nylorun 0.14.0-beta → 0.15.0-beta

package/dist/client/tenant.js

@@ -0,0 +1,176 @@
+import { CliError } from "../errors.js";
+import { parseStackFlags } from "../stack/commands.js";
+import { keyCommand, keyUsage } from "../stack/keys.js";
+import { printJson, printTable } from "./io.js";
+import { mcpCommand, mcpUsage } from "./mcp.js";
+import { callsCommand, modelsCommand, modelsUsage, usageCommand, usageUsage } from "./models.js";
+import { budgetsCommand, coverageCommand, settingsCommand, settingsUsage, toolPolicyCommand, } from "./settings.js";
+import { signingKeysCommand, signingKeysUsage } from "./signing-keys.js";
+import { connect, managementClient, messageOf, remoteConnection } from "./target.js";
+export const tenantUsage = `nylorun tenant <command>
+
+The Management API of the installation's one Tenant, with a management key: the local Tenant
+--tenant names (else the linked project's, else the default one), or the installation that
+NYLORUN_RUNTIME_URL and NYLORUN_MANAGEMENT_KEY name.
+
+  reset [--sessions|--environments|--all] [--yes] [--tenant <name>]
+                                      clear the Tenant's sessions, Environments or all its data
+                                      (the Project link and keys stay)
+${keyUsage}
+${signingKeysUsage}
+${modelsUsage}
+${usageUsage}
+${settingsUsage}
+${mcpUsage}
+
+A put reads a JSON body from a file, or from stdin for -, and replaces the whole document; what
+budgets, tool-policy and settings artifacts get print, put takes back. An API key is read from
+stdin, never from the arguments.`;
+const usageError = (message) => new CliError(message, 2);
+/** The Management API client of the installation `--tenant` (or the environment) names. */
+export async function tenantClient(deps, tenant) {
+    const connection = await connect(deps, "management", tenant);
+    return { connection, admin: managementClient(deps, connection) };
+}
+/**
+ * `nylorun status` for an installation the environment names (`NYLORUN_RUNTIME_URL` and
+ * `NYLORUN_MANAGEMENT_KEY`): the Tenant, its checks and counts. A local Tenant's status is the
+ * stack's (`stack/commands.ts`).
+ */
+export async function remoteStatus(deps, args) {
+    const usage = "nylorun status [--tenant <name>] [--json]";
+    const flags = parseStackFlags(args, { booleans: ["--json"] }, usage);
+    if (flags.rest.length)
+        throw usageError(`Usage: ${usage}`);
+    const { connection, admin } = await tenantClient(deps, undefined);
+    let body;
+    try {
+        body = await admin.tenant.status();
+    }
+    catch (error) {
+        throw new CliError(`${messageOf(error)} The installation at ${connection.url} did not answer.`, 1);
+    }
+    if (flags.booleans.has("--json")) {
+        deps.out(JSON.stringify(body, null, 2));
+        return 0;
+    }
+    deps.out(`${body.tenant.name}  ${body.tenant.id}`);
+    deps.out(`runtime  ${connection.url}`);
+    deps.out(`path     ${body.path}`);
+    deps.out(`checks   ${Object.entries(body.checks)
+        .map(([k, v]) => `${k}=${v ? "ok" : "fail"}`)
+        .join(" ")}`);
+    deps.out(`counts   sessions=${body.counts.sessions} running=${body.counts.runningSessions} uncertain=${body.counts.uncertainEffects}`);
+    deps.out(`sandbox  ${body.sandbox.backend ?? "none"}`);
+    return 0;
+}
+const RESET_USAGE = "nylorun tenant reset [--sessions|--environments|--all] [--yes] [--tenant <name>]";
+const SCOPES = { "--sessions": "sessions", "--environments": "environments", "--all": "all" };
+/** `nylorun tenant reset`; `--all` asks first. */
+async function reset(deps, args) {
+    const flags = parseStackFlags(args, { booleans: ["--yes", ...Object.keys(SCOPES)], values: ["--tenant"], aliases: { "-y": "--yes" } }, RESET_USAGE);
+    if (flags.rest.length)
+        throw usageError(`Usage: ${RESET_USAGE}`);
+    const chosen = Object.keys(SCOPES).filter((flag) => flags.booleans.has(flag));
+    if (chosen.length > 1)
+        throw usageError("Pass only one of --sessions, --environments, --all.");
+    const scope = chosen.length ? SCOPES[chosen[0]] : "sessions";
+    const { connection, admin } = await tenantClient(deps, flags.values.get("--tenant"));
+    if (scope === "all" && !flags.booleans.has("--yes")) {
+        if (!deps.confirm)
+            throw usageError("Confirmation required; pass --yes for non-interactive use.");
+        if (!(await deps.confirm(`Reset ALL data of ${connection.label}? The Project link and keys are kept. [y/N] `))) {
+            deps.err("Cancelled.");
+            return 1;
+        }
+    }
+    try {
+        await admin.tenant.reset({ scope, activeWork: "drain" });
+    }
+    catch (error) {
+        throw new CliError(`Tenant reset failed: ${messageOf(error)}`, 1);
+    }
+    deps.out(`Reset ${connection.label} (${scope}).`);
+    return 0;
+}
+/**
+ * `nylorun tenant keys`: through the Management API on an installation the environment names
+ * (application keys only), else on the local Tenant through `nylorun-operate`.
+ */
+async function keys(deps, args) {
+    if (args.includes("--tenant") || !remoteConnection(deps.env, "management"))
+        return keyCommand(deps, args);
+    const [verb, ...rest] = args;
+    const { admin, connection } = await tenantClient(deps, undefined);
+    if (verb === "put") {
+        const usage = "nylorun tenant keys put <id>";
+        const flags = parseStackFlags(rest, { booleans: ["--management"] }, usage);
+        if (flags.booleans.has("--management"))
+            throw new CliError("Management keys are issued only on the Runtime's machine: run nylorun tenant keys put <id> --management there.", 2);
+        if (flags.rest.length !== 1)
+            throw usageError(`Usage: ${usage}`);
+        const key = await admin.keys.put(flags.rest[0]);
+        deps.out(key.key);
+        deps.err(`${key.rotated ? "Rotated" : "Created"} application key ${key.id} on ${connection.label}${key.rotated ? " (the previous key no longer works)" : ""}. Store it now: it is not shown again.`);
+        return 0;
+    }
+    if (verb === "list" || verb === "ls") {
+        const usage = "nylorun tenant keys list [--json]";
+        const flags = parseStackFlags(rest, { booleans: ["--json"] }, usage);
+        if (flags.rest.length)
+            throw usageError(`Usage: ${usage}`);
+        const list = await admin.keys.list();
+        if (flags.booleans.has("--json"))
+            printJson(deps, list);
+        else
+            printTable(deps, [["ID", "ROLE", "CREATED"], ...list.map((key) => [key.id, key.role, key.createdAt])]);
+        return 0;
+    }
+    if (verb === "rm" || verb === "delete") {
+        const usage = "nylorun tenant keys rm <id>";
+        const flags = parseStackFlags(rest, {}, usage);
+        if (flags.rest.length !== 1)
+            throw usageError(`Usage: ${usage}`);
+        const id = flags.rest[0];
+        if (!(await admin.keys.delete(id))) {
+            deps.err(`No key ${id} on ${connection.label}.`);
+            return 1;
+        }
+        deps.out(`Deleted key ${id}: it no longer works.`);
+        return 0;
+    }
+    throw usageError(`Usage:\n${keyUsage}`);
+}
+/** `nylorun tenant <group> ...` */
+export async function tenantCommand(deps, args) {
+    const [group, ...rest] = args;
+    if (group === "--help" || group === "-h") {
+        deps.out(tenantUsage);
+        return 0;
+    }
+    if (!group)
+        throw usageError(tenantUsage);
+    if (group === "reset")
+        return reset(deps, rest);
+    if (group === "keys" || group === "key")
+        return keys(deps, rest);
+    if (group === "signing-keys")
+        return signingKeysCommand(deps, rest);
+    if (group === "models" || group === "model")
+        return modelsCommand(deps, rest);
+    if (group === "usage")
+        return usageCommand(deps, rest);
+    if (group === "calls")
+        return callsCommand(deps, rest);
+    if (group === "budgets")
+        return budgetsCommand(deps, rest);
+    if (group === "tool-policy")
+        return toolPolicyCommand(deps, rest);
+    if (group === "settings")
+        return settingsCommand(deps, rest);
+    if (group === "coverage")
+        return coverageCommand(deps, rest);
+    if (group === "mcp")
+        return mcpCommand(deps, rest);
+    throw usageError(`Unknown tenant command ${group}.\n${tenantUsage}`);
+}

package/dist/doctor.js

@@ -75,7 +75,7 @@ export async function doctorStack(options) {
                     ? `- ${local.name} stopped (Compose project ${local.project}): run nylorun up`
                     : local.runtime.healthy
                         ? `✓ ${local.name} running (Compose project ${local.project})`
-                        : `✗ ${local.name} running, but the Runtime does not answer: see nylorun status and nylorun logs runtime`,
+                        : `✗ ${local.name} running, but the Runtime does not answer: see nylorun status and nylorun local logs runtime`,
         ]);
         if (local.state === "running") {
             rows.push([
@@ -88,7 +88,7 @@ export async function doctorStack(options) {
                 "gateway",
                 local.gateway.healthy
                     ? `✓ ${local.gateway.state} · combined packing (runtime: core,loop; gateway: gates)`
-                    : `✗ ${local.gateway.state}: model calls fail; see nylorun logs gateway`,
+                    : `✗ ${local.gateway.state}: model calls fail; see nylorun local logs gateway`,
             ]);
             rows.push([
                 "harness",
@@ -96,7 +96,7 @@ export async function doctorStack(options) {
                     ? "- in-process (NYLORUN_HARNESS=in-process in .env)"
                     : local.harness.healthy
                         ? `✓ ${local.harness.state} · remote (agent turns, MCP servers, workspaces)`
-                        : `✗ ${local.harness.state}: turns do not run; see nylorun logs harness`,
+                        : `✗ ${local.harness.state}: turns do not run; see nylorun local logs harness`,
             ]);
             if (local.tenant)
                 rows.push([

package/dist/nylo.js

@@ -1,9 +1,25 @@
 #!/usr/bin/env node
 import "./baseline.js";
 import { runCommand } from "./command.js";
-// `nylo`, the Runtime client (client/). `nylorun`'s entry never imports it, so `npx nylorun start`
-// loads none of it, nor @nylorun/admin.
+import { CliError } from "./errors.js";
+/**
+ * `nylo` became part of `nylorun`. For one release this command names the `nylorun` command that
+ * replaces each of its own and exits 2; a later release removes it.
+ */
+const REPLACEMENTS = {
+    status: "nylorun status",
+    reset: "nylorun tenant reset",
+    access: "nylorun tenant signing-keys list|rotate|revoke",
+    configure: "nylorun tenant models set",
+    doctor: "nylorun doctor sandbox",
+    env: 'nothing: the SDKs read the Project link themselves; for a process outside the project, "nylorun tenant keys put <id>" and the Runtime URL "nylorun status" prints',
+};
+function nyloMessage(argv) {
+    const replacement = REPLACEMENTS[argv[0] ?? ""];
+    return replacement
+        ? `nylo is part of nylorun now: nylo ${argv[0]} is ${replacement}.`
+        : "nylo is part of nylorun now: run nylorun --help.";
+}
 runCommand(async () => {
-    const { main } = await import("./client/cli.js");
-    await main(process.argv.slice(2));
+    throw new CliError(nyloMessage(process.argv.slice(2)), 2);
 });

package/dist/sandbox/cluster-file.d.ts

@@ -1,6 +1,6 @@
 /**
  * `<Host root>/sandboxes/`: what the sandboxes service mounts read-only. `cluster.json`
- * records the cluster `nylorun sandbox enable` installed into; `token` is the
+ * records the cluster `nylorun local sandbox enable` installed into; `token` is the
  * ServiceAccount token (0600). Only the sandboxes container reads them: the runtime
  * container sees an empty mount there.
  */

package/dist/sandbox/commands.d.ts

@@ -37,5 +37,5 @@ export declare function installCluster(deps: SandboxDeps, input: {
         egress: number;
     };
 }): Promise<InstallResult>;
-/** `nylorun sandbox <enable|disable|status>`. */
+/** `nylorun local sandbox <enable|disable|status>`. */
 export declare function runSandboxCommand(args: readonly string[], deps: SandboxDeps): Promise<number>;

package/dist/sandbox/commands.js

@@ -16,7 +16,7 @@ export const sandboxUsage = `  sandbox enable --context <name> [--tenant <name>]
                                       stop the sandboxes service and forget the cluster
   sandbox status [--tenant <name>] [--json]
                                       the cluster, the sandboxes service's readiness and what it reports`;
-const ENABLE_USAGE = "nylorun sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]";
+const ENABLE_USAGE = "nylorun local sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]";
 /** The default workload image (D36), pre-pulled with the Runtime image. */
 export const DEFAULT_SANDBOX_IMAGE = "python:3.13-slim";
 /** Preferred host ports for the Harness API, gates and egress (pods reach them). */
@@ -141,7 +141,7 @@ async function enable(deps, args) {
         throw usageError(`Usage: ${ENABLE_USAGE}`);
     const context = flags.values.get("--context");
     if (!context)
-        throw usageError(`nylorun sandbox enable needs --context <name>: the kubeconfig context to run pods in (never the current one implicitly). Usage: ${ENABLE_USAGE}`);
+        throw usageError(`nylorun local sandbox enable needs --context <name>: the kubeconfig context to run pods in (never the current one implicitly). Usage: ${ENABLE_USAGE}`);
     const hostAddress = flags.values.get("--host-address");
     const bindAddress = flags.values.get("--bind-address");
     if (hostAddress)
@@ -191,7 +191,7 @@ async function enable(deps, args) {
     await restartTenant(stack, { name: tenant.name, sandboxes: settings });
     const ready = await stack.docker.stream(tenant.compose("up", "--detach", "--wait", "--wait-timeout", "120", "sandboxes"));
     if (ready !== 0)
-        throw new CliError(`The sandboxes service did not become ready (image ${images.sandboxes}). See "nylorun logs sandboxes" and "nylorun sandbox status".`, 7);
+        throw new CliError(`The sandboxes service did not become ready (image ${images.sandboxes}). See "nylorun local logs sandboxes" and "nylorun local sandbox status".`, 7);
     const c = installed.cluster;
     stack.out(`Sandboxes ${tenant.name}  enabled on ${c.context} (namespace ${c.namespace}, agent-sandbox ${c.controllerVersion})`);
     stack.out(`Pods reach ${c.hostAddress} on ports ${c.ports.harness}, ${c.ports.gates}, ${c.ports.egress}; NetworkPolicy enforced (probed ${c.networkPolicy.probedAt})`);
@@ -199,7 +199,7 @@ async function enable(deps, args) {
 }
 async function disable(deps, args) {
     const { stack } = deps;
-    const usage = "nylorun sandbox disable [--tenant <name>] [--delete-namespace]";
+    const usage = "nylorun local sandbox disable [--tenant <name>] [--delete-namespace]";
     const flags = parseStackFlags(args, { booleans: ["--delete-namespace"], values: ["--tenant"] }, usage);
     if (flags.rest.length)
         throw usageError(`Usage: ${usage}`);
@@ -229,7 +229,7 @@ async function disable(deps, args) {
 const INFO_SCRIPT = "fetch(process.env.NYLORUN_SANDBOXES_URL+'/v1/info',{headers:{authorization:'Bearer '+process.env.NYLORUN_SANDBOXES_TOKEN},signal:AbortSignal.timeout(5000)}).then(async r=>{process.stdout.write(await r.text());process.exit(r.ok?0:1)},()=>process.exit(1))";
 async function status(deps, args) {
     const { stack } = deps;
-    const usage = "nylorun sandbox status [--tenant <name>] [--json]";
+    const usage = "nylorun local sandbox status [--tenant <name>] [--json]";
     const flags = parseStackFlags(args, { booleans: ["--json"], values: ["--tenant"] }, usage);
     if (flags.rest.length)
         throw usageError(`Usage: ${usage}`);
@@ -240,7 +240,7 @@ async function status(deps, args) {
         if (flags.booleans.has("--json"))
             stack.out(JSON.stringify({ enabled: false }, null, 2));
         else
-            stack.out(`Sandboxes are not enabled for Tenant ${tenant.name}. Run "nylorun sandbox enable --context <name>".`);
+            stack.out(`Sandboxes are not enabled for Tenant ${tenant.name}. Run "nylorun local sandbox enable --context <name>".`);
         return 3;
     }
     await dockerPreflight(stack.docker);
@@ -271,7 +271,7 @@ const COMMANDS = {
     disable,
     status,
 };
-/** `nylorun sandbox <enable|disable|status>`. */
+/** `nylorun local sandbox <enable|disable|status>`. */
 export async function runSandboxCommand(args, deps) {
     const [name, ...rest] = args;
     const command = name === undefined ? undefined : COMMANDS[name];

package/dist/sandbox/manifests.d.ts

@@ -1,5 +1,5 @@
 /**
- * What `nylorun sandbox enable` installs into a cluster. The agent-sandbox controller is
+ * What `nylorun local sandbox enable` installs into a cluster. The agent-sandbox controller is
  * pinned (D32, Experiment 2): v1.0.5, API agents.x-k8s.io/v1beta1, its release manifest
  * verified by sha256 before it is applied. It is never upgraded or uninstalled here.
  */

package/dist/sandbox/manifests.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 /**
- * What `nylorun sandbox enable` installs into a cluster. The agent-sandbox controller is
+ * What `nylorun local sandbox enable` installs into a cluster. The agent-sandbox controller is
  * pinned (D32, Experiment 2): v1.0.5, API agents.x-k8s.io/v1beta1, its release manifest
  * verified by sha256 before it is applied. It is never upgraded or uninstalled here.
  */

package/dist/sandbox/probe.d.ts

@@ -2,7 +2,7 @@ import type { DockerRunner } from "../stack/docker.js";
 import type { PortProbe } from "../stack/ports.js";
 import type { Kube } from "./kubectl.js";
 /**
- * The NetworkPolicy probe `nylorun sandbox enable` runs before it trusts a cluster (D32), in
+ * The NetworkPolicy probe `nylorun local sandbox enable` runs before it trusts a cluster (D32), in
  * a throwaway namespace `nylorun-sbx-probe-<random>`:
  *
  * - a `control` pod (no policy) must reach a `peer` pod and the allowed host port, which

package/dist/stack/commands.d.ts

@@ -5,7 +5,7 @@ import type { PortProbe } from "./ports.js";
 import { type FetchLike } from "./studio-login.js";
 import { type OperateEndpoint } from "./operator-keys.js";
 export declare const STACK_SERVICES: readonly ["postgres", "restate", "s2-lite", "rustfs", "gateway", "runtime", "harness", "studio"];
-export declare const stackUsage: string;
+export declare const stackUsage = "  up|start [--tenant <name>] [--no-link] [--no-studio] [--allow-downgrade] [--studio-embed-origin <origin>]... [--studio-embed-origin-reset] [--restate-ui]\n                                      start the project's Tenant, creating it and the Project link (.nylorun/link.json,\n                                      credentials.json) on the first run; print the Runtime and Studio URLs (it opens no\n                                      browser). --tenant attaches to (or creates) a named Tenant; --no-link\n                                      starts the default Tenant (or --tenant's) without linking the current directory;\n                                      --restate-ui (or NYLORUN_RESTATE_UI=1) publishes Restate's UI on loopback for debugging\n  down|stop [--tenant <name> | --all] stop the Tenant's containers (--all: every Tenant's); keep volumes\n  status [--tenant <name>] [--json]   the Tenant, its id, services, endpoints and Runtime health\n  studio [--tenant <name>] [--no-open]\n                                      sign a browser in to Studio on the Tenant; --no-open prints the login URL; start the Tenant if it is stopped";
 export interface StackDeps {
     /** Environment snapshot (NYLORUN_HOME, NYLORUN_TENANT, image overrides, NYLORUN_COMPOSE_PROJECT). */
     env: Readonly<Record<string, string | undefined>>;
@@ -22,6 +22,11 @@ export interface StackDeps {
     confirm?(question: string): Promise<boolean>;
     /** A developer is at a terminal. */
     interactive?: boolean;
+    /** Standard input, for a body or a secret piped in; undefined when there is none. */
+    stdin?: {
+        isTTY: boolean;
+        text(): Promise<string>;
+    };
     /** Open `url` in a browser; false when no browser could be started. */
     openBrowser(url: string): Promise<boolean>;
     /** Is this process id alive? (launcher-managed Runtime detection) */
@@ -137,7 +142,7 @@ export interface StackEndpoints {
     /** This call started the Runtime (it was not running before). */
     started: boolean;
 }
-/** The running Tenant's APIs and their keys (`nylorun sandbox`). */
+/** The running Tenant's APIs and their keys (`nylorun local sandbox`). */
 export interface TenantApi {
     /** The Tenant's name. */
     name: string;
@@ -179,7 +184,7 @@ export declare function ensureStack(deps: StackDeps, options: {
     studio: boolean;
     name?: string;
 }): Promise<StackEndpoints>;
-/** A started Tenant as `nylorun sandbox` sees it. */
+/** A started Tenant as `nylorun local sandbox` sees it. */
 export interface SelectedTenant {
     name: string;
     paths: StackPaths;
@@ -187,7 +192,7 @@ export interface SelectedTenant {
     /** `docker compose` arguments for this Tenant's project and files. */
     compose(...args: string[]): string[];
 }
-/** The Tenant `nylorun sandbox` acts on; it must have been started once. */
+/** The Tenant `nylorun local sandbox` acts on; it must have been started once. */
 export declare function selectTenant(deps: StackDeps, options?: {
     name?: string;
 }): Promise<SelectedTenant>;

package/dist/stack/commands.js

@@ -38,13 +38,8 @@ export const stackUsage = `  up|start [--tenant <name>] [--no-link] [--no-studio
                                       --restate-ui (or NYLORUN_RESTATE_UI=1) publishes Restate's UI on loopback for debugging
   down|stop [--tenant <name> | --all] stop the Tenant's containers (--all: every Tenant's); keep volumes
   status [--tenant <name>] [--json]   the Tenant, its id, services, endpoints and Runtime health
-  logs [service] [--tenant <name>] [-f] [--tail <n>]
-                                      container logs (${STACK_SERVICES.join(", ")})
   studio [--tenant <name>] [--no-open]
-                                      sign a browser in to Studio on the Tenant; --no-open prints the login URL; start the Tenant if it is stopped
-  reset [--tenant <name>] [--yes]     delete the Tenant's data (volumes, tenant/ and vault key); the next start creates it anew
-  ls [--json]                         the Tenants on this machine, with their memory in use
-  delete <tenant> --yes               remove a Tenant: containers, volumes and its Host root, with the vault key (KEK)`;
+                                      sign a browser in to Studio on the Tenant; --no-open prints the login URL; start the Tenant if it is stopped`;
 const usageError = (message) => new CliError(message, 2);
 /** The Compose project of Tenant `name`: `nylorun-<name>`, or `NYLORUN_COMPOSE_PROJECT`. */
 export function stackProject(env, name) {
@@ -166,7 +161,8 @@ export function parseStackFlags(args, allowed, usage) {
     for (let index = 0; index < args.length; index += 1) {
         const raw = args[index];
         const arg = allowed.aliases?.[raw] ?? raw;
-        if (!arg.startsWith("-")) {
+        // `-` alone is an argument: standard input.
+        if (arg === "-" || !arg.startsWith("-")) {
             rest.push(arg);
             continue;
         }
@@ -224,7 +220,7 @@ async function waitForHealth(ctx, runtimeUrl, hostId) {
             return health;
         }
         if (Date.now() > deadline)
-            throw new CliError(`The Runtime did not answer ${runtimeUrl}/health. See "nylorun logs runtime".`, 7);
+            throw new CliError(`The Runtime did not answer ${runtimeUrl}/health. See "nylorun local logs runtime".`, 7);
         await sleep(ctx.deps.pollMs ?? 500);
     }
 }
@@ -284,7 +280,7 @@ function tenantCauseMessage(ctx, tenant) {
         ? ` This nylorun pins Runtime ${ctx.deps.runtimeVersion}, older than the Tenant's database: update nylorun (npx nylorun@latest start).`
         : "";
     const message = tenant.message ? `: ${tenant.message.replace(/\.?$/, ".")}` : ".";
-    return `Tenant ${ctx.name} is unavailable (${tenant.cause})${message}${hint} See "nylorun logs runtime".`;
+    return `Tenant ${ctx.name} is unavailable (${tenant.cause})${message}${hint} See "nylorun local logs runtime".`;
 }
 /**
  * Wait until the Tenant is open (`/ready`'s `tenant` check): the Runtime creates it on the
@@ -304,7 +300,7 @@ async function waitForTenant(ctx, runtimeUrl) {
             if (!open && tenant?.cause)
                 throw new CliError(tenantCauseMessage(ctx, tenant), 7);
             if (late)
-                throw new CliError(`Tenant ${ctx.name} did not open (${runtimeUrl}/ready: ${open ? "open, but nylorun-operate status did not answer" : "not open"})${tenant?.message ? `: ${tenant.message.replace(/\.$/, "")}` : ""}. See "nylorun status" and "nylorun logs runtime".`, 7);
+                throw new CliError(`Tenant ${ctx.name} did not open (${runtimeUrl}/ready: ${open ? "open, but nylorun-operate status did not answer" : "not open"})${tenant?.message ? `: ${tenant.message.replace(/\.$/, "")}` : ""}. See "nylorun status" and "nylorun local logs runtime".`, 7);
         }
         await sleep(ctx.deps.pollMs ?? 500);
     }
@@ -394,7 +390,7 @@ async function bringUp(ctx, options) {
         await refuseDowngrade(ctx, options.allowDowngrade ?? false);
     const legacy = await oldVolumes(deps.docker, ctx.project);
     if (legacy.old.length && !legacy.current)
-        throw new CliError(`Tenant ${ctx.name} was created by nylorun 0.5; its data is in the old volumes ${legacy.old.join(", ")}. Run "nylorun reset --tenant ${ctx.name}" to start it fresh; that also removes the old volumes (or drop them yourself with "docker volume rm ${legacy.old.join(" ")}").`, 3);
+        throw new CliError(`Tenant ${ctx.name} was created by nylorun 0.5; its data is in the old volumes ${legacy.old.join(", ")}. Run "nylorun local reset --tenant ${ctx.name}" to start it fresh; that also removes the old volumes (or drop them yourself with "docker volume rm ${legacy.old.join(" ")}").`, 3);
     const base = nylorunRoot(deps);
     const telemetry = await readTelemetry(base);
     const analytics = telemetryDecision(deps.env, telemetry).enabled;
@@ -437,21 +433,21 @@ async function bringUp(ctx, options) {
         const tenant = await operateStatus(ctx);
         if (tenant?.cause)
             throw new CliError(tenantCauseMessage(ctx, tenant), 7);
-        throw new CliError(`docker compose up failed (exit ${up}). See "nylorun logs runtime", "nylorun logs gateway", "nylorun logs harness" and "nylorun status".`, 7);
+        throw new CliError(`docker compose up failed (exit ${up}). See "nylorun local logs runtime", "nylorun local logs gateway", "nylorun local logs harness" and "nylorun status".`, 7);
     }
     await waitForHealth(ctx, runtimeUrl, prepared.host.hostId);
     // Without --wait: a cluster that is down must not fail the start; sessions refuse pods.
     if (prepared.env.sandboxes) {
         const sandboxes = await deps.docker.stream(composeArgs(ctx, "up", "--detach", "sandboxes"));
         if (sandboxes !== 0)
-            deps.err(`Warning: the sandboxes service did not start. See "nylorun logs sandboxes".`);
+            deps.err(`Warning: the sandboxes service did not start. See "nylorun local logs sandboxes".`);
     }
     let studioStarted = false;
     if (options.studio) {
         const studio = await deps.docker.stream(composeArgs(ctx, "up", "--detach", "--wait", "--wait-timeout", "120", "studio"));
         studioStarted = studio === 0;
         if (!studioStarted)
-            deps.err(`Warning: Studio did not start (image ${prepared.env.studioImage}). The Runtime is up; see "nylorun logs studio".`);
+            deps.err(`Warning: Studio did not start (image ${prepared.env.studioImage}). The Runtime is up; see "nylorun local logs studio".`);
     }
     return {
         runtimeUrl,
@@ -561,7 +557,7 @@ async function linkProject(ctx, started, tenantId) {
             deps.err(`Seeded the Tenant from .env: ${set.join(", ")}.`);
     }
     catch (error) {
-        deps.err(`Warning: could not seed the Tenant from .env (${error instanceof Error ? error.message : String(error)}). Set the model in Studio or with "npx -p nylorun nylo configure".`);
+        deps.err(`Warning: could not seed the Tenant from .env (${error instanceof Error ? error.message : String(error)}). Set the model in Studio or with "npx nylorun tenant models set".`);
     }
 }
 const START_USAGE = "nylorun start [--tenant <name>] [--no-link] [--no-studio] [--allow-downgrade] [--studio-embed-origin <origin>]... [--studio-embed-origin-reset] [--restate-ui]";
@@ -777,14 +773,14 @@ async function status(deps, args) {
             out(`Embeds      ${result.studio.embedOrigins.join(" ")}  (may show Studio in a frame)`);
         out(`Gateway     ${result.gateway.state} (the Model Gate; model calls fail while it is down)`);
         out(result.harness.mode === "remote"
-            ? `Harness     ${result.harness.state}, remote${result.harness.connected === undefined ? "" : `, ${result.harness.connected} connected`} (agent turns, MCP servers and workspaces; "nylorun logs harness")`
+            ? `Harness     ${result.harness.state}, remote${result.harness.connected === undefined ? "" : `, ${result.harness.connected} connected`} (agent turns, MCP servers and workspaces; "nylorun local logs harness")`
             : `Harness     in-process (NYLORUN_HARNESS=in-process in .env: turns run in the runtime container)`);
         out(result.restate.url
             ? `Restate UI  ${result.restate.url}  (unauthenticated; published by --restate-ui)`
             : `Restate UI  not published (nylorun start --restate-ui)`);
         const sandboxes = result.services.find((s) => s.service === "sandboxes");
         if (sandboxes)
-            out(`Sandboxes   ${[sandboxes.state, sandboxes.health].filter(Boolean).join(", ")} (see "nylorun sandbox status")`);
+            out(`Sandboxes   ${[sandboxes.state, sandboxes.health].filter(Boolean).join(", ")} (see "nylorun local sandbox status")`);
         out(`Services    ${STACK_SERVICES.map((name) => {
             const service = result.services.find((s) => s.service === name);
             const state = service
@@ -796,7 +792,7 @@ async function status(deps, args) {
     return result.runtime.healthy ? 0 : 3;
 }
 async function logs(deps, args) {
-    const usage = `nylorun logs [${STACK_SERVICES.join("|")}] [--tenant <name>] [-f] [--tail <n>]`;
+    const usage = `nylorun local logs [${STACK_SERVICES.join("|")}] [--tenant <name>] [-f] [--tail <n>]`;
     const flags = parseStackFlags(args, { booleans: ["--follow"], values: ["--tail", "--tenant"], aliases: { "-f": "--follow" } }, usage);
     if (flags.rest.length > 1)
         throw usageError(`Usage: ${usage}`);
@@ -812,7 +808,7 @@ async function logs(deps, args) {
     return await deps.docker.stream(composeArgs(ctx, "logs", ...(flags.booleans.has("--follow") ? ["--follow"] : []), ...(tail !== undefined ? ["--tail", tail] : []), ...(service ? [service] : [])));
 }
 async function reset(deps, args) {
-    const usage = "nylorun reset [--tenant <name>] [--yes]";
+    const usage = "nylorun local reset [--tenant <name>] [--yes]";
     const flags = parseStackFlags(args, { booleans: ["--yes"], values: ["--tenant"], aliases: { "-y": "--yes" } }, usage);
     if (flags.rest.length)
         throw usageError(`Usage: ${usage}`);
@@ -821,7 +817,7 @@ async function reset(deps, args) {
     if (!flags.booleans.has("--yes")) {
         const question = `Delete Tenant ${ctx.name}'s volumes (Compose project ${ctx.project}), its Tenant directory ${paths.tenant} and its vault key ${paths.vaultKey}? Its data is lost, and the next start creates the Tenant anew, with a new id. [y/N] `;
         if (!deps.confirm)
-            throw usageError(`nylorun reset deletes all of Tenant ${ctx.name}'s data; pass --yes to confirm when not in a terminal.`);
+            throw usageError(`nylorun local reset deletes all of Tenant ${ctx.name}'s data; pass --yes to confirm when not in a terminal.`);
         if (!(await deps.confirm(question))) {
             deps.err("Reset cancelled.");
             return 1;
@@ -856,7 +852,7 @@ async function composeProjects(docker) {
     }
 }
 async function ls(deps, args) {
-    const usage = "nylorun ls [--json]";
+    const usage = "nylorun local ls [--json]";
     const flags = parseStackFlags(args, { booleans: ["--json"] }, usage);
     if (flags.rest.length)
         throw usageError(`Usage: ${usage}`);
@@ -912,7 +908,7 @@ async function ls(deps, args) {
     return 0;
 }
 async function deleteStack(deps, args) {
-    const usage = "nylorun delete <tenant> --yes";
+    const usage = "nylorun local delete <tenant> --yes";
     const flags = parseStackFlags(args, { booleans: ["--yes"], aliases: { "-y": "--yes" } }, usage);
     const [name, ...extra] = flags.rest;
     if (name === undefined || extra.length)
@@ -921,9 +917,9 @@ async function deleteStack(deps, args) {
     const base = nylorunRoot(deps);
     const ctx = { deps, project: stackProject(deps.env, name), paths: stackPaths(tenantRoot(base, name)) };
     if (!existsSync(ctx.paths.root))
-        throw new CliError(`No Tenant ${name} under ${tenantsDir(base)}. See "nylorun ls".`, 3);
+        throw new CliError(`No Tenant ${name} under ${tenantsDir(base)}. See "nylorun local ls".`, 3);
     if (!flags.booleans.has("--yes"))
-        throw usageError(`nylorun delete removes Tenant ${name}: its containers, volumes and Host root ${ctx.paths.root}, with its vault key (KEK) and all its data. This cannot be undone; pass --yes to confirm.`);
+        throw usageError(`nylorun local delete removes Tenant ${name}: its containers, volumes and Host root ${ctx.paths.root}, with its vault key (KEK) and all its data. This cannot be undone; pass --yes to confirm.`);
     await dockerPreflight(deps.docker);
     const files = existsSync(ctx.paths.compose) && existsSync(ctx.paths.env);
     await composeDown(ctx, files
@@ -1051,7 +1047,7 @@ export async function runningTenantApi(deps, options = {}) {
 export async function ensureStack(deps, options) {
     return await ensureSelected(await selectStack(deps, options.name === undefined ? {} : { name: options.name }), options);
 }
-/** The Tenant `nylorun sandbox` acts on; it must have been started once. */
+/** The Tenant `nylorun local sandbox` acts on; it must have been started once. */
 export async function selectTenant(deps, options = {}) {
     await tidyMachine(deps);
     const ctx = await selectStack(deps, options);
@@ -1115,7 +1111,7 @@ async function studio(deps, args, options = {}) {
     if (running.started)
         deps.out(`Runtime   ${running.runtimeUrl}`);
     if (!running.studioUp)
-        throw new CliError(`Studio did not start. See "nylorun logs studio".`, 7);
+        throw new CliError(`Studio did not start. See "nylorun local logs studio".`, 7);
     // Studio serves the one Tenant; the link's Tenant id stands in while it is opening.
     let next = options.next;
     if (next === undefined) {

package/dist/stack/compose-file.d.ts

@@ -41,7 +41,7 @@
  * gateway receive it (NYLORUN_OBJECT_STORE_*). The runtime creates the bucket at boot and
  * reaches the store through its `s3` BlobStore.
  *
- * With `sandboxes` (after `nylorun sandbox enable`, F7.2) the `sandboxes` service runs the
+ * With `sandboxes` (after `nylorun local sandbox enable`, F7.2) the `sandboxes` service runs the
  * agent-sandbox driver: the only container holding the cluster credentials
  * (`<Host root>/sandboxes`, read-only), not published, reached by the runtime alone with
  * NYLORUN_SANDBOXES_TOKEN. The runtime gets an empty read-only mount over that directory.