nylorun 0.13.0-beta → 0.14.0-beta

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # nylorun
 
+## 0.14.0-beta
+
+### Minor Changes
+
+- 35e29b7: **Environments replace sandboxes and vaults (protocol 11). This is a fresh start: upgrading deletes your sandboxes, their disks and every vault except the model's, and closes every open session (its history stays readable).** List what you have before upgrading; see "Environments replace sandboxes and vaults" in MIGRATION.md.
+
+  An Environment is where sessions run: one sandbox (kind `virtual`, `pod` or `none`) with a recipe that can change, and one vault of secrets for its shell, MCP servers and HTTP tools. The app decides who uses which Environment; the Runtime keeps it by id and holds its lifecycle.
+
+  - `@nylorun/core`: protocol 11 (the Host accepts 11 only; older clients get `426`), required feature `environments`. `PutEnvironmentRequestSchema`, `EnvironmentViewSchema` (`recipe`, `version`, `appliedVersion`, `ownerUserId`, `lastUsedAt`), `PutEnvironmentSecretRequestSchema`, `EnvironmentSecretViewSchema`, `ENVIRONMENT_EVENT_TYPES`, `TenantEnvironmentsConfigSchema`, `environmentGranted`. `PutSessionRequest.environment` replaces `sandbox`, `vaultIds` and `credentialSelections`; `SessionView.environment` replaces the session's sandbox and vault fields. Error codes `environment_busy`, `environment_unavailable`, `environment_lost`, `environment_not_granted`, `environment_owner_mismatch` and `session_closed` (the `sandbox_*` codes and `sandbox_expired` are gone); session events `environment.state`, `environment.exec` and `environment.attached`; scope `environments:write`. Credential coverage takes `environmentId` and answers `covered` or `missing`; the MCP preview takes `environmentId`. The vault Management schemas are removed.
+  - `@nylorun/runtime`: `/v1/environments/{id}` replaces `/v1/sandboxes/{id}`: `PUT` creates, finds or changes one (`kind` and `storage` fixed; a recipe change bumps `version`; a pod gets a new image or resources at its next start from stopped, a new allowlist within seconds), with list by label, events (`nylorun.environment-event/1`), stop, reset and delete. Each Environment owns one vault: `PUT|GET|DELETE /v1/environments/{id}/secrets/{name}` on the Runtime API, write-only, with a second credential for a host or URL refused at the write (`409 credential_conflict`). An optional owner guard (`ownerUserId`) is checked when a session opens and at every turn start. `lifecycle.deleteAfter` deletes an Environment unused that long; TTL and `onExpiry` are gone. Kind `none` holds secrets for MCP-only agents. `/v1/tenant/vaults`, user and installation vaults, the Tenant's default sandbox, inline sandboxes and `{ session }` sharing are removed. The Tenant setting is `environments.config` (`limits.environments`). Identity files grant `environments:` (an old `sandboxes:` key, or `sandboxes:write`, stops the Runtime with a message naming the new key). Migration `0020_environments`.
+  - `@nylorun/harness`: the Harness API claims `environment.state` and `environment.exec`, and its workspace fields name `environmentId`.
+  - `@nylorun/agents`: `client.environments` (`put`, `get`, `list`, `page`, `stop`, `reset`, `delete`, `events`, `secrets.put|list|get|delete`, `forSession`) replaces `client.sandboxes`; `createSession({ environment })`; `sessions.page({ environmentId })` filters by Environment. The AG-UI handler's session options take `environment`.
+  - `@nylorun/admin`: `admin.coverage({ agentId, environmentId })` replaces `admin.vaults`; `admin.mcp.preview({ url, environmentId })`.
+  - `@nylorun/studio`: Environments replace Sandboxes, with a create form, stop, reset, delete and their secrets; the Credentials forms write an Environment's secrets; New session picks an Environment and shows its coverage.
+  - `nylorun`: `nylorun sandbox ls|rm` list and delete Environments; `nylorun mcp inspect --environment <id>` replaces `--vault`; `nylo reset --environments` replaces `--sandboxes`; `nylo doctor sandbox` reports the Environment limits.
+
+- 7800358: **Each turn is one OpenTelemetry trace, projected from the session log (R7).** An operator could not see what a turn did or where its time went without grepping container logs. Now every turn is a trace with a span for each model call, tool call and egress tunnel, exported over OTLP to any collector, readable per turn from the Runtime, and joined to the trace of the app that started it. No protocol change.
+
+  - **Traces from the log.** A turn's end is its root span, `invoke_agent <agent>`; each model call is a `chat <model>` span, each tool call and flow HTTP stage an `execute_tool <tool>` span, each egress-gate tunnel a `CONNECT <host>` span, and each pause and answer a marker. A model or gate tool span is the gate's own start and end; usage and cost are the gate's (`nylorun.usage.mismatch` when the harness reported other numbers). Attribute names follow the OTel GenAI conventions at one pinned commit, recorded as `nylorun.semconv.genai` on the resource. Ids are derived from the log under a key the Tenant keeps (setting `trace.key`), so every export and read of a turn gives the same ids.
+  - **OTLP export, off until you set an endpoint.** With `OTEL_EXPORTER_OTLP_ENDPOINT` (or `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`) the Runtime posts OTLP/HTTP JSON from a replication slot of its own, `nylorun_trace_export`, in batches of up to 512 spans or every 2 s; `OTEL_EXPORTER_OTLP_HEADERS`, `OTEL_SERVICE_NAME` and `OTEL_RESOURCE_ATTRIBUTES` work as usual. No turn waits for it. A collector that is down costs only its spans: after three retries a batch is dropped and logged as `trace_export_dropped`, and the slot moves on, so Postgres keeps no WAL for it. `nylorun start` passes these variables to the runtime container.
+  - **References by default.** Spans point at log events (`nylorun.event.cursor`) and carry no content unless you opt in per kind with `NYLORUN_TRACE_CONTENT` (`user`, `outputs`, `tool-results`, `errors`), or all of them with `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`, each cut at 8 KiB. A span never carries a credential value, a prompt, a person's id, an identity header or an idempotency key.
+  - **`GET /v1/sessions/{id}/turns/{turnId}/trace`** answers a turn's spans as OTLP JSON, the same spans the exporter posts: look at a turn without a collector, or post it to one to backfill. Application keys, as the `/calls` reads. Host feature `traces`; `@nylorun/agents` adds `session.trace(turnId)`, and `@nylorun/core/contracts` `TurnTraceSchema`.
+  - **Trace context in and out.** A `traceparent` (and `tracestate`) on `POST /v1/sessions/{id}/commands`, an AG-UI run or an A2A message puts the turn in the caller's trace; `command.message` records it as `trace`. The turn hands its context on: to the harness in `TurnStart.trace`, to HTTP tools as `traceparent` beside `Idempotency-Key`, to MCP servers as `traceparent` on the call's requests, and to sandbox commands as `TRACEPARENT`.
+  - **Harness API** (additive): the `effect.intent` answer `execute` may carry the tool call's `traceparent`. `@nylorun/harness`: `HarnessExecutors.tool` takes it as a fourth argument (`ToolCallContext`).
+
+### Patch Changes
+
+- a0cbca1: **Clearer wording when a definition runs your code.** The refusal for a code tool or a flow's tool stage, the `hooks were removed` error and `nylo endpoints` now say that the Runtime runs agents from their manifests alone, instead of that it runs no code of yours during a session. Only the message text changed; anything matching the old wording (for example `runs no code of yours during a session`) needs the new text.
+- Pin core to the tested release.
+- Pin admin to the tested release.
+- Pin runtime to the tested release.
+- Pin studio to the tested release.
+- Updated dependencies [17a97e9]
+- Updated dependencies [b6214d9]
+- Updated dependencies [e917bd6]
+- Updated dependencies [5165451]
+- Updated dependencies [35e29b7]
+- Updated dependencies [e917bd6]
+- Updated dependencies [a0cbca1]
+- Updated dependencies [3013501]
+- Updated dependencies [6061a3a]
+- Updated dependencies [7d496e4]
+- Updated dependencies [81c783e]
+- Updated dependencies [7800358]
+- Updated dependencies
+  - @nylorun/core@0.20.0-beta
+  - @nylorun/admin@0.16.0-beta
+
 ## 0.13.0-beta
 
 ### Minor Changes

package/README.md

@@ -21,7 +21,7 @@ provider over its APIs belong to the Runtime client, `nylo`
 Depends on `@nylorun/core` and `@nylorun/admin` (for `nylo`) among Nylorun
 packages and never imports `@nylorun/runtime`; the `nylorun` command loads
 neither `nylo` nor `@nylorun/admin`. Vocabulary:
-[runtime/src/CONTEXT.md](../runtime/src/CONTEXT.md).
+[runtime/server/src/CONTEXT.md](../../runtime/server/src/CONTEXT.md).
 
 Prerequisites, installed by the developer (nylorun never downloads them): Node
 24 or newer, and Docker with Compose v2 ([Docker
@@ -48,12 +48,12 @@ nylorun studio [--tenant <name>] [--no-open]   # sign a browser in to Studio on
 nylorun reset [--tenant <name>] [--yes]        # delete the Tenant's volumes, Tenant directory and vault key; the next start creates it anew
 nylorun ls [--json]                # the Tenants on this machine, with their state, memory and URLs
 nylorun delete <tenant> --yes      # remove a Tenant: containers, volumes, Host root and vault key
-nylorun sandbox ls [--tenant <name>] [--label <key=value>]... [--json]   # the running Tenant's sandboxes
-nylorun sandbox rm <id> [--tenant <name>]   # delete a sandbox and its files
+nylorun sandbox ls [--tenant <name>] [--label <key=value>]... [--json]   # the running Tenant's Environments
+nylorun sandbox rm <id> [--tenant <name>]   # delete an Environment: its sandbox, files and vault
 nylorun key put <id> [--management] [--tenant <name>]   # create or rotate the Tenant's application key <id> (--management: a management key); prints it once
 nylorun key list [--tenant <name>] [--json] # the Tenant's keys: id, role, when issued
 nylorun key rm <id> [--tenant <name>]       # delete a key: it stops working at once
-nylorun mcp inspect <url> [--server <name>] [--vault <id>] [--sse] [--tenant <name>] [--json]   # a remote MCP server's tools, with the installation vault's credential
+nylorun mcp inspect <url> [--server <name>] [--environment <id>] [--sse] [--tenant <name>] [--json]   # a remote MCP server's tools, with an Environment's credential
 nylorun doctor [--json]            # prerequisites and the Tenant's health
 nylorun telemetry [status|enable|disable]   # Studio's anonymous usage analytics
 nylorun sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]
@@ -64,8 +64,10 @@ nylorun sandbox status [--tenant <name>] [--json]   # pods on a Kubernetes conte
 `up` and `down` are the Docker Compose spellings of `start` and `stop`: `down`
 stops the containers and keeps the volumes, so no Tenant data is lost. Removed
 commands exit 2 naming the replacement: `nylorun dev` and the MCP OAuth `connect`
-subcommand of `nylorun mcp` (protocol 10: add a key or a gateway credential to a
-vault instead, and preview the server with `nylorun mcp inspect`).
+subcommand of `nylorun mcp` (protocol 10: write a key or a gateway credential as
+an Environment's secret instead, and preview the server with
+`nylorun mcp inspect --environment <id>`), and `--vault` of `nylorun mcp inspect`
+(protocol 11: `--environment <id>`).
 `nylorun configure`, `nylorun status --env` and `nylorun doctor sandbox` exit 2
 naming `nylo configure`, `nylo env` and `nylo doctor sandbox`.
 `nylorun status` and `nylorun reset` are not `nylo status` and `nylo reset`: see
@@ -184,7 +186,7 @@ replaced by the application key otherwise.
 
 Every Tenant serves the Runtime API, which takes **application keys**, and the
 Management API (`/v1/tenant/*`), which takes **management keys**
-([SELF_HOSTING.md](../SELF_HOSTING.md#keys)). `nylorun key` manages both on the
+([SELF_HOSTING.md](../../guides/SELF_HOSTING.md#keys)). `nylorun key` manages both on the
 running Tenant through `nylorun-operate` in its runtime container, so only this
 machine can issue a management key.
 
@@ -201,26 +203,28 @@ application key. `nylorun sandbox` and `nylorun mcp` use the linked project's ke
 
 ## MCP servers
 
-An agent names its MCP servers by URL; the operator gives each URL a vault
-credential, a `bearer` token or a `headers` map, with `via` and an identity
-header when an MCP gateway holds each person's sign-in. Add it on Studio's
-Credentials page or with `@nylorun/admin` (no `nylorun` command adds one); the
-whole flow, with gateway recipes, is in
-[DEPLOYMENT.md](../DEPLOYMENT.md#mcp-servers-and-http-tools).
+An agent names its MCP servers by URL; a session gets a credential for a URL from
+the Environment it is opened on (`createSession({ environment })`): a secret of that
+Environment, a `bearer` token or a `headers` map, with `via` and an identity
+header when an MCP gateway holds each person's sign-in. Write it with
+`client.environments.secrets.put(id, name, secret)` of `@nylorun/agents` (the
+Runtime API, an application key) or in Studio; no `nylorun` command writes one.
+The whole flow, with gateway recipes, is in
+[DEPLOYMENT.md](../../guides/DEPLOYMENT.md#mcp-servers-and-http-tools).
 
 `nylorun mcp inspect <url>` shows what a remote MCP server offers before an
 agent names it, through the running Tenant's Management API
 (`POST /v1/tenant/mcp/preview`, with the management key). The Runtime connects
-with the installation vault's credential for `<url>` (`--vault <id>` picks the
-vault when several hold one), lists the tools within 15 s and calls none. It
+with Environment `<id>`'s credential for `<url>` when `--environment <id>` names one
+(without it, no credential is sent), lists the tools within 15 s and calls none. It
 prints a table of each tool's model name, input schema size, hints
 (`read-only`, `destructive`, `idempotent`) and description, then the tools
 renamed for the model. `--server` is the server name your manifest uses (default:
 the host's name, `linear` for `mcp.linear.app`); `--sse` speaks the older SSE
 transport; `--json` prints the Runtime's answer. A server that answers `401`
 needs a credential: it says so, and names the server's sign-in from its
-protected-resource metadata, since such a server needs a key in a vault or an
-MCP gateway that holds each person's sign-in. A server it cannot list exits 1 with
+protected-resource metadata, since such a server needs a key in an Environment's
+secrets or an MCP gateway that holds each person's sign-in. A server it cannot list exits 1 with
 the reason (`mcp.unreachable` for an address the Runtime refuses).
 
 ## The containers
@@ -313,17 +317,20 @@ on every start and writes the result to `NYLORUN_STUDIO_ANALYTICS_ID` in
 
 ## Sandboxes
 
-A session gets a sandbox when it is opened with one, or when the Tenant's
-default names one (`PUT /v1/tenant/sandbox`). A local Tenant runs them on the
-Runtime's **virtual** backend: an emulated shell in the Runtime process, with no
-extra containers. It is not a VM or container boundary.
-
-A sandbox can also be a resource with its own id (`PUT /v1/sandboxes/{id}`,
-`client.sandboxes` in `@nylorun/agents`) that sessions attach to and that
-outlives them. `nylorun sandbox ls` lists the running Tenant's sandboxes with
-their state, attached sessions and labels; `nylorun sandbox rm <id>` deletes one
-and its files (refused while a turn runs in it). Neither starts a stopped Tenant
-(exit 3).
+A session gets a sandbox from the Environment it is opened on
+(`createSession({ environment: id })`; protocol 11): an Environment has its own id
+(`PUT /v1/environments/{id}`, `client.environments` in `@nylorun/agents`), one
+sandbox and one vault of secrets, and outlives the sessions that name it. A session
+opened on none has no sandbox. Kind `virtual` (the default) runs on the Runtime's
+**virtual** backend: an emulated shell in the Runtime process, with no extra
+containers. It is not a VM or container boundary. Kind `pod` runs in a pod on a
+cluster (below).
+
+`nylorun sandbox ls` lists the running Tenant's Environments with their kind,
+state, sessions and labels; `nylorun sandbox rm <id>` deletes one, with its files
+and vault (refused while a turn runs in it). Neither starts a stopped Tenant
+(exit 3). The Tenant's limits for Environments (`limits.environments`, `idle`,
+resources, network) are `PUT /v1/tenant/sandbox` on the Management API.
 
 ### Pods on a cluster (preview)
 
@@ -338,8 +345,8 @@ lets pods reach only three ports on the Docker host, and adds the `sandboxes`
 service to the Tenant: the one container holding the cluster credentials
 (`<Host root>/sandboxes/`). On kind under Linux, pass `--host-address 172.17.0.1`.
 `nylorun sandbox disable` removes the service (`--delete-namespace` also deletes
-the namespace and every sandbox in it). Sessions keep using the virtual backend
-in this release.
+the namespace and every sandbox in it). Sessions run in a pod when their
+Environment has kind `pod` (`client.environments.put(id, { kind: "pod" })`).
 
 ## Host root
 
@@ -370,11 +377,11 @@ npx nylo status                       # in a project with nylorun installed
 
 Outside such a project, `npx nylo` looks for an npm package named `nylo`, which
 is not this one: use `npx -p nylorun nylo`. The deprecated
-[`@nylorun/cli`](../cli/README.md) runs this `nylo` for one more release.
+[`@nylorun/cli`](../legacy/README.md) runs this `nylo` for one more release.
 
 ```sh
 nylo status [--json]                  # the Tenant, its checks and counts
-nylo reset [--sessions|--sandboxes|--all] [--yes]
+nylo reset [--sessions|--environments|--all] [--yes]
 nylo access signing-keys …            # the Tenant's signing keys: list, rotate, revoke
 nylo configure                        # set or replace the Tenant's model provider
 nylo env                              # export lines for the linked Project
@@ -404,7 +411,7 @@ Local Tenant commands (`up`, `down`, `start`, `stop`, `logs`, `studio`) exit 2
 naming `npx nylorun <command>`. `nylo tenant …` exits 2: `npx nylorun start`
 creates the project's Tenant and the link, and `nylo status|reset` replace
 `nylo tenant status|reset`. `nylo endpoints` was removed with Action endpoints
-(protocol 8: the Runtime runs no code of yours during a session) and exits 2.
+(protocol 8: the Runtime runs agents from their manifests alone) and exits 2.
 
 ### `status` and `reset`: `nylorun` or `nylo`
 
@@ -414,7 +421,7 @@ Both commands have a `status` and a `reset`, which act on different things:
 | --- | --- | --- |
 | Acts on | the local Tenant on this machine (`--tenant`, `NYLORUN_TENANT` or the link), through Docker and `nylorun-operate` in its runtime container | the linked installation, local or remote, through the Management API with a management key |
 | `status` | the containers, endpoints and Runtime health, and the Tenant's state: it answers when the Tenant is stopped or not open, and says why | the open Tenant's checks, counts and sandbox backend (`GET /v1/tenant`); when the Tenant does not answer it fails and points at `nylorun status` |
-| `reset` | deletes all the Tenant's data: volumes, `tenant/` and the vault key; the next `start` creates it anew, with a new id, and relinks the project | clears the sessions (the default), the sandboxes or all the data (`--all`) after draining work in flight; the Tenant, its keys and the Project link are kept |
+| `reset` | deletes all the Tenant's data: volumes, `tenant/` and the vault key; the next `start` creates it anew, with a new id, and relinks the project | clears the sessions (the default), the Environments (`--environments`) or all the data (`--all`) after draining work in flight; the Tenant, its keys and the Project link are kept |
 
 `nylo reset --all` asks first; pass `--yes` when not in a terminal.
 `nylorun reset` asks too, or takes `--yes`.
@@ -475,4 +482,4 @@ These are `nylorun`'s; [`nylo`'s](#nylo-exit-codes) are above.
 | `nylo`: `403 key_role_mismatch` | The key belongs to the other API: a management key for the Management API, an application key for the Runtime API |
 | `nylo`: old Project link refused | `npx nylorun start` in the project |
 
-See [MIGRATION.md](../MIGRATION.md).
+See [MIGRATION.md](../../guides/MIGRATION.md).

package/dist/client/cli.js

@@ -11,8 +11,8 @@ Runtime client for the linked installation and its one Tenant (the Project link
 npx nylorun start writes, or NYLORUN_RUNTIME_URL with NYLORUN_SERVER_KEY, and
 NYLORUN_MANAGEMENT_KEY for status, reset, access, configure and doctor):
   status [--json]                         the Tenant, its checks and counts
-  reset [--sessions|--sandboxes|--all] [--yes]
-                                          clear the Tenant's sessions, sandboxes or all its data
+  reset [--sessions|--environments|--all] [--yes]
+                                          clear the Tenant's sessions, Environments or all its data
   access signing-keys list|rotate|revoke  the Tenant's token signing keys (nylo access --help)
   configure                               set the linked Tenant's model provider
   env                                     print the linked Project's NYLORUN_* variables as exports
@@ -29,7 +29,7 @@ const LOCAL_COMMANDS = new Set([
 const TENANT_REMOVED = `nylo tenant was removed: an installation serves one Tenant.
 Run "npx nylorun start" in your project to create its Tenant and the Project link.
 Then use nylo status and nylo reset on the linked installation.`;
-const ENDPOINTS_REMOVED = `nylo endpoints was removed: the Runtime runs no code of yours during a session,
+const ENDPOINTS_REMOVED = `nylo endpoints was removed: the Runtime runs agents from their manifests alone,
 so there are no Action endpoints. An agent's tools are http() tools and remote MCP servers
 (see MIGRATION.md).`;
 const usageError = (message) => new CliError(message, 2);

package/dist/client/doctor.d.ts

@@ -11,11 +11,12 @@ export type SandboxReport = {
         version?: string;
     }[];
     defaultImage?: string;
-    /** The Tenant's sandbox configuration (Runtimes with Sandboxes v3). */
+    /** The Tenant's Environment settings in force (`environments.config`, protocol 11). */
     config?: {
-        default: "none" | "virtual" | Record<string, unknown>;
         limits?: {
             network?: readonly string[];
+            idle?: string;
+            environments?: number;
         };
     };
 };

package/dist/client/doctor.js

@@ -42,14 +42,21 @@ export async function doctorSandbox(options) {
             ? "auto (npx nylorun start seeds the Tenant's sandbox.backend from .env NYLORUN_SANDBOX)"
             : report.preference,
     ]);
-    if (report.config)
+    rows.push([
+        "sessions",
+        "get a sandbox only on an Environment (createSession({ environment }) names one)",
+    ]);
+    const limits = report.config?.limits;
+    if (limits)
         rows.push([
-            "default",
-            report.config.default === "none"
-                ? "none: sessions get a sandbox only when opened with one (set a default with PUT /v1/tenant/sandbox)"
-                : report.config.default === "virtual"
-                    ? "virtual: sessions that name no sandbox get one"
-                    : "a Tenant sandbox: sessions that name no sandbox get it",
+            "limits",
+            [
+                limits.idle ? `idle ${limits.idle}` : undefined,
+                limits.environments === undefined ? undefined : `${limits.environments} environments`,
+                limits.network ? `${limits.network.length} allowed hosts` : undefined,
+            ]
+                .filter((item) => item !== undefined)
+                .join(", ") || "-",
         ]);
     rows.push([
         "selected",

package/dist/client/installation/commands.d.ts

@@ -3,5 +3,5 @@
  * answer: `npx nylorun status` reports why.
  */
 export declare function statusCommand(args: readonly string[]): Promise<void>;
-/** `nylo reset [--sessions|--sandboxes|--all] [--yes]`; `--all` asks first. */
+/** `nylo reset [--sessions|--environments|--all] [--yes]`; `--all` asks first. */
 export declare function resetCommand(args: readonly string[]): Promise<void>;

package/dist/client/installation/commands.js

@@ -38,16 +38,18 @@ export async function statusCommand(args) {
     console.log(`counts   sessions=${body.counts.sessions} running=${body.counts.runningSessions} uncertain=${body.counts.uncertainEffects}`);
     console.log(`sandbox  ${body.sandbox.backend ?? "none"}`);
 }
-const RESET_USAGE = "Usage: nylo reset [--sessions|--sandboxes|--all] [--yes]";
-const SCOPES = { "--sessions": "sessions", "--sandboxes": "sandboxes", "--all": "all" };
-/** `nylo reset [--sessions|--sandboxes|--all] [--yes]`; `--all` asks first. */
+const RESET_USAGE = "Usage: nylo reset [--sessions|--environments|--all] [--yes]";
+const SCOPES = { "--sessions": "sessions", "--environments": "environments", "--all": "all" };
+/** `nylo reset [--sessions|--environments|--all] [--yes]`; `--all` asks first. */
 export async function resetCommand(args) {
     const yes = args.includes("--yes");
     const flags = args.filter((a) => a !== "--yes");
+    if (flags.includes("--sandboxes"))
+        throw new CliError("--sandboxes is now --environments (protocol 11): nylo reset --environments deletes the Tenant's Environments, their vaults and files.", 2);
     if (flags.some((f) => !(f in SCOPES)) || args.filter((a) => a === "--yes").length > 1)
         throw new CliError(RESET_USAGE, 2);
     if (flags.length > 1)
-        throw new CliError("Pass only one of --sessions, --sandboxes, --all.", 2);
+        throw new CliError("Pass only one of --sessions, --environments, --all.", 2);
     const scope = flags.length ? SCOPES[flags[0]] : "sessions";
     const connection = await linkedConnection(projectRoot());
     const tenant = connection.link?.tenant;

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-/** Exit codes are part of both commands' contract; see nylorun/README.md ("Exit codes"). */
+/** Exit codes are part of both commands' contract; see cli/nylorun/README.md ("Exit codes"). */
 export declare class CliError extends Error {
     readonly exitCode: number;
     constructor(message: string, exitCode?: number);

package/dist/errors.js

@@ -1,4 +1,4 @@
-/** Exit codes are part of both commands' contract; see nylorun/README.md ("Exit codes"). */
+/** Exit codes are part of both commands' contract; see cli/nylorun/README.md ("Exit codes"). */
 export class CliError extends Error {
     exitCode;
     constructor(message, exitCode = 1) {

package/dist/stack/compose-file.js

@@ -238,7 +238,16 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
       NYLORUN_HARNESS: \${NYLORUN_HARNESS:-remote}
       NYLORUN_HARNESS_LISTEN_PORT: "4200"
       NYLORUN_HARNESS_ALLOWED_HOSTS: runtime:4200${sandboxes ? SANDBOXES_HARNESS_HOST : ""}
-      NYLORUN_HARNESS_TOKEN: \${NYLORUN_HARNESS_TOKEN:?run nylorun start}${sandboxes ? SANDBOXES_RUNTIME_ENV : ""}${identity ? IDENTITY_RUNTIME_ENV : ""}
+      NYLORUN_HARNESS_TOKEN: \${NYLORUN_HARNESS_TOKEN:?run nylorun start}
+      # Traces (R7.2): from the shell that runs \`nylorun start\`. Unset, they are
+      # empty and the Runtime exports nothing. A collector on this machine is host.docker.internal.
+      OTEL_EXPORTER_OTLP_ENDPOINT: \${OTEL_EXPORTER_OTLP_ENDPOINT:-}
+      OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: \${OTEL_EXPORTER_OTLP_TRACES_ENDPOINT:-}
+      OTEL_EXPORTER_OTLP_HEADERS: \${OTEL_EXPORTER_OTLP_HEADERS:-}
+      OTEL_SERVICE_NAME: \${OTEL_SERVICE_NAME:-}
+      OTEL_RESOURCE_ATTRIBUTES: \${OTEL_RESOURCE_ATTRIBUTES:-}
+      OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT: \${OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT:-}
+      NYLORUN_TRACE_CONTENT: \${NYLORUN_TRACE_CONTENT:-}${sandboxes ? SANDBOXES_RUNTIME_ENV : ""}${identity ? IDENTITY_RUNTIME_ENV : ""}
     extra_hosts:
       host.docker.internal: host-gateway # the Docker host, also on Linux Docker Engine
     volumes:

package/dist/stack/mcp.d.ts

@@ -1,9 +1,11 @@
 import type { McpPreview } from "@nylorun/core/contracts";
 import { type StackDeps } from "./commands.js";
-export declare const mcpUsage = "  mcp inspect <url> [--server <name>] [--vault <id>] [--sse] [--tenant <name>] [--json]\n                                      list a remote MCP server's tools with the installation vault's\n                                      credential for <url>: model names, schema sizes, renames, or\n                                      that it needs a person's sign-in (the Runtime calls no tool)";
+export declare const mcpUsage = "  mcp inspect <url> [--server <name>] [--environment <id>] [--sse] [--tenant <name>] [--json]\n                                      list a remote MCP server's tools, with Environment <id>'s\n                                      credential for <url> (none without it): model names, schema\n                                      sizes, renames, or that it needs a person's sign-in (the\n                                      Runtime calls no tool)";
+/** What `--vault` says since protocol 11. */
+export declare const MCP_VAULT_REMOVED = "--vault was removed in protocol 11: a credential is a secret of an Environment, in its own vault. Pass --environment <id> to send that Environment's credential for the URL.";
 /** What the removed `connect` subcommand says since protocol 10. */
-export declare const MCP_CONNECT_REMOVED = "The connect subcommand of nylorun mcp was removed with MCP OAuth (protocol 10): add the server's key to an installation vault as a bearer or headers credential (Studio's Credentials page, or @nylorun/admin), or reach a server that needs a person's sign-in through a gateway (a credential with via). See its tools with nylorun mcp inspect <url>.";
+export declare const MCP_CONNECT_REMOVED: string;
 /** A preview as a person reads it: the server, a table of tools, the renames, or the sign-in hint. */
-export declare function previewLines(preview: McpPreview): string[];
+export declare function previewLines(preview: McpPreview, environmentId?: string): string[];
 /** `nylorun mcp <inspect|connect> ...` */
 export declare function mcpCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/stack/mcp.js

@@ -2,30 +2,39 @@
  * `nylorun mcp inspect <url>`: a remote MCP server's tools before an agent names it (R2b C12),
  * through the running local Tenant's Management API (`POST /v1/tenant/mcp/preview`) with the
  * Project link's management key, else the Host root's (`runningTenantApi`). It never starts the
- * Tenant, and the Runtime never calls a tool. Its `connect` subcommand (MCP OAuth) was removed
- * in protocol 10, and says so.
+ * Tenant, and the Runtime never calls a tool. `--environment <id>` sends that Environment's
+ * credential for the URL (protocol 11; it replaced `--vault`); an Environment's secrets are
+ * written on the Runtime API (`client.environments.secrets.put` of `@nylorun/agents`). Its
+ * `connect` subcommand (MCP OAuth) was removed in protocol 10, and says so.
  */
 import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "@nylorun/core/compatibility";
 import { CliError } from "../errors.js";
 import { parseStackFlags, runningTenantApi } from "./commands.js";
-export const mcpUsage = `  mcp inspect <url> [--server <name>] [--vault <id>] [--sse] [--tenant <name>] [--json]
-                                      list a remote MCP server's tools with the installation vault's
-                                      credential for <url>: model names, schema sizes, renames, or
-                                      that it needs a person's sign-in (the Runtime calls no tool)`;
-const INSPECT_USAGE = "nylorun mcp inspect <url> [--server <name>] [--vault <id>] [--sse] [--tenant <name>] [--json]";
+export const mcpUsage = `  mcp inspect <url> [--server <name>] [--environment <id>] [--sse] [--tenant <name>] [--json]
+                                      list a remote MCP server's tools, with Environment <id>'s
+                                      credential for <url> (none without it): model names, schema
+                                      sizes, renames, or that it needs a person's sign-in (the
+                                      Runtime calls no tool)`;
+const INSPECT_USAGE = "nylorun mcp inspect <url> [--server <name>] [--environment <id>] [--sse] [--tenant <name>] [--json]";
+/** Where a credential for an MCP server goes since protocol 11. */
+const SECRET_HINT = "write it as a bearer or headers secret of an Environment (client.environments.secrets.put of @nylorun/agents, or Studio)";
+/** What `--vault` says since protocol 11. */
+export const MCP_VAULT_REMOVED = "--vault was removed in protocol 11: a credential is a secret of an Environment, in its own vault. Pass --environment <id> to send that Environment's credential for the URL.";
 /** What the removed `connect` subcommand says since protocol 10. */
-export const MCP_CONNECT_REMOVED = "The connect subcommand of nylorun mcp was removed with MCP OAuth (protocol 10): add the server's key to an installation vault as a bearer or headers credential (Studio's Credentials page, or @nylorun/admin), or reach a server that needs a person's sign-in through a gateway (a credential with via). See its tools with nylorun mcp inspect <url>.";
+export const MCP_CONNECT_REMOVED = `The connect subcommand of nylorun mcp was removed with MCP OAuth (protocol 10): ${SECRET_HINT.replace("write it", "write the server's key")}, or reach a server that needs a person's sign-in through a gateway (a secret with via). See its tools with nylorun mcp inspect <url> --environment <id>.`;
 /** The preview takes up to 15 s in the Runtime; the hop gets a margin. */
 const PREVIEW_TIMEOUT_MS = 30_000;
 const DESCRIPTION_CHARS = 60;
 const usageError = (message) => new CliError(message, 2);
 async function inspect(deps, args) {
-    const flags = parseStackFlags(args, { booleans: ["--json", "--sse"], values: ["--server", "--vault", "--tenant"] }, INSPECT_USAGE);
+    if (args.some((arg) => arg === "--vault" || arg.startsWith("--vault=")))
+        throw usageError(MCP_VAULT_REMOVED);
+    const flags = parseStackFlags(args, { booleans: ["--json", "--sse"], values: ["--server", "--environment", "--tenant"] }, INSPECT_USAGE);
     if (flags.rest.length !== 1)
         throw usageError(`Usage: ${INSPECT_USAGE}`);
     const url = flags.rest[0];
     const name = flags.values.get("--server");
-    const vaultId = flags.values.get("--vault");
+    const environmentId = flags.values.get("--environment");
     const tenant = flags.values.get("--tenant");
     const api = await runningTenantApi(deps, tenant === undefined ? {} : { name: tenant });
     const response = await deps.fetch(`${api.runtimeUrl}/v1/tenant/mcp/preview`, {
@@ -40,7 +49,7 @@ async function inspect(deps, args) {
             url,
             ...(flags.booleans.has("--sse") ? { type: "sse" } : {}),
             ...(name === undefined ? {} : { name }),
-            ...(vaultId === undefined ? {} : { vaultId }),
+            ...(environmentId === undefined ? {} : { environmentId }),
         }),
         redirect: "error",
         signal: AbortSignal.timeout(PREVIEW_TIMEOUT_MS),
@@ -60,15 +69,17 @@ async function inspect(deps, args) {
         deps.out(JSON.stringify(preview, null, 2));
         return 0;
     }
-    for (const line of previewLines(preview))
+    for (const line of previewLines(preview, environmentId))
         deps.out(line);
     return 0;
 }
 /** A preview as a person reads it: the server, a table of tools, the renames, or the sign-in hint. */
-export function previewLines(preview) {
+export function previewLines(preview, environmentId) {
     const credential = preview.credentialSent
-        ? "with the installation vault's credential"
-        : "with no credential (no installation vault holds one for this URL)";
+        ? `with Environment ${environmentId ?? "(unnamed)"}'s credential`
+        : environmentId === undefined
+            ? "with no credential (pass --environment <id> to send an Environment's)"
+            : `with no credential (Environment ${environmentId} holds none for this URL)`;
     if (preview.authRequired) {
         const metadata = preview.authRequired.resourceMetadata;
         const servers = Array.isArray(metadata?.authorization_servers)
@@ -76,13 +87,14 @@ export function previewLines(preview) {
             : [];
         return [
             preview.credentialSent
-                ? `The MCP server at ${preview.url} answered 401: it rejected the installation vault's credential.`
+                ? `The MCP server at ${preview.url} answered 401: it rejected Environment ${environmentId ?? "(unnamed)"}'s credential.`
                 : `The MCP server at ${preview.url} answered 401: it needs a credential.`,
             ...(servers.length > 0
                 ? [`It signs people in with ${servers.join(", ")} (${preview.authRequired.resourceMetadataUrl}).`]
                 : []),
-            "Nylorun holds no OAuth client: add the server's API key to an installation vault, or reach it",
-            "through a gateway that keeps each person's sign-in (a credential with via and an identity header).",
+            `Nylorun holds no OAuth client: ${SECRET_HINT.replace("write it", "write the server's API key")},`,
+            "and pass --environment <id>; or reach it through a gateway that keeps each person's sign-in",
+            "(a secret with via and an identity header).",
         ];
     }
     const info = preview.serverInfo;

package/dist/stack/sandbox.d.ts

@@ -1,4 +1,4 @@
 import { type StackDeps } from "./commands.js";
-export declare const sandboxUsage = "  sandbox ls [--tenant <name>] [--label <key=value>]... [--json]\n                                      the Tenant's sandboxes: id, kind, state, attached sessions and labels\n  sandbox rm <id> [--tenant <name>]   delete a sandbox and its files (refused while a turn runs in it)\n  sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]\n                                      run the Tenant's sandboxes as pods on that kubeconfig context (agent-sandbox v1.0.5)\n  sandbox disable [--tenant <name>] [--delete-namespace]\n                                      stop the sandboxes service and forget the cluster\n  sandbox status [--tenant <name>] [--json]\n                                      the cluster, the sandboxes service's readiness and what it reports";
+export declare const sandboxUsage = "  sandbox ls [--tenant <name>] [--label <key=value>]... [--json]\n                                      the Tenant's Environments: id, kind, state, sessions and labels\n  sandbox rm <id> [--tenant <name>]   delete an Environment: its sandbox, files and vault\n                                      (refused while a turn runs in it)\n  sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]\n                                      run the Tenant's sandboxes as pods on that kubeconfig context (agent-sandbox v1.0.5)\n  sandbox disable [--tenant <name>] [--delete-namespace]\n                                      stop the sandboxes service and forget the cluster\n  sandbox status [--tenant <name>] [--json]\n                                      the cluster, the sandboxes service's readiness and what it reports";
 /** `nylorun sandbox <ls|rm|enable|disable|status> ...` */
 export declare function sandboxCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/stack/sandbox.js

@@ -1,8 +1,8 @@
 /**
- * `nylorun sandbox ls | rm`: the running local Tenant's sandbox resources (Host feature
- * `sandboxes`), through its Tenant API with an operator key (`runningTenantApi`). Neither starts the
- * Tenant. `nylorun sandbox enable|disable|status` (sandbox pods on a cluster, F7.2) live in
- * `../sandbox/commands.ts`.
+ * `nylorun sandbox ls | rm`: the running local Tenant's Environments (protocol 11: each holds one
+ * sandbox and one vault), through its Runtime API with the application key (`runningTenantApi`).
+ * Neither starts the Tenant. `nylorun sandbox enable|disable|status` (sandbox pods on a cluster,
+ * F7.2) live in `../sandbox/commands.ts`.
  */
 import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "@nylorun/core/compatibility";
 import { CliError } from "../errors.js";
@@ -10,8 +10,9 @@ import { runSandboxCommand, sandboxUsage as clusterUsage } from "../sandbox/comm
 import { spawnKubectl } from "../sandbox/kubectl.js";
 import { parseStackFlags, runningTenantApi } from "./commands.js";
 export const sandboxUsage = `  sandbox ls [--tenant <name>] [--label <key=value>]... [--json]
-                                      the Tenant's sandboxes: id, kind, state, attached sessions and labels
-  sandbox rm <id> [--tenant <name>]   delete a sandbox and its files (refused while a turn runs in it)
+                                      the Tenant's Environments: id, kind, state, sessions and labels
+  sandbox rm <id> [--tenant <name>]   delete an Environment: its sandbox, files and vault
+                                      (refused while a turn runs in it)
 ${clusterUsage}`;
 const usageError = (message) => new CliError(message, 2);
 async function call(deps, api, method, path) {
@@ -26,8 +27,8 @@ async function call(deps, api, method, path) {
         signal: AbortSignal.timeout(15_000),
     });
     const body = (await response.json().catch(() => ({})));
-    if (response.status === 404 && path === "/v1/sandboxes")
-        throw new CliError(`Tenant ${api.name} runs a Runtime without sandboxes. Update it: npx nylorun@latest start.`, 1);
+    if (response.status === 404 && /^\/v1\/environments(\?|$)/.test(path))
+        throw new CliError(`Tenant ${api.name} runs a Runtime without Environments. Update it: npx nylorun@latest start.`, 1);
     if (!response.ok && response.status !== 404)
         throw new CliError(`${method} ${path} returned ${response.status}${typeof body.message === "string" ? `: ${body.message}` : ""}`, 1);
     return { status: response.status, body };
@@ -50,24 +51,24 @@ async function ls(deps, args) {
     const name = flags.values.get("--tenant");
     const api = await runningTenantApi(deps, name === undefined ? {} : { name });
     const search = query.toString();
-    const { body } = await call(deps, api, "GET", `/v1/sandboxes${search ? `?${search}` : ""}`);
-    const sandboxes = (body.sandboxes ?? []);
+    const { body } = await call(deps, api, "GET", `/v1/environments${search ? `?${search}` : ""}`);
+    const environments = (body.environments ?? []);
     if (flags.booleans.has("--json")) {
-        deps.out(JSON.stringify(sandboxes, null, 2));
+        deps.out(JSON.stringify(environments, null, 2));
         return 0;
     }
-    if (sandboxes.length === 0) {
-        deps.out(`No sandboxes on Tenant ${api.name}.`);
+    if (environments.length === 0) {
+        deps.out(`No Environments on Tenant ${api.name}.`);
         return 0;
     }
     const rows = [
         ["ID", "KIND", "STATE", "SESSIONS", "LABELS"],
-        ...sandboxes.map((sandbox) => [
-            sandbox.id,
-            sandbox.kind,
-            sandbox.state,
-            String(sandbox.sessions.length),
-            labelsText(sandbox.labels),
+        ...environments.map((environment) => [
+            environment.id,
+            environment.kind,
+            environment.state,
+            String(environment.sessions.length),
+            labelsText(environment.labels),
         ]),
     ];
     const widths = rows[0].map((_, column) => Math.max(...rows.map((row) => row[column].length)));
@@ -85,12 +86,12 @@ async function rm(deps, args) {
     const id = flags.rest[0];
     const name = flags.values.get("--tenant");
     const api = await runningTenantApi(deps, name === undefined ? {} : { name });
-    const { status, body } = await call(deps, api, "DELETE", `/v1/sandboxes/${encodeURIComponent(id)}`);
+    const { status, body } = await call(deps, api, "DELETE", `/v1/environments/${encodeURIComponent(id)}`);
     if (status === 404 || body.deleted !== true) {
-        deps.err(`No sandbox ${id} on Tenant ${api.name}.`);
+        deps.err(`No Environment ${id} on Tenant ${api.name}.`);
         return 1;
     }
-    deps.out(`Deleted sandbox ${id} and its files.`);
+    deps.out(`Deleted Environment ${id}: its sandbox, files and vault.`);
     return 0;
 }
 /** `nylorun sandbox <ls|rm|enable|disable|status> ...` */

package/dist/stack/versions.d.ts

@@ -1,7 +1,7 @@
-/** An image this CLI release pins in `cli/package.json` `nylorun` (D7). */
+/** An image this CLI release pins in its `package.json` `nylorun` (D7). */
 export type PinnedImage = "runtime" | "studio";
 /**
- * The version this CLI release pins for an image, from `cli/package.json`
+ * The version this CLI release pins for an image, from its `package.json`
  * `nylorun.runtime` or `nylorun.studio`: the tag of `ghcr.io/nylorun/<name>`
  * a local Tenant runs unless `NYLORUN_RUNTIME_IMAGE` / `NYLORUN_STUDIO_IMAGE`
  * overrides it. The release tooling writes both pins.

package/dist/stack/versions.js

@@ -3,11 +3,11 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CliError } from "../errors.js";
 function cliPackageJsonPath() {
-    // src/stack/*.ts and dist/stack/*.js both sit two levels below cli/.
+    // src/stack/*.ts and dist/stack/*.js both sit two levels below the package root.
     return join(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
 }
 /**
- * The version this CLI release pins for an image, from `cli/package.json`
+ * The version this CLI release pins for an image, from its `package.json`
  * `nylorun.runtime` or `nylorun.studio`: the tag of `ghcr.io/nylorun/<name>`
  * a local Tenant runs unless `NYLORUN_RUNTIME_IMAGE` / `NYLORUN_STUDIO_IMAGE`
  * overrides it. The release tooling writes both pins.
@@ -22,7 +22,7 @@ export function pinnedVersion(name) {
     }
     const version = raw?.nylorun?.[name];
     if (typeof version !== "string" || version.trim() === "") {
-        throw new CliError(`cli/package.json is missing "nylorun.${name}" (the pinned ${name} image version).`, 1);
+        throw new CliError(`nylorun's package.json is missing "nylorun.${name}" (the pinned ${name} image version).`, 1);
     }
     return version;
 }

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "nylorun",
-  "version": "0.13.0-beta",
+  "version": "0.14.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Set up and run local Nylorun Tenants (Runtime and Studio) with Docker Compose (nylorun), and the Runtime client of the linked installation (nylo)",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/nylorun/agents.git",
-    "directory": "nylorun"
+    "directory": "cli/nylorun"
   },
   "files": [
     "dist",
@@ -23,21 +23,21 @@
     "node": ">=24.0.0"
   },
   "scripts": {
-    "build": "npm run clean && node ../scripts/check-typescript-version.mjs && tsc -p tsconfig.json",
+    "build": "npm run clean && node ../../scripts/check-typescript-version.mjs && tsc -p tsconfig.json",
     "clean": "node -e \"import('node:fs').then(({rmSync})=>rmSync('dist',{recursive:true,force:true}))\"",
     "check": "npm run build && npm test && node scripts/check-package.mjs",
     "test": "vitest run --passWithNoTests",
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@nylorun/core": "0.19.0-beta",
-    "@nylorun/admin": "0.15.0-beta"
+    "@nylorun/core": "0.20.0-beta",
+    "@nylorun/admin": "0.16.0-beta"
   },
   "devDependencies": {
     "@earendil-works/pi-ai": "0.99.1",
-    "@nylorun/agents": "file:../agents",
+    "@nylorun/agents": "file:../../sdks/agents",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "@types/node": "^26.5.0",
+    "@types/node": "^26.6.4",
     "vitest": "^5.0.2"
   },
   "bin": {
@@ -45,7 +45,7 @@
     "nylo": "dist/nylo.js"
   },
   "nylorun": {
-    "runtime": "0.23.0-beta",
-    "studio": "0.23.3-beta"
+    "runtime": "0.24.0-beta",
+    "studio": "0.24.0-beta"
   }
 }