1,25 +1,4 @@
-export declare const EXIT: {
-    readonly ok: 0;
-    readonly failed: 1;
-    readonly usage: 2;
-    readonly invalid: 3;
-    readonly credentials: 4;
-    readonly sandbox: 5;
-};
-export type ExitCode = (typeof EXIT)[keyof typeof EXIT];
-/**
- * An error that already knows what it means. Anything else reaching the top is
- * a bug and exits `failed`, which is the distinction a script needs: a wrong
- * invocation and a wrong answer are not the same failure.
- */
-export declare class CliError extends Error {
-    readonly code: ExitCode;
-    readonly hint?: string;
-    constructor(message: string, code?: ExitCode, hint?: string);
-}
-export declare const usageError: (m: string, hint?: string) => CliError;
-export declare const invalidError: (m: string, hint?: string) => CliError;
-export declare const credentialError: (m: string, hint?: string) => CliError;
+export { EngineError as CliError, credentialError, EXIT, invalidError, usageError, type ExitCode, } from '@zenera/engine';
 export type Appearance = 'dark' | 'light';
 /** One grey per background. The only 256-colour indices in the CLI. */
 export declare const CHROME: Record<Appearance, number>;

package/dist/term.js

@@ -11,32 +11,9 @@ import { styleText } from 'node:util';
 // `styleText` no-ops when the stream is not a tty and honours NO_COLOR itself,
 // so there is no flag to thread through and no piped output to garble.
 // ---------------------------------------------------------------------------
-export const EXIT = {
-    ok: 0,
-    failed: 1,
-    usage: 2,
-    invalid: 3,
-    credentials: 4,
-    sandbox: 5,
-};
-/**
- * An error that already knows what it means. Anything else reaching the top is
- * a bug and exits `failed`, which is the distinction a script needs: a wrong
- * invocation and a wrong answer are not the same failure.
- */
-export class CliError extends Error {
-    code;
-    hint;
-    constructor(message, code = EXIT.failed, hint) {
-        super(message);
-        this.name = 'CliError';
-        this.code = code;
-        this.hint = hint;
-    }
-}
-export const usageError = (m, hint) => new CliError(m, EXIT.usage, hint);
-export const invalidError = (m, hint) => new CliError(m, EXIT.invalid, hint);
-export const credentialError = (m, hint) => new CliError(m, EXIT.credentials, hint);
+// The engine raises these too, so `instanceof CliError` holds for its errors.
+import { usageError } from '@zenera/engine';
+export { EngineError as CliError, credentialError, EXIT, invalidError, usageError, } from '@zenera/engine';
 /** One grey per background. The only 256-colour indices in the CLI. */
 export const CHROME = { dark: 245, light: 242 };
 let sniffed;

package/dist/tui/app.js

@@ -1,5 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { TextInput } from '@inkjs/ui';
+import { display } from '@zenera/engine';
 import { addUsage, isCheckpoint, turns, zeroUsage, } from '@zenera/neo';
 import { Box, Static, Text, useApp, useInput, useStdout } from 'ink';
 import { pathToFileURL } from 'node:url';
@@ -7,7 +8,6 @@ import React, { useCallback, useContext, useEffect, useRef, useState } from 'rea
 import * as Engine from "../engine.js";
 import { History } from "../history.js";
 import { format } from "../narrate.js";
-import { display } from "../session.js";
 import { CliError } from "../term.js";
 import { hostUrls, hyperlink, hyperlinks, linkBlock, mountsOf } from "./links.js";
 import { resolveTheme, THEMES } from "./theme.js";

package/dist/tui/models.d.ts

@@ -1,5 +1,5 @@
+import type { Provider } from '@zenera/engine';
 import { type Balance, type Catalog, type CatalogEntry, type Role } from '../catalog.ts';
-import type { Provider } from '../keys.ts';
 export interface ProviderRow {
     provider: Provider;
     /** where its credential came from — `environment`, `keyring` — or '' for none */

package/dist/validate.d.ts

@@ -1,6 +1,5 @@
+import { type DeclaredRole, type KeyStore, type Liveness } from '@zenera/engine';
 import { type AnyTool, type ProjectConfig, type Runner } from '@zenera/neo';
-import { type DeclaredRole } from './audit.ts';
-import { type KeyStore, type Liveness } from './keys.ts';
 /**
  * `error` — the project will not load, or will not run.
  * `warning` — it loads, and something about it is probably not what was meant.

package/dist/validate.js

@@ -1,10 +1,8 @@
+import { SHAPES, auditModels, credentialFor, envNames, form, resolveBuild, } from '@zenera/engine';
 import { EXA_GROUP, FileSkillProvider, SANDBOX_MOUNT, Sandbox, exaTools, fileTools, frontmatter, projectRegistry, readProjectConfig, sandboxTools, selectTools, toList, } from '@zenera/neo';
 import { existsSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
-import { auditModels, credentialFor } from "./audit.js";
-import { resolveBuild } from "./image.js";
-import { SHAPES, envNames, form } from "./keys.js";
 import { probeModels } from "./liveness.js";
 import { BuildError, ensurePodmanReady } from "./podman.js";
 import { ownVersion, staleShared } from "./scaffold.js";

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@zenera/cli",
-    "version": "1.1.36",
+    "version": "1.1.39",
     "description": "Command-line front end for @zenera/neo: agentic projects you can run, share and commit.",
     "keywords": [
         "agents",
@@ -15,13 +15,13 @@
         "access": "public"
     },
     "author": "Andrey Ryabov",
-    "homepage": "https://github.com/andreyryabov/ZeneraNeo#readme",
+    "homepage": "https://github.com/zenera-ai/ZeneraNeo#readme",
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/andreyryabov/ZeneraNeo.git",
+        "url": "git+https://github.com/zenera-ai/ZeneraNeo.git",
         "directory": "packages/cli"
     },
-    "bugs": "https://github.com/andreyryabov/ZeneraNeo/issues",
+    "bugs": "https://github.com/zenera-ai/ZeneraNeo/issues",
     "type": "module",
     "bin": {
         "zen": "./dist/main.js",
@@ -54,8 +54,9 @@
         "@google/genai": "^2.30.0",
         "@inkjs/ui": "^2.0.0",
         "@openrouter/sdk": "^1.4.25",
-        "@zenera/neo": "^1.1.36",
-        "@zenera/view": "^1.1.36",
+        "@zenera/engine": "^1.1.39",
+        "@zenera/neo": "^1.1.39",
+        "@zenera/view": "^1.1.39",
         "google-auth-library": "^10.0.0",
         "ink": "^7.1.1",
         "openai": "^6.0.0",

package/templates/editor/.github/skills/zen-cli/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: zen-cli
-description: How to drive this project from the terminal with `zen` - running it, validating it, credentials, the sandbox, run reports, and the `faker` and `rag` modules.
+description: How to drive this project from the terminal with `zen` - running it, validating it, credentials, the sandbox, run reports, and the `gym` and `rag` modules.
 ---
 
 # The `zen` command line
@@ -33,7 +33,7 @@ zen version
 
 zen meta     <run|prompts|resume|model|dataset> [project] [args]
 
-zen faker    <serve|build|cache> [spec...]
+zen gym      <serve|build|cache|model> [spec...]
 zen rag      schema <index|restore|ready|search|list|grep|trace|show|stats> [spec...]
 zen rag      docs <index|restore|ready|search|list|grep|show|stats> [path...]
 ```
@@ -61,7 +61,7 @@ guess a flag, and do not read them all.
 | The evaluation dataset: cases, drift, notes, drawing a sample       | [dataset.md](./references/dataset.md) (and `zen-dataset` skill) |
 | Tuning the prose on the dataset: workers, applies, STATUS.md        | [finetune.md](./references/finetune.md)                         |
 | Sharing a project: archives, what travels, importing one safely     | [export.md](./references/export.md)                             |
-| `zen faker` - a mock API from an OpenAPI/Swagger document           | [faker.md](./references/faker.md)                               |
+| `zen gym` - a mock API from an OpenAPI/Swagger document             | [gym.md](./references/gym.md)                                   |
 | `zen rag` - searching an API description, or a pile of markdown     | [rag.md](./references/rag.md)                                   |
 
 ## The short version

package/templates/editor/.github/skills/zen-cli/references/frame.md

@@ -37,7 +37,7 @@ Not listed in help, but they work.
 | `validate`, `doctor` | `check`   |
 | `report`             | `inspect` |
 | `edit`, `code`       | `open`    |
-| `mock`               | `faker`   |
+| `mock`               | `gym`     |
 
 ## stdout is the answer, stderr is the narration
 
@@ -103,7 +103,7 @@ A real environment variable always beats the keyring.
     projects.json         the registry: name -> directory
     keys.json             credentials (0600)
     keys/                 key files, for providers that hold a file
-    faker/                generator cache for `zen faker`
+    gym/                generator cache for `zen gym`
 
 <project>/
     zenera.json           { version, name }

package/templates/editor/.github/skills/zen-cli/references/{faker.md → gym.md}

@@ -1,11 +1,11 @@
-# Mock APIs - `zen faker`
+# Agent API environments - `zen gym`
 
 ```
-zen faker <serve|build|cache> [spec...]
+zen gym <serve|build|cache|model> [spec...]
 ```
 
-Alias: `zen mock`. Provided by `@zenera/faker` - `npm i -g @zenera/faker` if
-`zen faker` says it is not installed.
+Provided by `@zenera/gym` - `npm i -g @zenera/gym` if
+`zen gym` says it is not installed.
 
 Serves a mock API from one or more OpenAPI/Swagger documents. For each
 operation a **model writes a Python generator**, which is self-tested inside a
@@ -14,17 +14,18 @@ plausible, not `"string"` repeated.
 
 ## Subcommands
 
-| Command           | What it does                                          |
-| ----------------- | ----------------------------------------------------- |
-| `serve <spec...>` | Serve the documents. Generators are written on demand |
-| `build <spec...>` | Write every generator now and exit                    |
-| `cache ls\|clear` | What has been generated, or throw it away             |
+| Command           | What it does                                               |
+| ----------------- | ---------------------------------------------------------- |
+| `serve <spec...>` | Serve the documents. Generators are written on demand      |
+| `build <spec...>` | Write every generator now and exit                         |
+| `cache ls\|clear` | What has been generated, or throw it away                  |
+| `model [ref]`     | Show or set the model; `--clear` forgets the stored choice |
 
 ```
-zen faker serve openapi.yaml
-zen faker serve api/*.yaml --port 9000 --seed 7
-zen faker build openapi.yaml --concurrency 8
-zen faker cache clear
+zen gym serve openapi.yaml
+zen gym serve api/*.yaml --port 9000 --seed 7
+zen gym build openapi.yaml --concurrency 8
+zen gym cache clear
 ```
 
 `build` is the one to run in CI or before a demo: it pays for every generator up
@@ -32,23 +33,25 @@ front and exits non-zero, with a table, if any could not be written.
 
 ## Options
 
-| Flag                | Default               | Meaning                                         |
-| ------------------- | --------------------- | ----------------------------------------------- |
-| `--port <n>`        | `8787`                | Port to listen on                               |
-| `--host <h>`        | `127.0.0.1`           | Anything else is reachable off-machine          |
-| `--model <ref>`     | project default       | Which model writes the generators               |
-| `--image <ref>`     | a baked image         | Skip the baked image and use this one           |
-| `--cache <dir>`     | `~/.zenera/neo/faker` | Where generators live                           |
-| `--seed <n>`        | -                     | Answer the same request the same way every time |
-| `--attempts <n>`    | `3`                   | Tries per generator before giving up            |
-| `--concurrency <n>` | `4`                   | Generators written at once                      |
-| `--timeout <s>`     | `30`                  | Seconds one generator may take                  |
-| `--max-body <n>`    | 1 MB                  | Largest request body accepted, in bytes         |
-| `--rebuild`         | -                     | Ignore what is cached and write it again        |
-| `--no-cache`        | -                     | Do not record what is written                   |
-| `--quiet`           | -                     | No narration                                    |
+| Flag                | Default             | Meaning                                         |
+| ------------------- | ------------------- | ----------------------------------------------- |
+| `--port <n>`        | `8787`              | Port to listen on                               |
+| `--host <h>`        | `127.0.0.1`         | Anything else is reachable off-machine          |
+| `--model <ref>`     | project default     | Which model writes the generators               |
+| `--image <ref>`     | a baked image       | Skip the baked image and use this one           |
+| `--cache <dir>`     | `~/.zenera/neo/gym` | Where generators live                           |
+| `--seed <n>`        | -                   | Answer the same request the same way every time |
+| `--attempts <n>`    | `3`                 | Tries per generator before giving up            |
+| `--concurrency <n>` | `4`                 | Generators written at once                      |
+| `--timeout <s>`     | `30`                | Seconds one generator may take                  |
+| `--max-body <n>`    | 1 MB                | Largest request body accepted, in bytes         |
+| `--rebuild`         | -                   | Ignore what is cached and write it again        |
+| `--no-cache`        | -                   | Do not record what is written                   |
+| `--quiet`           | -                   | No narration                                    |
 
 Credentials come from the `zen` keyring - see [keys.md](keys.md).
+Model selection: `--model`, `ZENERA_GYM_MODEL`, `~/.zenera/neo/gym.json`,
+then the best model the available keys support.
 
 ## Serving
 
@@ -56,17 +59,19 @@ Binds the loopback address by default. On start it prints a table per document:
 paths, methods, and how many operations have a response schema and therefore get
 a generator.
 
-| Endpoint          | Answers                   |
-| ----------------- | ------------------------- |
-| `/__faker/routes` | Every route it will serve |
-| `/__faker/health` | Whether it is up          |
+| Endpoint        | Answers                   |
+| --------------- | ------------------------- |
+| `/__gym/routes` | Every route it will serve |
+| `/__gym/health` | Whether it is up          |
 
 Response headers:
 
-| Header              | Meaning                                               |
-| ------------------- | ----------------------------------------------------- |
-| `x-faker-operation` | The `operationId` that answered                       |
-| `x-faker-cache`     | `hit` or `miss` - whether this call cost a model turn |
+| Header            | Meaning                                               |
+| ----------------- | ----------------------------------------------------- |
+| `x-gym-operation` | The `operationId` that answered                       |
+| `x-gym-cache`     | `hit` or `miss` - whether this call cost a model turn |
+
+Gym provides simulation, not task scoring, rewards, or a training loop.
 
 Incoming headers are filtered: `authorization`, `cookie` and anything matching
 `key|token|secret|password|credential` never reach a generator.
@@ -91,7 +96,7 @@ Probes are synthetic on purpose - real request bodies never reach a prompt.
 
 ## The cache
 
-Generators live in the machine's shared cache, `~/.zenera/neo/cache/faker-generator/`,
+Generators live in the machine's shared cache, `~/.zenera/neo/cache/gym-generator/`,
 keyed by the operation's shape - so the same spec served from two directories is
 written once, and a spec edit produces a new key rather than a stale answer. A
 generator that a model gave up on is remembered for the life of the process, so
@@ -99,17 +104,17 @@ a hopeless operation is not re-asked on every request; a _transient_ failure - a
 429, a dropped socket - is not, because it is about this minute rather than this
 operation.
 
-`~/.zenera/neo/faker/` is the container's workspace, and scratch: a cache hit is
+`~/.zenera/neo/gym/` is the container's workspace, and scratch: a cache hit is
 copied into it, because the container can only run what is under its mount.
 
-`zen faker cache ls` lists what has been generated. `zen faker cache clear`
+`zen gym cache ls` lists what has been generated. `zen gym cache clear`
 removes the generators, the workspace and the container together. They have to
 go together: the container's name is a hash of its configuration, so deleting
 the workspace alone would leave a stopped container bind-mounted onto a
 directory that no longer exists, and every generator would fail with
 `python3: can't open file '/workspace/generators/…/gen.py'`.
 
-`zen cache ls --kind faker-generator` reaches the same entries from the other
+`zen cache ls --kind gym-generator` reaches the same entries from the other
 side, along with everything else this machine has cached.
 
 ## Documents it accepts

package/templates/editor/.github/skills/zen-cli/references/keys.md

@@ -77,7 +77,7 @@ turns gateway mode on without the keyring - and `zen key mode`/`ls`/`check`
 report and probe it (`bifrost/$BIFROST_API_KEY`), with nothing stored. In this
 mode `zen models` lists only
 what the gateway serves - see `models.md`. The full guide is
-[docs/gateway.md](https://github.com/andreyryabov/ZeneraNeo/blob/main/docs/gateway.md).
+[docs/gateway.md](https://github.com/zenera-ai/ZeneraNeo/blob/main/docs/gateway.md).
 
 ### Vertex takes either shape
 
@@ -141,6 +141,6 @@ The frame does **not** materialise the keyring for you - each command that needs
 a credential opens the store itself. If `zen key ls` shows a key as live and a
 command still says `provider "openai": no api key - set OPENAI_API_KEY`, the
 credential is fine and the command is at fault. Everything that runs a model
-(`run`, `check`, `models`, `faker`, `rag`) already does this.
+(`run`, `check`, `models`, `gym`, `rag`) already does this.
 
 Exit code `4` means no usable credential for what was asked.

package/templates/editor/.github/skills/zen-cli/references/models.md

@@ -58,7 +58,7 @@ stderr with a `⇄ bifrost mode` line, `browse` carries the same badge on every
 screen, and `--json` adds a `gateway` field. `zen models` then does go to the
 network, since one request covers every provider; `test` asks through the
 gateway too. The full guide is
-[docs/gateway.md](https://github.com/andreyryabov/ZeneraNeo/blob/main/docs/gateway.md).
+[docs/gateway.md](https://github.com/zenera-ai/ZeneraNeo/blob/main/docs/gateway.md).
 
 ## Testing a model
 

package/templates/editor/.github/skills/zen-cli/references/rag.md

@@ -34,7 +34,7 @@ zen rag schema index <spec...> [--embedding <ref>] [-o <dir>] [--batch <n>]
 zen rag schema index openapi.yaml --embedding openai:text-embedding-3-small
 ```
 
-Unlike the faker, `$ref`s are **bundled, not dereferenced**: component names are
+Unlike the gym, `$ref`s are **bundled, not dereferenced**: component names are
 the node ids and the cycles between them are the edges. `discriminator` is kept -
 it is what turns a `oneOf` into a tagged union a compiler can narrow.
 

package/templates/editor/.vscode/agents.schema.json

@@ -1,6 +1,6 @@
 {
     "$schema": "http://json-schema.org/draft-07/schema#",
-    "$id": "https://raw.githubusercontent.com/andreyryabov/ZeneraNeo/main/packages/cli/templates/editor/.vscode/agents.schema.json",
+    "$id": "https://raw.githubusercontent.com/zenera-ai/ZeneraNeo/main/packages/cli/templates/editor/.vscode/agents.schema.json",
     "title": "Zenera Neo agents.yaml",
     "description": "Who exists in this project, what they may reach for, and which model answers for them. Written by `zen init` and replaced by every `zen init` and `zen open`, so it describes the version of `zen` in hand. The runtime is the authority: `zen check` reads the project the way a run does.",
     "type": "object",