nylorun 0.12.2-beta → 0.14.0-beta

package/dist/client/doctor.js

@@ -0,0 +1,72 @@
+import { release } from "node:os";
+import { findProjectRoot } from "@nylorun/core/project";
+import { CliError } from "../errors.js";
+import { linkedConnection, managementClient } from "./project/connection.js";
+function platformLine() {
+    const os = process.platform === "darwin"
+        ? "macOS"
+        : process.env.WSL_DISTRO_NAME
+            ? `Linux (WSL: ${process.env.WSL_DISTRO_NAME})`
+            : process.platform;
+    return `${os} (kernel ${release()}) · ${process.arch}`;
+}
+/** The Tenant's sandbox report (`GET /v1/tenant/sandbox`, Management API). */
+async function fetchSandboxReport() {
+    const connection = await linkedConnection(findProjectRoot() ?? process.cwd());
+    return (await managementClient(connection).settings.sandbox.get());
+}
+/** `nylo doctor sandbox`: Tenant sandbox report via the Management API (F2-4). */
+export async function doctorSandbox(options) {
+    let report;
+    try {
+        report = await fetchSandboxReport();
+    }
+    catch (error) {
+        throw new CliError(error instanceof Error
+            ? error.message
+            : `Could not read Tenant sandbox status: ${String(error)}`, 1);
+    }
+    if (options.json) {
+        console.log(JSON.stringify({ platform: platformLine(), ...report }, null, 2));
+        return;
+    }
+    const rows = [["platform", platformLine()]];
+    for (const probe of report.probes)
+        rows.push([
+            probe.name,
+            `${probe.available ? "✓" : "✗"} ${probe.reason ?? ""}${probe.version ? ` · ${probe.version}` : ""}`,
+        ]);
+    rows.push([
+        "preference",
+        report.preference === "auto"
+            ? "auto (npx nylorun start seeds the Tenant's sandbox.backend from .env NYLORUN_SANDBOX)"
+            : report.preference,
+    ]);
+    rows.push([
+        "sessions",
+        "get a sandbox only on an Environment (createSession({ environment }) names one)",
+    ]);
+    const limits = report.config?.limits;
+    if (limits)
+        rows.push([
+            "limits",
+            [
+                limits.idle ? `idle ${limits.idle}` : undefined,
+                limits.environments === undefined ? undefined : `${limits.environments} environments`,
+                limits.network ? `${limits.network.length} allowed hosts` : undefined,
+            ]
+                .filter((item) => item !== undefined)
+                .join(", ") || "-",
+        ]);
+    rows.push([
+        "selected",
+        report.backend
+            ? `${report.backend} (${report.isolation} isolation)`
+            : `none: ${report.reason}`,
+    ]);
+    const width = Math.max(...rows.map(([key]) => key.length)) + 2;
+    for (const [key, value] of rows)
+        console.log(`  ${key.padEnd(width)}${value}`);
+    if (report.backend === "virtual")
+        console.log("\n  The virtual shell emulates bash in the Runtime process; it is not a VM boundary.");
+}

package/dist/client/installation/commands.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `nylo status [--json]`: the Tenant, its checks and counts. A Tenant that is not open does not
+ * answer: `npx nylorun status` reports why.
+ */
+export declare function statusCommand(args: readonly string[]): Promise<void>;
+/** `nylo reset [--sessions|--environments|--all] [--yes]`; `--all` asks first. */
+export declare function resetCommand(args: readonly string[]): Promise<void>;

package/dist/client/installation/commands.js

@@ -0,0 +1,82 @@
+/**
+ * `nylo status` and `nylo reset`: the linked installation's one Tenant, through the Management
+ * API (the Project's management key).
+ */
+import { createInterface } from "node:readline/promises";
+import { findProjectRoot } from "@nylorun/core/project";
+import { CliError } from "../../errors.js";
+import { linkedConnection, managementClient } from "../project/connection.js";
+const projectRoot = () => findProjectRoot() ?? process.cwd();
+/**
+ * `nylo status [--json]`: the Tenant, its checks and counts. A Tenant that is not open does not
+ * answer: `npx nylorun status` reports why.
+ */
+export async function statusCommand(args) {
+    const json = args.includes("--json");
+    if (args.some((a) => a !== "--json"))
+        throw new CliError("Usage: nylo status [--json]", 2);
+    const root = projectRoot();
+    const connection = await linkedConnection(root);
+    const admin = managementClient(connection);
+    let body;
+    try {
+        body = await admin.tenant.status();
+    }
+    catch (error) {
+        throw new CliError(`${(error instanceof Error ? error.message : `The Tenant at ${connection.url} is not reachable`).replace(/\.?$/, ".")} Run "npx nylorun status" to see the Tenant's state and why it is not open.`, 1);
+    }
+    if (json) {
+        console.log(JSON.stringify(body, null, 2));
+        return;
+    }
+    console.log(`${body.tenant.name}  ${body.tenant.id}`);
+    console.log(`runtime  ${connection.url}`);
+    console.log(`path     ${body.path}`);
+    console.log(`checks   ${Object.entries(body.checks)
+        .map(([k, v]) => `${k}=${v ? "ok" : "fail"}`)
+        .join(" ")}`);
+    console.log(`counts   sessions=${body.counts.sessions} running=${body.counts.runningSessions} uncertain=${body.counts.uncertainEffects}`);
+    console.log(`sandbox  ${body.sandbox.backend ?? "none"}`);
+}
+const RESET_USAGE = "Usage: nylo reset [--sessions|--environments|--all] [--yes]";
+const SCOPES = { "--sessions": "sessions", "--environments": "environments", "--all": "all" };
+/** `nylo reset [--sessions|--environments|--all] [--yes]`; `--all` asks first. */
+export async function resetCommand(args) {
+    const yes = args.includes("--yes");
+    const flags = args.filter((a) => a !== "--yes");
+    if (flags.includes("--sandboxes"))
+        throw new CliError("--sandboxes is now --environments (protocol 11): nylo reset --environments deletes the Tenant's Environments, their vaults and files.", 2);
+    if (flags.some((f) => !(f in SCOPES)) || args.filter((a) => a === "--yes").length > 1)
+        throw new CliError(RESET_USAGE, 2);
+    if (flags.length > 1)
+        throw new CliError("Pass only one of --sessions, --environments, --all.", 2);
+    const scope = flags.length ? SCOPES[flags[0]] : "sessions";
+    const connection = await linkedConnection(projectRoot());
+    const tenant = connection.link?.tenant;
+    const target = tenant ? `Tenant ${tenant} (${connection.url})` : `the Tenant on ${connection.url}`;
+    const admin = managementClient(connection);
+    if (scope === "all" && !yes)
+        await confirmOrThrow(`Reset ALL data of ${target}? The Project link and credentials are kept. [y/N] `);
+    try {
+        await admin.tenant.reset({ scope, activeWork: "drain" });
+    }
+    catch (error) {
+        throw new CliError(error instanceof Error ? error.message : `Tenant reset failed: ${String(error)}`, 1);
+    }
+    console.log(`Reset ${target} (${scope}).`);
+}
+async function confirmOrThrow(prompt) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new CliError("Confirmation required; pass --yes for non-interactive use.", 2);
+    }
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = (await rl.question(prompt)).trim().toLowerCase();
+        if (answer !== "y" && answer !== "yes") {
+            throw new CliError("Cancelled.", 1);
+        }
+    }
+    finally {
+        rl.close();
+    }
+}

package/dist/client/model/configure.d.ts

@@ -0,0 +1,58 @@
+import type { Readable, Writable } from "node:stream";
+import type { Credential } from "@earendil-works/pi-ai";
+import type { ManagementClient } from "@nylorun/admin";
+import { CliError } from "../../errors.js";
+/** Exit 130 on SIGINT, 143 on SIGTERM. */
+export declare class ConfigurationCancelled extends CliError {
+    readonly signal: "SIGINT" | "SIGTERM";
+    constructor(signal: "SIGINT" | "SIGTERM");
+}
+export type PromptedModel = {
+    provider: string;
+    model: string;
+    baseUrl?: string;
+    /** A custom endpoint's context window and output limit, when given. */
+    settings?: {
+        contextWindow?: number;
+        maxTokens?: number;
+    };
+    auth: Credential;
+};
+export type ModelCatalog = {
+    providers: {
+        id: string;
+        name: string;
+        models: {
+            id: string;
+            name: string;
+        }[];
+        auth?: {
+            apiKey?: unknown;
+            oauth?: unknown;
+        };
+    }[];
+};
+export type Selection = Readonly<{
+    provider: string;
+    model: string;
+    custom?: Readonly<{
+        baseUrl: string;
+    }>;
+}>;
+/** The Tenant's model catalog (`GET /v1/tenant/models`, Management API). */
+export declare function fetchModelCatalog(admin: ManagementClient): Promise<ModelCatalog>;
+export declare function configureProvider(options?: {
+    signal?: AbortSignal;
+    root?: string;
+    input?: Readable;
+    output?: Writable;
+    /** Tenant API catalog from GET /v1/tenant/models. */
+    catalog?: ModelCatalog;
+    /** This installation's stable id, for OAuth flows that need one (OpenAI). */
+    deviceId?: () => string;
+}): Promise<PromptedModel>;
+/**
+ * A stable id for this CLI installation, created on first use under the Host root.
+ * OpenAI's "Sign in with ChatGPT" sends it as the agent host id.
+ */
+export declare function installationId(home?: string): string;

package/dist/client/model/configure.js

@@ -0,0 +1,294 @@
+import { createInterface } from "node:readline/promises";
+import { randomUUID } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { nylorunHome } from "@nylorun/core/project";
+import { CliError } from "../../errors.js";
+import { loadPiAi } from "./pi-ai.js";
+/** Exit 130 on SIGINT, 143 on SIGTERM. */
+export class ConfigurationCancelled extends CliError {
+    signal;
+    constructor(signal) {
+        super(`Provider configuration cancelled (${signal}).`, signal === "SIGINT" ? 130 : 143);
+        this.signal = signal;
+        this.name = "ConfigurationCancelled";
+    }
+}
+/**
+ * Build a pi-ai registry for interactive login. Catalog listing prefers the
+ * Tenant API payload when provided (F2-4).
+ */
+function modelsFor({ builtinModels, createProvider, stream, streamSimple }, selection, credentials, catalog) {
+    const models = builtinModels({ credentials });
+    if (selection.custom) {
+        const model = {
+            id: selection.model,
+            name: selection.model,
+            api: "openai-completions",
+            provider: "custom",
+            baseUrl: selection.custom.baseUrl,
+            reasoning: false,
+            input: ["text", "image"],
+            cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+            contextWindow: 128000,
+            maxTokens: 16384,
+        };
+        models.setProvider(createProvider({
+            id: "custom",
+            name: "Custom OpenAI-compatible",
+            baseUrl: selection.custom.baseUrl,
+            auth: {
+                apiKey: {
+                    name: "Custom API key",
+                    async login(interaction) {
+                        const key = await interaction.prompt({
+                            type: "secret",
+                            message: "API key",
+                        });
+                        return { type: "api_key", key: key.trim() };
+                    },
+                    async resolve() {
+                        const credential = await credentials.read("custom");
+                        if (!credential || credential.type !== "api_key")
+                            return undefined;
+                        const key = credential.key;
+                        if (!key)
+                            return undefined;
+                        return { type: "api_key", auth: { apiKey: key } };
+                    },
+                },
+            },
+            models: [model],
+            api: { stream, streamSimple },
+        }));
+    }
+    return {
+        models,
+        listProviders() {
+            if (catalog?.providers.length) {
+                return catalog.providers.map((provider) => {
+                    const live = models.getProvider(provider.id);
+                    return {
+                        id: provider.id,
+                        name: provider.name,
+                        auth: {
+                            ...(live?.auth?.apiKey || provider.auth?.apiKey
+                                ? { apiKey: live?.auth?.apiKey ?? {} }
+                                : {}),
+                            ...(live?.auth?.oauth || provider.auth?.oauth
+                                ? { oauth: live?.auth?.oauth ?? {} }
+                                : {}),
+                            ...(!live?.auth?.apiKey &&
+                                !live?.auth?.oauth &&
+                                !provider.auth?.apiKey &&
+                                !provider.auth?.oauth
+                                ? { apiKey: {} }
+                                : {}),
+                        },
+                    };
+                });
+            }
+            return models.getProviders().map((provider) => ({
+                id: provider.id,
+                name: provider.name,
+                auth: {
+                    ...(provider.auth?.apiKey ? { apiKey: provider.auth.apiKey } : {}),
+                    ...(provider.auth?.oauth ? { oauth: provider.auth.oauth } : {}),
+                },
+            }));
+        },
+        listModels(providerId) {
+            const fromCatalog = catalog?.providers.find((p) => p.id === providerId);
+            if (fromCatalog?.models.length)
+                return fromCatalog.models;
+            return models.getModels(providerId).map((model) => ({
+                id: model.id,
+                name: model.name,
+            }));
+        },
+    };
+}
+/** The Tenant's model catalog (`GET /v1/tenant/models`, Management API). */
+export async function fetchModelCatalog(admin) {
+    return await admin.models.catalog();
+}
+// Internal options also allow isolated prompt tests without changing process globals.
+export async function configureProvider(options = {}) {
+    const login = { getDeviceId: options.deviceId ?? installationId };
+    const output = options.output ?? process.stdout;
+    const controller = new AbortController();
+    const signal = controller.signal;
+    const forwardAbort = () => controller.abort(options.signal.reason);
+    options.signal?.throwIfAborted();
+    const ai = await loadPiAi();
+    options.signal?.throwIfAborted();
+    let captured;
+    const store = {
+        async read() {
+            return undefined;
+        },
+        async list() {
+            return [];
+        },
+        async delete() { },
+        async modify(_id, fn) {
+            const next = await fn(captured);
+            if (next?.type === "api_key" && !next.key)
+                throw new Error("An API key is required.");
+            if (next)
+                captured = next;
+            return next ?? captured;
+        },
+    };
+    const registry = modelsFor(ai, { provider: "", model: "" }, store, options.catalog);
+    const providers = registry.listProviders();
+    const prompt = createInterface({
+        input: options.input ?? process.stdin,
+        output,
+    });
+    const onInt = () => controller.abort(new ConfigurationCancelled("SIGINT"));
+    const onClose = () => controller.abort(new Error("Configuration input closed before setup completed."));
+    const closeOnAbort = () => prompt.close();
+    prompt.on("SIGINT", onInt);
+    prompt.on("close", onClose);
+    signal.addEventListener("abort", closeOnAbort, { once: true });
+    options.signal?.addEventListener("abort", forwardAbort, { once: true });
+    if (options.signal?.aborted)
+        forwardAbort();
+    async function question(message) {
+        signal.throwIfAborted();
+        return prompt.question(message, { signal });
+    }
+    /** A positive whole number of tokens, or undefined for the default. */
+    async function tokens(message) {
+        const answer = (await question(message)).trim();
+        if (!answer)
+            return undefined;
+        const value = Number(answer);
+        if (!Number.isInteger(value) || value < 1)
+            throw new Error(`${message.split(" (")[0]} must be a whole number of tokens.`);
+        return value;
+    }
+    try {
+        signal.throwIfAborted();
+        output.write("0. Custom OpenAI-compatible provider\n");
+        providers.forEach((provider, index) => output.write(`${index + 1}. ${provider.name} (${provider.id})\n`));
+        const choice = Number(await question("Choose a provider: "));
+        if (choice === 0) {
+            const baseUrl = (await question("OpenAI-compatible base URL: "))
+                .trim()
+                .replace(/\/$/, "");
+            const model = (await question("Model id: ")).trim();
+            if (!baseUrl || !model)
+                throw new Error("A base URL and model id are required.");
+            const contextWindow = await tokens("Context window in tokens (Enter for 32768): ");
+            const maxTokens = await tokens("Max output tokens (Enter for 8192): ");
+            const settings = {
+                ...(contextWindow ? { contextWindow } : {}),
+                ...(maxTokens ? { maxTokens } : {}),
+            };
+            const selection = {
+                provider: "custom",
+                model,
+                custom: { baseUrl },
+            };
+            const custom = modelsFor(ai, selection, store, options.catalog);
+            if (!(await custom.models.checkAuth("custom", { signal })))
+                await custom.models.login("custom", "api_key", interaction(), login);
+            return {
+                ...prompted(selection),
+                ...(Object.keys(settings).length ? { settings } : {}),
+            };
+        }
+        else {
+            const chosen = providers[choice - 1];
+            if (!chosen)
+                throw new Error("Choose a listed provider.");
+            const available = registry.listModels(chosen.id);
+            available.forEach((model, index) => output.write(`${index + 1}. ${model.name} (${model.id})\n`));
+            const model = available[Number(await question("Choose a model: ")) - 1];
+            if (!model)
+                throw new Error("Choose a listed model.");
+            if (!(await registry.models.checkAuth(chosen.id, { signal }))) {
+                let method = chosen.auth.apiKey
+                    ? "api_key"
+                    : "oauth";
+                if (chosen.auth.apiKey && chosen.auth.oauth) {
+                    const answer = (await question("Choose authentication: 1. API key (default), 2. OAuth: ")).trim();
+                    if (answer && !["1", "2"].includes(answer))
+                        throw new Error("Choose authentication 1 or 2.");
+                    if (answer === "2")
+                        method = "oauth";
+                }
+                await registry.models.login(chosen.id, method, interaction(), login);
+            }
+            return prompted({ provider: chosen.id, model: model.id });
+        }
+    }
+    catch (error) {
+        throw signal.aborted ? signal.reason : error;
+    }
+    finally {
+        options.signal?.removeEventListener("abort", forwardAbort);
+        signal.removeEventListener("abort", closeOnAbort);
+        prompt.removeListener("SIGINT", onInt);
+        prompt.removeListener("close", onClose);
+        prompt.close();
+    }
+    function interaction() {
+        return {
+            signal,
+            prompt: async (item) => {
+                if (item.type !== "select")
+                    return question(item.message + ": ");
+                item.options.forEach((option, index) => output.write(`${index + 1}. ${option.label}\n`));
+                const answer = (await question(item.message + " ")).trim();
+                const option = item.options.find((option) => option.id === answer) ??
+                    item.options[Number(answer) - 1];
+                if (!option)
+                    throw new Error("Choose a listed authentication option.");
+                return option.id;
+            },
+            notify: (event) => {
+                output.write(("url" in event
+                    ? event.url
+                    : "verificationUri" in event
+                        ? event.verificationUri
+                        : event.message) + "\n");
+            },
+        };
+    }
+    function prompted(selection) {
+        signal.throwIfAborted();
+        if (!captured)
+            throw new Error("An API key or OAuth credential is required.");
+        output.write("Provider configuration saved.\n");
+        return {
+            provider: selection.provider,
+            model: selection.model,
+            ...(selection.custom?.baseUrl
+                ? { baseUrl: selection.custom.baseUrl }
+                : {}),
+            auth: captured,
+        };
+    }
+}
+/**
+ * A stable id for this CLI installation, created on first use under the Host root.
+ * OpenAI's "Sign in with ChatGPT" sends it as the agent host id.
+ */
+export function installationId(home = nylorunHome()) {
+    const file = join(home, "cli-installation-id");
+    try {
+        const existing = readFileSync(file, "utf8").trim();
+        if (existing)
+            return existing;
+    }
+    catch {
+        /* Created below on first use. */
+    }
+    const id = randomUUID();
+    mkdirSync(home, { recursive: true });
+    writeFileSync(file, `${id}\n`, { mode: 0o600 });
+    return id;
+}

package/dist/client/model/host-model.d.ts

@@ -0,0 +1,4 @@
+import type { ManagementClient } from "@nylorun/admin";
+import type { PromptedModel } from "./configure.js";
+/** Set the installation's Tenant model provider (`PUT /v1/tenant/model`, Management API). */
+export declare function putHostModel(admin: ManagementClient, model: PromptedModel): ReturnType<ManagementClient["models"]["put"]>;

package/dist/client/model/host-model.js

@@ -0,0 +1,13 @@
+import { randomUUID } from "node:crypto";
+/** Set the installation's Tenant model provider (`PUT /v1/tenant/model`, Management API). */
+export async function putHostModel(admin, model) {
+    return await admin.models.put({
+        idempotencyKey: randomUUID(),
+        provider: model.provider,
+        model: model.model,
+        ...(model.baseUrl ? { baseUrl: model.baseUrl } : {}),
+        ...(model.settings ? { settings: model.settings } : {}),
+        // A prompted credential is complete: pi-ai's type leaves its fields optional.
+        auth: model.auth,
+    });
+}

package/dist/client/model/pi-ai.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The pi-ai `nylo configure` loads; nylorun's devDependency has the same version
+ * (scripts/check-package.mjs).
+ */
+export declare const PI_AI_VERSION = "0.99.1";
+/** What `nylo configure` uses of pi-ai: its provider registry and login flows. */
+export interface PiAi {
+    createProvider: typeof import("@earendil-works/pi-ai").createProvider;
+    builtinModels: typeof import("@earendil-works/pi-ai/providers/all").builtinModels;
+    stream: typeof import("@earendil-works/pi-ai/api/openai-completions").stream;
+    streamSimple: typeof import("@earendil-works/pi-ai/api/openai-completions").streamSimple;
+}
+/**
+ * pi-ai, with its provider SDKs about 100 MB, is not a dependency of nylorun, so
+ * `npx nylorun` stays small: only `nylo configure` needs it. It loads pi-ai from beside nylorun
+ * when it resolves there (the workspace, or a project that installs it), else from
+ * `<Nylorun home>/lib/pi-ai-<version>/`, which it installs with npm on first use.
+ */
+export declare function loadPiAi(options?: {
+    home?: string;
+    /** Import pi-ai from beside nylorun (tests). */
+    packages?: () => Promise<PiAi>;
+    /** Install `PI_AI_VERSION` into a directory holding its package.json (tests). */
+    install?: (directory: string) => Promise<void>;
+    log?: (line: string) => void;
+}): Promise<PiAi>;

package/dist/client/model/pi-ai.js

@@ -0,0 +1,104 @@
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { nylorunHome } from "@nylorun/core/project";
+import { CliError } from "../../errors.js";
+/**
+ * The pi-ai `nylo configure` loads; nylorun's devDependency has the same version
+ * (scripts/check-package.mjs).
+ */
+export const PI_AI_VERSION = "0.99.1";
+const PI_AI = "@earendil-works/pi-ai";
+/** The module written beside an on-demand install, which resolves pi-ai from there. */
+const ENTRY = "pi-ai.js";
+const ENTRY_SOURCE = `export { createProvider } from "${PI_AI}";
+export { builtinModels } from "${PI_AI}/providers/all";
+export { stream, streamSimple } from "${PI_AI}/api/openai-completions";
+`;
+async function fromPackages() {
+    const [ai, all, completions] = await Promise.all([
+        import("@earendil-works/pi-ai"),
+        import("@earendil-works/pi-ai/providers/all"),
+        import("@earendil-works/pi-ai/api/openai-completions"),
+    ]);
+    return {
+        createProvider: ai.createProvider,
+        builtinModels: all.builtinModels,
+        stream: completions.stream,
+        streamSimple: completions.streamSimple,
+    };
+}
+const notInstalled = (error) => error?.code === "ERR_MODULE_NOT_FOUND" &&
+    String(error.message).includes(`'${PI_AI}'`);
+/**
+ * pi-ai, with its provider SDKs about 100 MB, is not a dependency of nylorun, so
+ * `npx nylorun` stays small: only `nylo configure` needs it. It loads pi-ai from beside nylorun
+ * when it resolves there (the workspace, or a project that installs it), else from
+ * `<Nylorun home>/lib/pi-ai-<version>/`, which it installs with npm on first use.
+ */
+export async function loadPiAi(options = {}) {
+    try {
+        return await (options.packages ?? fromPackages)();
+    }
+    catch (error) {
+        if (!notInstalled(error))
+            throw error;
+    }
+    const directory = join(nylorunHome(options.home), "lib", `pi-ai-${PI_AI_VERSION}`);
+    if (!existsSync(join(directory, ENTRY))) {
+        (options.log ?? ((line) => console.error(line)))(`nylo configure uses ${PI_AI}@${PI_AI_VERSION} for the model providers' sign-in, which nylorun does not install. Installing it once into ${directory}…`);
+        await installInto(directory, options.install ?? npmInstall);
+    }
+    return (await import(pathToFileURL(join(directory, ENTRY)).href));
+}
+/** Install beside `directory`, then move it in place; a concurrent install that won is kept. */
+async function installInto(directory, install) {
+    const temporary = `${directory}.${randomBytes(4).toString("hex")}.tmp`;
+    try {
+        await mkdir(temporary, { recursive: true });
+        await writeFile(join(temporary, "package.json"), `${JSON.stringify({ private: true, type: "module", dependencies: { [PI_AI]: PI_AI_VERSION } }, null, 2)}\n`);
+        await install(temporary);
+        await writeFile(join(temporary, ENTRY), ENTRY_SOURCE);
+        await rename(temporary, directory).catch((error) => {
+            if (!existsSync(join(directory, ENTRY)))
+                throw error;
+        });
+    }
+    catch (error) {
+        throw new CliError(`Could not install ${PI_AI}@${PI_AI_VERSION} for nylo configure: ${error instanceof Error ? error.message : String(error)}. Install it beside nylorun (npm install ${PI_AI}@${PI_AI_VERSION}), or set the model provider in Studio.`, 1);
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+    }
+}
+/** The npm that runs this command (`npx` sets npm_execpath), else the one beside node, else PATH's. */
+function npm() {
+    const candidates = [
+        process.env.npm_execpath,
+        join(dirname(process.execPath), "node_modules/npm/bin/npm-cli.js"),
+        join(dirname(process.execPath), "../lib/node_modules/npm/bin/npm-cli.js"),
+    ];
+    const cli = candidates.find((path) => path?.endsWith("npm-cli.js") && existsSync(path));
+    return cli ? { command: process.execPath, args: [cli] } : { command: "npm", args: [] };
+}
+/** `npm install` without scripts; its output goes to stderr, so stdout stays the prompts'. */
+function npmInstall(directory) {
+    const { command, args } = npm();
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, [
+            ...args,
+            "install",
+            "--omit=dev",
+            "--ignore-scripts",
+            "--no-audit",
+            "--no-fund",
+            "--no-update-notifier",
+            "--loglevel=error",
+        ], { cwd: directory, stdio: ["ignore", 2, 2] });
+        child.once("error", reject);
+        child.once("close", (code) => code === 0 ? resolve() : reject(new Error(`npm install exited with ${code}`)));
+    });
+}