nylorun 0.13.0-beta → 0.15.0-beta

package/dist/stack/commands.js

@@ -38,13 +38,8 @@ export const stackUsage = `  up|start [--tenant <name>] [--no-link] [--no-studio
                                       --restate-ui (or NYLORUN_RESTATE_UI=1) publishes Restate's UI on loopback for debugging
   down|stop [--tenant <name> | --all] stop the Tenant's containers (--all: every Tenant's); keep volumes
   status [--tenant <name>] [--json]   the Tenant, its id, services, endpoints and Runtime health
-  logs [service] [--tenant <name>] [-f] [--tail <n>]
-                                      container logs (${STACK_SERVICES.join(", ")})
   studio [--tenant <name>] [--no-open]
-                                      sign a browser in to Studio on the Tenant; --no-open prints the login URL; start the Tenant if it is stopped
-  reset [--tenant <name>] [--yes]     delete the Tenant's data (volumes, tenant/ and vault key); the next start creates it anew
-  ls [--json]                         the Tenants on this machine, with their memory in use
-  delete <tenant> --yes               remove a Tenant: containers, volumes and its Host root, with the vault key (KEK)`;
+                                      sign a browser in to Studio on the Tenant; --no-open prints the login URL; start the Tenant if it is stopped`;
 const usageError = (message) => new CliError(message, 2);
 /** The Compose project of Tenant `name`: `nylorun-<name>`, or `NYLORUN_COMPOSE_PROJECT`. */
 export function stackProject(env, name) {
@@ -166,7 +161,8 @@ export function parseStackFlags(args, allowed, usage) {
     for (let index = 0; index < args.length; index += 1) {
         const raw = args[index];
         const arg = allowed.aliases?.[raw] ?? raw;
-        if (!arg.startsWith("-")) {
+        // `-` alone is an argument: standard input.
+        if (arg === "-" || !arg.startsWith("-")) {
             rest.push(arg);
             continue;
         }
@@ -224,7 +220,7 @@ async function waitForHealth(ctx, runtimeUrl, hostId) {
             return health;
         }
         if (Date.now() > deadline)
-            throw new CliError(`The Runtime did not answer ${runtimeUrl}/health. See "nylorun logs runtime".`, 7);
+            throw new CliError(`The Runtime did not answer ${runtimeUrl}/health. See "nylorun local logs runtime".`, 7);
         await sleep(ctx.deps.pollMs ?? 500);
     }
 }
@@ -284,7 +280,7 @@ function tenantCauseMessage(ctx, tenant) {
         ? ` This nylorun pins Runtime ${ctx.deps.runtimeVersion}, older than the Tenant's database: update nylorun (npx nylorun@latest start).`
         : "";
     const message = tenant.message ? `: ${tenant.message.replace(/\.?$/, ".")}` : ".";
-    return `Tenant ${ctx.name} is unavailable (${tenant.cause})${message}${hint} See "nylorun logs runtime".`;
+    return `Tenant ${ctx.name} is unavailable (${tenant.cause})${message}${hint} See "nylorun local logs runtime".`;
 }
 /**
  * Wait until the Tenant is open (`/ready`'s `tenant` check): the Runtime creates it on the
@@ -304,7 +300,7 @@ async function waitForTenant(ctx, runtimeUrl) {
             if (!open && tenant?.cause)
                 throw new CliError(tenantCauseMessage(ctx, tenant), 7);
             if (late)
-                throw new CliError(`Tenant ${ctx.name} did not open (${runtimeUrl}/ready: ${open ? "open, but nylorun-operate status did not answer" : "not open"})${tenant?.message ? `: ${tenant.message.replace(/\.$/, "")}` : ""}. See "nylorun status" and "nylorun logs runtime".`, 7);
+                throw new CliError(`Tenant ${ctx.name} did not open (${runtimeUrl}/ready: ${open ? "open, but nylorun-operate status did not answer" : "not open"})${tenant?.message ? `: ${tenant.message.replace(/\.$/, "")}` : ""}. See "nylorun status" and "nylorun local logs runtime".`, 7);
         }
         await sleep(ctx.deps.pollMs ?? 500);
     }
@@ -394,7 +390,7 @@ async function bringUp(ctx, options) {
         await refuseDowngrade(ctx, options.allowDowngrade ?? false);
     const legacy = await oldVolumes(deps.docker, ctx.project);
     if (legacy.old.length && !legacy.current)
-        throw new CliError(`Tenant ${ctx.name} was created by nylorun 0.5; its data is in the old volumes ${legacy.old.join(", ")}. Run "nylorun reset --tenant ${ctx.name}" to start it fresh; that also removes the old volumes (or drop them yourself with "docker volume rm ${legacy.old.join(" ")}").`, 3);
+        throw new CliError(`Tenant ${ctx.name} was created by nylorun 0.5; its data is in the old volumes ${legacy.old.join(", ")}. Run "nylorun local reset --tenant ${ctx.name}" to start it fresh; that also removes the old volumes (or drop them yourself with "docker volume rm ${legacy.old.join(" ")}").`, 3);
     const base = nylorunRoot(deps);
     const telemetry = await readTelemetry(base);
     const analytics = telemetryDecision(deps.env, telemetry).enabled;
@@ -437,21 +433,21 @@ async function bringUp(ctx, options) {
         const tenant = await operateStatus(ctx);
         if (tenant?.cause)
             throw new CliError(tenantCauseMessage(ctx, tenant), 7);
-        throw new CliError(`docker compose up failed (exit ${up}). See "nylorun logs runtime", "nylorun logs gateway", "nylorun logs harness" and "nylorun status".`, 7);
+        throw new CliError(`docker compose up failed (exit ${up}). See "nylorun local logs runtime", "nylorun local logs gateway", "nylorun local logs harness" and "nylorun status".`, 7);
     }
     await waitForHealth(ctx, runtimeUrl, prepared.host.hostId);
     // Without --wait: a cluster that is down must not fail the start; sessions refuse pods.
     if (prepared.env.sandboxes) {
         const sandboxes = await deps.docker.stream(composeArgs(ctx, "up", "--detach", "sandboxes"));
         if (sandboxes !== 0)
-            deps.err(`Warning: the sandboxes service did not start. See "nylorun logs sandboxes".`);
+            deps.err(`Warning: the sandboxes service did not start. See "nylorun local logs sandboxes".`);
     }
     let studioStarted = false;
     if (options.studio) {
         const studio = await deps.docker.stream(composeArgs(ctx, "up", "--detach", "--wait", "--wait-timeout", "120", "studio"));
         studioStarted = studio === 0;
         if (!studioStarted)
-            deps.err(`Warning: Studio did not start (image ${prepared.env.studioImage}). The Runtime is up; see "nylorun logs studio".`);
+            deps.err(`Warning: Studio did not start (image ${prepared.env.studioImage}). The Runtime is up; see "nylorun local logs studio".`);
     }
     return {
         runtimeUrl,
@@ -561,7 +557,7 @@ async function linkProject(ctx, started, tenantId) {
             deps.err(`Seeded the Tenant from .env: ${set.join(", ")}.`);
     }
     catch (error) {
-        deps.err(`Warning: could not seed the Tenant from .env (${error instanceof Error ? error.message : String(error)}). Set the model in Studio or with "npx -p nylorun nylo configure".`);
+        deps.err(`Warning: could not seed the Tenant from .env (${error instanceof Error ? error.message : String(error)}). Set the model in Studio or with "npx nylorun tenant models set".`);
     }
 }
 const START_USAGE = "nylorun start [--tenant <name>] [--no-link] [--no-studio] [--allow-downgrade] [--studio-embed-origin <origin>]... [--studio-embed-origin-reset] [--restate-ui]";
@@ -777,14 +773,14 @@ async function status(deps, args) {
             out(`Embeds      ${result.studio.embedOrigins.join(" ")}  (may show Studio in a frame)`);
         out(`Gateway     ${result.gateway.state} (the Model Gate; model calls fail while it is down)`);
         out(result.harness.mode === "remote"
-            ? `Harness     ${result.harness.state}, remote${result.harness.connected === undefined ? "" : `, ${result.harness.connected} connected`} (agent turns, MCP servers and workspaces; "nylorun logs harness")`
+            ? `Harness     ${result.harness.state}, remote${result.harness.connected === undefined ? "" : `, ${result.harness.connected} connected`} (agent turns, MCP servers and workspaces; "nylorun local logs harness")`
             : `Harness     in-process (NYLORUN_HARNESS=in-process in .env: turns run in the runtime container)`);
         out(result.restate.url
             ? `Restate UI  ${result.restate.url}  (unauthenticated; published by --restate-ui)`
             : `Restate UI  not published (nylorun start --restate-ui)`);
         const sandboxes = result.services.find((s) => s.service === "sandboxes");
         if (sandboxes)
-            out(`Sandboxes   ${[sandboxes.state, sandboxes.health].filter(Boolean).join(", ")} (see "nylorun sandbox status")`);
+            out(`Sandboxes   ${[sandboxes.state, sandboxes.health].filter(Boolean).join(", ")} (see "nylorun local sandbox status")`);
         out(`Services    ${STACK_SERVICES.map((name) => {
             const service = result.services.find((s) => s.service === name);
             const state = service
@@ -796,7 +792,7 @@ async function status(deps, args) {
     return result.runtime.healthy ? 0 : 3;
 }
 async function logs(deps, args) {
-    const usage = `nylorun logs [${STACK_SERVICES.join("|")}] [--tenant <name>] [-f] [--tail <n>]`;
+    const usage = `nylorun local logs [${STACK_SERVICES.join("|")}] [--tenant <name>] [-f] [--tail <n>]`;
     const flags = parseStackFlags(args, { booleans: ["--follow"], values: ["--tail", "--tenant"], aliases: { "-f": "--follow" } }, usage);
     if (flags.rest.length > 1)
         throw usageError(`Usage: ${usage}`);
@@ -812,7 +808,7 @@ async function logs(deps, args) {
     return await deps.docker.stream(composeArgs(ctx, "logs", ...(flags.booleans.has("--follow") ? ["--follow"] : []), ...(tail !== undefined ? ["--tail", tail] : []), ...(service ? [service] : [])));
 }
 async function reset(deps, args) {
-    const usage = "nylorun reset [--tenant <name>] [--yes]";
+    const usage = "nylorun local reset [--tenant <name>] [--yes]";
     const flags = parseStackFlags(args, { booleans: ["--yes"], values: ["--tenant"], aliases: { "-y": "--yes" } }, usage);
     if (flags.rest.length)
         throw usageError(`Usage: ${usage}`);
@@ -821,7 +817,7 @@ async function reset(deps, args) {
     if (!flags.booleans.has("--yes")) {
         const question = `Delete Tenant ${ctx.name}'s volumes (Compose project ${ctx.project}), its Tenant directory ${paths.tenant} and its vault key ${paths.vaultKey}? Its data is lost, and the next start creates the Tenant anew, with a new id. [y/N] `;
         if (!deps.confirm)
-            throw usageError(`nylorun reset deletes all of Tenant ${ctx.name}'s data; pass --yes to confirm when not in a terminal.`);
+            throw usageError(`nylorun local reset deletes all of Tenant ${ctx.name}'s data; pass --yes to confirm when not in a terminal.`);
         if (!(await deps.confirm(question))) {
             deps.err("Reset cancelled.");
             return 1;
@@ -856,7 +852,7 @@ async function composeProjects(docker) {
     }
 }
 async function ls(deps, args) {
-    const usage = "nylorun ls [--json]";
+    const usage = "nylorun local ls [--json]";
     const flags = parseStackFlags(args, { booleans: ["--json"] }, usage);
     if (flags.rest.length)
         throw usageError(`Usage: ${usage}`);
@@ -912,7 +908,7 @@ async function ls(deps, args) {
     return 0;
 }
 async function deleteStack(deps, args) {
-    const usage = "nylorun delete <tenant> --yes";
+    const usage = "nylorun local delete <tenant> --yes";
     const flags = parseStackFlags(args, { booleans: ["--yes"], aliases: { "-y": "--yes" } }, usage);
     const [name, ...extra] = flags.rest;
     if (name === undefined || extra.length)
@@ -921,9 +917,9 @@ async function deleteStack(deps, args) {
     const base = nylorunRoot(deps);
     const ctx = { deps, project: stackProject(deps.env, name), paths: stackPaths(tenantRoot(base, name)) };
     if (!existsSync(ctx.paths.root))
-        throw new CliError(`No Tenant ${name} under ${tenantsDir(base)}. See "nylorun ls".`, 3);
+        throw new CliError(`No Tenant ${name} under ${tenantsDir(base)}. See "nylorun local ls".`, 3);
     if (!flags.booleans.has("--yes"))
-        throw usageError(`nylorun delete removes Tenant ${name}: its containers, volumes and Host root ${ctx.paths.root}, with its vault key (KEK) and all its data. This cannot be undone; pass --yes to confirm.`);
+        throw usageError(`nylorun local delete removes Tenant ${name}: its containers, volumes and Host root ${ctx.paths.root}, with its vault key (KEK) and all its data. This cannot be undone; pass --yes to confirm.`);
     await dockerPreflight(deps.docker);
     const files = existsSync(ctx.paths.compose) && existsSync(ctx.paths.env);
     await composeDown(ctx, files
@@ -1051,7 +1047,7 @@ export async function runningTenantApi(deps, options = {}) {
 export async function ensureStack(deps, options) {
     return await ensureSelected(await selectStack(deps, options.name === undefined ? {} : { name: options.name }), options);
 }
-/** The Tenant `nylorun sandbox` acts on; it must have been started once. */
+/** The Tenant `nylorun local sandbox` acts on; it must have been started once. */
 export async function selectTenant(deps, options = {}) {
     await tidyMachine(deps);
     const ctx = await selectStack(deps, options);
@@ -1115,7 +1111,7 @@ async function studio(deps, args, options = {}) {
     if (running.started)
         deps.out(`Runtime   ${running.runtimeUrl}`);
     if (!running.studioUp)
-        throw new CliError(`Studio did not start. See "nylorun logs studio".`, 7);
+        throw new CliError(`Studio did not start. See "nylorun local logs studio".`, 7);
     // Studio serves the one Tenant; the link's Tenant id stands in while it is opening.
     let next = options.next;
     if (next === undefined) {

package/dist/stack/compose-file.d.ts

@@ -41,7 +41,7 @@
  * gateway receive it (NYLORUN_OBJECT_STORE_*). The runtime creates the bucket at boot and
  * reaches the store through its `s3` BlobStore.
  *
- * With `sandboxes` (after `nylorun sandbox enable`, F7.2) the `sandboxes` service runs the
+ * With `sandboxes` (after `nylorun local sandbox enable`, F7.2) the `sandboxes` service runs the
  * agent-sandbox driver: the only container holding the cluster credentials
  * (`<Host root>/sandboxes`, read-only), not published, reached by the runtime alone with
  * NYLORUN_SANDBOXES_TOKEN. The runtime gets an empty read-only mount over that directory.

package/dist/stack/compose-file.js

@@ -42,7 +42,7 @@ import { PINNED_IMAGES } from "./images.js";
  * gateway receive it (NYLORUN_OBJECT_STORE_*). The runtime creates the bucket at boot and
  * reaches the store through its `s3` BlobStore.
  *
- * With `sandboxes` (after `nylorun sandbox enable`, F7.2) the `sandboxes` service runs the
+ * With `sandboxes` (after `nylorun local sandbox enable`, F7.2) the `sandboxes` service runs the
  * agent-sandbox driver: the only container holding the cluster credentials
  * (`<Host root>/sandboxes`, read-only), not published, reached by the runtime alone with
  * NYLORUN_SANDBOXES_TOKEN. The runtime gets an empty read-only mount over that directory.
@@ -143,7 +143,7 @@ ${restateUi ? RESTATE_UI : RESTATE_CLOSED}    healthcheck:
       RUSTFS_ACCESS_KEY: nylorun
       RUSTFS_SECRET_KEY: \${NYLORUN_OBJECT_STORE_SECRET_KEY:?run nylorun start}
       RUSTFS_CONSOLE_ENABLE: "false" # no web console: clients go through the Runtime
-      RUSTFS_OBS_LOG_DIRECTORY: "" # log to stdout (nylorun logs rustfs)
+      RUSTFS_OBS_LOG_DIRECTORY: "" # log to stdout (nylorun local logs rustfs)
     # The image runs as uid 10001 and owns /data, which Docker copies into the new volume.
     volumes:
       - rustfs:/data
@@ -238,7 +238,16 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
       NYLORUN_HARNESS: \${NYLORUN_HARNESS:-remote}
       NYLORUN_HARNESS_LISTEN_PORT: "4200"
       NYLORUN_HARNESS_ALLOWED_HOSTS: runtime:4200${sandboxes ? SANDBOXES_HARNESS_HOST : ""}
-      NYLORUN_HARNESS_TOKEN: \${NYLORUN_HARNESS_TOKEN:?run nylorun start}${sandboxes ? SANDBOXES_RUNTIME_ENV : ""}${identity ? IDENTITY_RUNTIME_ENV : ""}
+      NYLORUN_HARNESS_TOKEN: \${NYLORUN_HARNESS_TOKEN:?run nylorun start}
+      # Traces (R7.2): from the shell that runs \`nylorun start\`. Unset, they are
+      # empty and the Runtime exports nothing. A collector on this machine is host.docker.internal.
+      OTEL_EXPORTER_OTLP_ENDPOINT: \${OTEL_EXPORTER_OTLP_ENDPOINT:-}
+      OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: \${OTEL_EXPORTER_OTLP_TRACES_ENDPOINT:-}
+      OTEL_EXPORTER_OTLP_HEADERS: \${OTEL_EXPORTER_OTLP_HEADERS:-}
+      OTEL_SERVICE_NAME: \${OTEL_SERVICE_NAME:-}
+      OTEL_RESOURCE_ATTRIBUTES: \${OTEL_RESOURCE_ATTRIBUTES:-}
+      OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT: \${OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT:-}
+      NYLORUN_TRACE_CONTENT: \${NYLORUN_TRACE_CONTENT:-}${sandboxes ? SANDBOXES_RUNTIME_ENV : ""}${identity ? IDENTITY_RUNTIME_ENV : ""}
     extra_hosts:
       host.docker.internal: host-gateway # the Docker host, also on Linux Docker Engine
     volumes:
@@ -369,21 +378,21 @@ const IDENTITY_RUNTIME_ENV = `
       # Trusted issuers (<Host root>/identity.yaml): JWTs from the operator's identity provider.
       NYLORUN_IDENTITY_FILE: /nylorun/identity.yaml`;
 const SANDBOXES_RUNTIME_ENV = `
-      # The sandboxes service (nylorun sandbox enable): pods on the Tenant's cluster.
+      # The sandboxes service (nylorun local sandbox enable): pods on the Tenant's cluster.
       NYLORUN_SANDBOXES_URL: http://sandboxes:4300
-      NYLORUN_SANDBOXES_TOKEN: \${NYLORUN_SANDBOXES_TOKEN:?run nylorun sandbox enable}
+      NYLORUN_SANDBOXES_TOKEN: \${NYLORUN_SANDBOXES_TOKEN:?run nylorun local sandbox enable}
       NYLORUN_SANDBOX_HARNESS_IMAGE: \${NYLORUN_RUNTIME_IMAGE:?run nylorun start} # pods copy the engine from it`;
 /** Pods join and connect to the Harness API at the Docker host's address. */
-const SANDBOXES_HARNESS_HOST = ",\${NYLORUN_SANDBOX_HOST_ADDRESS:?run nylorun sandbox enable}:\${NYLORUN_SANDBOX_HARNESS_PORT:?run nylorun sandbox enable}";
+const SANDBOXES_HARNESS_HOST = ",\${NYLORUN_SANDBOX_HOST_ADDRESS:?run nylorun local sandbox enable}:\${NYLORUN_SANDBOX_HARNESS_PORT:?run nylorun local sandbox enable}";
 /** The Harness API, published for sandbox pods. */
 const SANDBOXES_RUNTIME_PORT = `
-      - "\${NYLORUN_SANDBOX_BIND:?run nylorun sandbox enable}:\${NYLORUN_SANDBOX_HARNESS_PORT:?run nylorun sandbox enable}:4200" # Harness API, for sandbox pods`;
+      - "\${NYLORUN_SANDBOX_BIND:?run nylorun local sandbox enable}:\${NYLORUN_SANDBOX_HARNESS_PORT:?run nylorun local sandbox enable}:4200" # Harness API, for sandbox pods`;
 /** The gates accept the pods' Host; their calls carry run tokens. */
-const SANDBOXES_GATES_HOST = ",\${NYLORUN_SANDBOX_HOST_ADDRESS:?run nylorun sandbox enable}:\${NYLORUN_SANDBOX_GATES_PORT:?run nylorun sandbox enable}";
+const SANDBOXES_GATES_HOST = ",\${NYLORUN_SANDBOX_HOST_ADDRESS:?run nylorun local sandbox enable}:\${NYLORUN_SANDBOX_GATES_PORT:?run nylorun local sandbox enable}";
 /** The gates and egress-gate, published for sandbox pods. */
 const SANDBOXES_GATES_PORT = `    ports:
-      - "\${NYLORUN_SANDBOX_BIND:?run nylorun sandbox enable}:\${NYLORUN_SANDBOX_GATES_PORT:?run nylorun sandbox enable}:4100" # gates, for sandbox pods (run tokens)
-      - "\${NYLORUN_SANDBOX_BIND:?run nylorun sandbox enable}:\${NYLORUN_SANDBOX_EGRESS_PORT:?run nylorun sandbox enable}:4200" # egress-gate, for sandbox pods (egress tokens)
+      - "\${NYLORUN_SANDBOX_BIND:?run nylorun local sandbox enable}:\${NYLORUN_SANDBOX_GATES_PORT:?run nylorun local sandbox enable}:4100" # gates, for sandbox pods (run tokens)
+      - "\${NYLORUN_SANDBOX_BIND:?run nylorun local sandbox enable}:\${NYLORUN_SANDBOX_EGRESS_PORT:?run nylorun local sandbox enable}:4200" # egress-gate, for sandbox pods (egress tokens)
 `;
 /** egress-gate (F7.2): pods' CONNECT proxy in the gateway. */
 const SANDBOXES_GATEWAY_ENV = `
@@ -396,19 +405,19 @@ const SANDBOXES_RUNTIME_MOUNT = `
         read_only: true
         tmpfs: { size: 4096, mode: 0755 } # empty, and listable by the runtime user`;
 /**
- * The sandboxes service. The pod-facing ports `nylorun sandbox enable` records
+ * The sandboxes service. The pod-facing ports `nylorun local sandbox enable` records
  * (NYLORUN_SANDBOX_*_PORT in .env), the Harness API's, the gates' and egress-gate's, are
  * published by the runtime and the gateway (above).
  */
 function sandboxesService(project) {
     return `
   sandboxes: # agent-sandbox driver; the only holder of the cluster credentials; not published
-    image: \${NYLORUN_SANDBOXES_IMAGE:?run nylorun sandbox enable}
+    image: \${NYLORUN_SANDBOXES_IMAGE:?run nylorun local sandbox enable}
     container_name: ${project}-sandboxes
     labels: *tenant
     user: "\${NYLORUN_UID:?run nylorun start}:\${NYLORUN_GID:?run nylorun start}" # reads the 0600 token
     environment:
-      NYLORUN_SANDBOXES_TOKEN: \${NYLORUN_SANDBOXES_TOKEN:?run nylorun sandbox enable}
+      NYLORUN_SANDBOXES_TOKEN: \${NYLORUN_SANDBOXES_TOKEN:?run nylorun local sandbox enable}
       NYLORUN_SANDBOXES_DIR: /run/nylorun/sandboxes
       NYLORUN_SANDBOXES_LISTEN: ":4300"
     extra_hosts:

package/dist/stack/env-file.d.ts

@@ -55,11 +55,11 @@ export interface StackEnv {
     studioAnalyticsId: string;
     /** The Tenant's name, which the Runtime gives the Tenant it creates. */
     tenantName: string;
-    /** Present once `nylorun sandbox enable` ran for the Tenant (F7.2). */
+    /** Present once `nylorun local sandbox enable` ran for the Tenant (F7.2). */
     sandboxes?: SandboxStackEnv;
 }
 /**
- * The sandboxes service's settings (`nylorun sandbox enable`): its bearer token (only the
+ * The sandboxes service's settings (`nylorun local sandbox enable`): its bearer token (only the
  * runtime presents it), its image, and the host ports pods reach (Harness API, gates,
  * egress) on the host address, published on the bind address. The ports persist.
  */

package/dist/stack/env-file.js

@@ -102,7 +102,7 @@ export function renderEnvFile(env) {
         line("studioFrameAncestors"),
         "",
         "# Studio's anonymous usage analytics; empty when off. Set on every start: turn",
-        "# it off with nylorun telemetry disable or NYLORUN_TELEMETRY_DISABLED=1.",
+        "# it off with nylorun local telemetry disable or NYLORUN_TELEMETRY_DISABLED=1.",
         line("studioAnalyticsId"),
         "",
         "# The Tenant's name, which the Runtime gives the Tenant it creates on the first",
@@ -111,7 +111,7 @@ export function renderEnvFile(env) {
         "",
         ...(sandboxes
             ? [
-                "# Sandboxes (nylorun sandbox enable): the runtime's token for the sandboxes",
+                "# Sandboxes (nylorun local sandbox enable): the runtime's token for the sandboxes",
                 "# service, its image, and the host ports pods reach on the host address.",
                 sandboxLine("token"),
                 sandboxLine("image"),

package/dist/stack/images.d.ts

@@ -1,7 +1,7 @@
 /**
  * Images a local Tenant runs. The Runtime and Studio tags are pinned by this
  * CLI release; `NYLORUN_RUNTIME_IMAGE` and `NYLORUN_STUDIO_IMAGE` override them
- * (local builds, CI images). The sandboxes service (`nylorun sandbox enable`) is
+ * (local builds, CI images). The sandboxes service (`nylorun local sandbox enable`) is
  * versioned with the Runtime: `ghcr.io/nylorun/sandboxes:<runtime pin>`, or
  * `NYLORUN_SANDBOXES_IMAGE`. Postgres, Restate, s2-lite and RustFS are the
  * official images, pinned here; RustFS (the Object store, D35) by digest as well, so

package/dist/stack/images.js

@@ -2,7 +2,7 @@ import { pinnedVersion } from "./versions.js";
 /**
  * Images a local Tenant runs. The Runtime and Studio tags are pinned by this
  * CLI release; `NYLORUN_RUNTIME_IMAGE` and `NYLORUN_STUDIO_IMAGE` override them
- * (local builds, CI images). The sandboxes service (`nylorun sandbox enable`) is
+ * (local builds, CI images). The sandboxes service (`nylorun local sandbox enable`) is
  * versioned with the Runtime: `ghcr.io/nylorun/sandboxes:<runtime pin>`, or
  * `NYLORUN_SANDBOXES_IMAGE`. Postgres, Restate, s2-lite and RustFS are the
  * official images, pinned here; RustFS (the Object store, D35) by digest as well, so

package/dist/stack/index.d.ts

@@ -5,17 +5,8 @@ export { checkDocker } from "./docker.js";
 export type { Check, DockerChecks } from "./docker.js";
 /** Real dependencies: docker on PATH, global fetch, the terminal. */
 export declare function defaultStackDeps(env: Readonly<Record<string, string | undefined>>): StackDeps;
-/** Entry for `nylorun start|stop|status|logs|reset|studio|ls|delete`. */
+/** Entry for `nylorun start|stop|status|studio` and `nylorun local logs|reset|ls|delete`. */
 export declare function stackCommand(name: string, args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
-/** Entry for `nylorun sandbox ls|rm`. */
-export declare function sandboxCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
-export { sandboxUsage } from "./sandbox.js";
-/** Entry for `nylorun key put|list|rm`. */
-export declare function keyCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
-export { keyUsage } from "./keys.js";
-/** Entry for `nylorun mcp inspect`. */
-export declare function mcpCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
-export { mcpUsage } from "./mcp.js";
 /** `nylorun studio`, landing on `next` when given, else on the Tenant's page. */
 export declare function studioCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>, options?: {
     next?: string;

package/dist/stack/index.js

@@ -1,10 +1,8 @@
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline/promises";
+import { text } from "node:stream/consumers";
 import { runStackCommand, runStudioCommand } from "./commands.js";
 import { spawnDocker } from "./docker.js";
-import { keyCommand as runKeyCommand } from "./keys.js";
-import { mcpCommand as runMcpCommand } from "./mcp.js";
-import { sandboxCommand as runSandboxCommand } from "./sandbox.js";
 import { pinnedVersion } from "./versions.js";
 import { loopbackPorts } from "./ports.js";
 export { ensureStack, isStackCommand, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
@@ -52,6 +50,7 @@ export function defaultStackDeps(env) {
             }
             : {}),
         interactive,
+        stdin: { isTTY: Boolean(process.stdin.isTTY), text: () => text(process.stdin) },
         openBrowser: async (url) => {
             const command = browserCommand(env);
             return await new Promise((resolve) => {
@@ -77,25 +76,10 @@ export function defaultStackDeps(env) {
         },
     };
 }
-/** Entry for `nylorun start|stop|status|logs|reset|studio|ls|delete`. */
+/** Entry for `nylorun start|stop|status|studio` and `nylorun local logs|reset|ls|delete`. */
 export async function stackCommand(name, args, env) {
     return await runStackCommand(name, args, defaultStackDeps(env));
 }
-/** Entry for `nylorun sandbox ls|rm`. */
-export async function sandboxCommand(args, env) {
-    return await runSandboxCommand(defaultStackDeps(env), args);
-}
-export { sandboxUsage } from "./sandbox.js";
-/** Entry for `nylorun key put|list|rm`. */
-export async function keyCommand(args, env) {
-    return await runKeyCommand(defaultStackDeps(env), args);
-}
-export { keyUsage } from "./keys.js";
-/** Entry for `nylorun mcp inspect`. */
-export async function mcpCommand(args, env) {
-    return await runMcpCommand(defaultStackDeps(env), args);
-}
-export { mcpUsage } from "./mcp.js";
 /** `nylorun studio`, landing on `next` when given, else on the Tenant's page. */
 export async function studioCommand(args, env, options = {}) {
     return await runStudioCommand(args, defaultStackDeps(env), options);

package/dist/stack/keys.d.ts

@@ -1,4 +1,4 @@
 import { type StackDeps } from "./commands.js";
-export declare const keyUsage = "  key put <id> [--management] [--tenant <name>]\n                                      create the Tenant's application key <id> (--management: a management key), or\n                                      rotate it (the old key stops working); prints the key once\n  key list [--tenant <name>] [--json] the Tenant's keys: id, role, when issued (never the keys)\n  key rm <id> [--tenant <name>]      delete key <id>: it stops working at once";
-/** `nylorun key <put|list|rm> ...` */
+export declare const keyUsage = "  keys put <id> [--management] [--tenant <name>]\n                                      create the Tenant's application key <id> (--management: a\n                                      management key, on the Runtime's machine only), or rotate it\n                                      (the old key stops working); prints the key once\n  keys list [--tenant <name>] [--json]\n                                      the Tenant's keys: id, role, when issued (never the keys)\n  keys rm <id> [--tenant <name>]      delete key <id>: it stops working at once";
+/** `nylorun tenant keys <put|list|rm> ...` on a local Tenant. */
 export declare function keyCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/stack/keys.js

@@ -1,20 +1,23 @@
 /**
- * `nylorun key put | list | rm`: the running local Tenant's keys, through `nylorun-operate` in its
- * runtime container. Revocable application keys by name, for app servers and other clients, and
+ * `nylorun tenant keys put | list | rm` on a local Tenant: its keys, through `nylorun-operate` in
+ * its runtime container (`client/tenant.ts` takes a remote installation's application keys
+ * through the Management API). Revocable application keys by name, for app servers and other clients, and
  * management keys (`--management`), which only this machine issues; none of these starts the
  * Tenant.
  */
 import { CliError } from "../errors.js";
 import { parseStackFlags, runningOperate } from "./commands.js";
 import { deleteOperatorKey, listOperatorKeys, putOperatorKey } from "./operator-keys.js";
-export const keyUsage = `  key put <id> [--management] [--tenant <name>]
-                                      create the Tenant's application key <id> (--management: a management key), or
-                                      rotate it (the old key stops working); prints the key once
-  key list [--tenant <name>] [--json] the Tenant's keys: id, role, when issued (never the keys)
-  key rm <id> [--tenant <name>]      delete key <id>: it stops working at once`;
+export const keyUsage = `  keys put <id> [--management] [--tenant <name>]
+                                      create the Tenant's application key <id> (--management: a
+                                      management key, on the Runtime's machine only), or rotate it
+                                      (the old key stops working); prints the key once
+  keys list [--tenant <name>] [--json]
+                                      the Tenant's keys: id, role, when issued (never the keys)
+  keys rm <id> [--tenant <name>]      delete key <id>: it stops working at once`;
 const usageError = (message) => new CliError(message, 2);
 async function put(deps, args) {
-    const usage = "nylorun key put <id> [--management] [--tenant <name>]";
+    const usage = "nylorun tenant keys put <id> [--management] [--tenant <name>]";
     const flags = parseStackFlags(args, { booleans: ["--management"], values: ["--tenant"] }, usage);
     if (flags.rest.length !== 1)
         throw usageError(`Usage: ${usage}`);
@@ -28,7 +31,7 @@ async function put(deps, args) {
     return 0;
 }
 async function list(deps, args) {
-    const usage = "nylorun key list [--tenant <name>] [--json]";
+    const usage = "nylorun tenant keys list [--tenant <name>] [--json]";
     const flags = parseStackFlags(args, { booleans: ["--json"], values: ["--tenant"] }, usage);
     if (flags.rest.length)
         throw usageError(`Usage: ${usage}`);
@@ -47,7 +50,7 @@ async function list(deps, args) {
     return 0;
 }
 async function rm(deps, args) {
-    const usage = "nylorun key rm <id> [--tenant <name>]";
+    const usage = "nylorun tenant keys rm <id> [--tenant <name>]";
     const flags = parseStackFlags(args, { values: ["--tenant"] }, usage);
     if (flags.rest.length !== 1)
         throw usageError(`Usage: ${usage}`);
@@ -61,7 +64,7 @@ async function rm(deps, args) {
     deps.out(`Deleted key ${id}: it no longer works.`);
     return 0;
 }
-/** `nylorun key <put|list|rm> ...` */
+/** `nylorun tenant keys <put|list|rm> ...` on a local Tenant. */
 export async function keyCommand(deps, args) {
     const [sub, ...rest] = args;
     if (sub === "put")

package/dist/stack/paths.d.ts

@@ -10,7 +10,7 @@ export interface StackPaths {
     state: string;
     /**
      * cli-credentials.json: the operator key `cli` that `nylorun` commands use outside a linked
-     * project (`nylorun sandbox`), mode 0600.
+     * project (`nylorun local sandbox`), mode 0600.
      */
     cliCredentials: string;
     /**

package/dist/stack/prepare.d.ts

@@ -43,7 +43,7 @@ export declare function prepareStack(input: {
     /** The measurement id Studio reports page views to; absent when telemetry is off. */
     studioAnalyticsId?: string;
     /**
-     * The sandboxes settings (`nylorun sandbox enable`); null removes them (`disable`).
+     * The sandboxes settings (`nylorun local sandbox enable`); null removes them (`disable`).
      * Undefined keeps the persisted ones while `sandboxes/cluster.json` exists.
      */
     sandboxes?: SandboxStackEnv | null;

package/dist/stack/stacks.js

@@ -25,7 +25,7 @@ export function tenantRoot(base, name) {
 export function assertTenantName(name, source) {
     // A Tenant id, such as a NYLORUN_TENANT kept from an older release.
     if (/^tn_/i.test(name))
-        throw new CliError(`${source} must be a Tenant's name, not a Tenant id: ${name}. "nylorun ls" lists the Tenants on this machine.`, 2);
+        throw new CliError(`${source} must be a Tenant's name, not a Tenant id: ${name}. "nylorun local ls" lists the Tenants on this machine.`, 2);
     if (!TENANT_NAME.test(name))
         throw new CliError(`${source} must be lowercase letters, digits, "-" or "_", starting with a letter or digit: ${name}`, 2);
     return name;

package/dist/stack/versions.d.ts

@@ -1,7 +1,7 @@
-/** An image this CLI release pins in `cli/package.json` `nylorun` (D7). */
+/** An image this CLI release pins in its `package.json` `nylorun` (D7). */
 export type PinnedImage = "runtime" | "studio";
 /**
- * The version this CLI release pins for an image, from `cli/package.json`
+ * The version this CLI release pins for an image, from its `package.json`
  * `nylorun.runtime` or `nylorun.studio`: the tag of `ghcr.io/nylorun/<name>`
  * a local Tenant runs unless `NYLORUN_RUNTIME_IMAGE` / `NYLORUN_STUDIO_IMAGE`
  * overrides it. The release tooling writes both pins.

package/dist/stack/versions.js

@@ -3,11 +3,11 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CliError } from "../errors.js";
 function cliPackageJsonPath() {
-    // src/stack/*.ts and dist/stack/*.js both sit two levels below cli/.
+    // src/stack/*.ts and dist/stack/*.js both sit two levels below the package root.
     return join(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
 }
 /**
- * The version this CLI release pins for an image, from `cli/package.json`
+ * The version this CLI release pins for an image, from its `package.json`
  * `nylorun.runtime` or `nylorun.studio`: the tag of `ghcr.io/nylorun/<name>`
  * a local Tenant runs unless `NYLORUN_RUNTIME_IMAGE` / `NYLORUN_STUDIO_IMAGE`
  * overrides it. The release tooling writes both pins.
@@ -22,7 +22,7 @@ export function pinnedVersion(name) {
     }
     const version = raw?.nylorun?.[name];
     if (typeof version !== "string" || version.trim() === "") {
-        throw new CliError(`cli/package.json is missing "nylorun.${name}" (the pinned ${name} image version).`, 1);
+        throw new CliError(`nylorun's package.json is missing "nylorun.${name}" (the pinned ${name} image version).`, 1);
     }
     return version;
 }

package/dist/telemetry.d.ts

@@ -8,7 +8,7 @@ export declare const STUDIO_ANALYTICS_ID = "G-K6RPDFH6Q6";
 /** `~/.nylorun/telemetry.json`: the developer's choice, for every Tenant on the machine. */
 export interface TelemetryFile {
     format: 1;
-    /** False after `nylorun telemetry disable`; absent until a choice is made. */
+    /** False after `nylorun local telemetry disable`; absent until a choice is made. */
     enabled?: boolean;
     /** When `nylorun start` showed the notice (ISO time); it is shown once. */
     noticeShown?: string;
@@ -23,7 +23,7 @@ export declare function readTelemetry(nylorunRoot: string): Promise<TelemetryFil
 export declare function writeTelemetry(nylorunRoot: string, file: TelemetryFile): Promise<void>;
 /** On unless the environment or the developer's choice turns it off. */
 export declare function telemetryDecision(env: Readonly<Record<string, string | undefined>>, file: TelemetryFile): TelemetryDecision;
-/** `nylorun telemetry [status|enable|disable]`. */
+/** `nylorun local telemetry [status|enable|disable]`. */
 export declare function telemetryCommand(args: readonly string[], context: {
     nylorunRoot: string;
     env: Readonly<Record<string, string | undefined>>;

package/dist/telemetry.js

@@ -12,7 +12,7 @@ export const STUDIO_ANALYTICS_ID = "G-K6RPDFH6Q6";
 export const TELEMETRY_NOTICE = [
     "Studio collects anonymous usage data: which pages are opened, with every",
     "Tenant, agent and session id removed. Nothing you send to agents is collected.",
-    'Turn it off with "nylorun telemetry disable" or NYLORUN_TELEMETRY_DISABLED=1.',
+    'Turn it off with "nylorun local telemetry disable" or NYLORUN_TELEMETRY_DISABLED=1.',
     "Learn more: https://github.com/nylorun/agents/blob/main/nylorun/README.md#telemetry",
 ].join("\n");
 export function telemetryPath(nylorunRoot) {
@@ -56,11 +56,11 @@ export function telemetryDecision(env, file) {
     if (flag(env.CI))
         return { enabled: false, reason: "CI is set" };
     if (file.enabled === false)
-        return { enabled: false, reason: 'turned off with "nylorun telemetry disable"' };
+        return { enabled: false, reason: 'turned off with "nylorun local telemetry disable"' };
     return { enabled: true, reason: "on by default" };
 }
-const USAGE = "Usage: nylorun telemetry [status|enable|disable]";
-/** `nylorun telemetry [status|enable|disable]`. */
+const USAGE = "Usage: nylorun local telemetry [status|enable|disable]";
+/** `nylorun local telemetry [status|enable|disable]`. */
 export async function telemetryCommand(args, context) {
     const [action = "status", ...rest] = args;
     if (rest.length || !["status", "enable", "disable"].includes(action))