nylorun 0.15.1-beta → 0.17.0-beta

package/dist/client/sessions.js

@@ -1,5 +1,6 @@
 /**
- * `nylorun sessions`: the Tenant's sessions (`/v1/sessions`, Runtime API): open one, send it a
+ * `nylorun sessions`: the Tenant's sessions (`/v1/sessions`, Runtime API): open one on an Agent
+ * (protocol 16: every session runs on one, and its id is the caller's to choose), send it a
  * message, answer what it waits for, watch its events, and read its history, usage, calls and
  * traces. `exec` runs a command in the session's sandbox, as an app's own tool would.
  */
@@ -10,13 +11,17 @@ export const sessionsUsage = `nylorun sessions <command>
 
 The Tenant's sessions, through the Runtime API with an application key (or NYLORUN_TOKEN).
 
-  list [--agent <id>] [--status <status>] [--environment <id>] [--owner <user>]
+  list [--agent <id>] [--manifest <name>] [--status <status>] [--owner <user>]
        [--limit <n>] [--cursor <c>] [--json]
-  create --agent <id> --owner <user> [--environment <id>] [--id <id>] [--info <json>]
-                                      open a session; prints its id
+                                      --agent: on that Agent; --manifest: on the Agents made
+                                      from that agent manifest
+  create --agent <id> --owner <user> [--id <id>] [--info <json>]
+                                      open a session on Agent <id>; prints its id
   get <id>                            the session: status, active turn, what it waits for
   send <id> [<text>] [--data <json>] [--file <artifact>[@<version>]]... [--idempotency-key <k>]
-                                      start a turn with text, JSON data or files (artifacts)
+       [--reject-if-busy]             start a turn with text, JSON data or files (artifacts); while
+                                      a turn runs the message waits in the session's queue, or is
+                                      refused with --reject-if-busy
   approve <id> <interaction> [--deny] approve (or deny) a held tool call
   respond <id> <interaction> <json>   answer a question the agent asked
   cancel <id> [--reason <text>]       cancel the running turn
@@ -33,9 +38,13 @@ The Tenant's sessions, through the Runtime API with an application key (or NYLOR
                                       its exit code
 
 ${runtimeFlagsUsage}`;
+/** Protocol 16: a session runs on the Agent `--agent` names, which holds what an Environment did. */
+const ENVIRONMENT_REMOVED = "--environment was removed in protocol 16: a session runs on an Agent, its sandbox and vault included. Pass --agent <id> (nylorun agents list).";
 async function list(deps, args) {
-    const usage = "nylorun sessions list [--agent <id>] [--status <s>] [--environment <id>] [--owner <user>] [--limit <n>] [--cursor <c>] [--json]";
-    const flags = parseFlags(args, { booleans: ["--json"], values: ["--agent", "--status", "--environment", "--owner", "--limit", "--cursor"] }, usage);
+    const usage = "nylorun sessions list [--agent <id>] [--manifest <name>] [--status <s>] [--owner <user>] [--limit <n>] [--cursor <c>] [--json]";
+    if (args.includes("--environment"))
+        throw usageError(ENVIRONMENT_REMOVED);
+    const flags = parseFlags(args, { booleans: ["--json"], values: ["--agent", "--manifest", "--status", "--owner", "--limit", "--cursor"] }, usage);
     positional(flags, 0, usage);
     const { client } = await runtimeClient(deps, flags);
     const value = (name) => flags.values.get(name);
@@ -43,7 +52,7 @@ async function list(deps, args) {
     const page = await runtimeCall(() => client.sessions.page({
         ...(value("--agent") ? { agentId: value("--agent") } : {}),
         ...(value("--status") ? { status: value("--status") } : {}),
-        ...(value("--environment") ? { environmentId: value("--environment") } : {}),
+        ...(value("--manifest") ? { manifest: value("--manifest") } : {}),
         ...(value("--owner") ? { ownerUserId: value("--owner") } : {}),
         ...(limit === undefined ? {} : { limit }),
         ...(value("--cursor") ? { cursor: value("--cursor") } : {}),
@@ -56,13 +65,12 @@ async function list(deps, args) {
         deps.out("No sessions.");
     else
         printTable(deps, [
-            ["ID", "AGENT", "OWNER", "STATUS", "ENVIRONMENT", "LAST EVENT"],
+            ["ID", "AGENT", "OWNER", "STATUS", "LAST EVENT"],
             ...page.sessions.map((session) => [
                 session.id,
                 session.agentId,
                 session.ownerUserId,
                 session.status,
-                session.environmentId ?? "-",
                 session.lastEventAt ?? "-",
             ]),
         ]);
@@ -70,8 +78,10 @@ async function list(deps, args) {
     return 0;
 }
 async function create(deps, args) {
-    const usage = "nylorun sessions create --agent <id> --owner <user> [--environment <id>] [--id <id>] [--info <json>]";
-    const flags = parseFlags(args, { values: ["--agent", "--owner", "--environment", "--id", "--info"] }, usage);
+    const usage = "nylorun sessions create --agent <id> --owner <user> [--id <id>] [--info <json>]";
+    if (args.includes("--environment"))
+        throw usageError(ENVIRONMENT_REMOVED);
+    const flags = parseFlags(args, { values: ["--agent", "--owner", "--id", "--info"] }, usage);
     positional(flags, 0, usage);
     const agentId = flags.values.get("--agent");
     const ownerUserId = flags.values.get("--owner");
@@ -81,14 +91,12 @@ async function create(deps, args) {
     const parsedInfo = info === undefined ? undefined : parseJsonArgument(info, "--info");
     if (parsedInfo !== undefined && (!parsedInfo || typeof parsedInfo !== "object" || Array.isArray(parsedInfo)))
         throw usageError("--info must be a JSON object.");
-    const environment = flags.values.get("--environment");
     const id = flags.values.get("--id");
     const { client } = await runtimeClient(deps, flags);
     const session = await runtimeCall(() => client.createSession({
-        agentId,
+        agent: agentId,
         ownerUserId,
         ...(id ? { id } : {}),
-        ...(environment ? { environment } : {}),
         ...(parsedInfo ? { info: parsedInfo } : {}),
     }));
     deps.out(session.id);
@@ -113,8 +121,8 @@ function filePart(value) {
     return { type: "file", artifactId: value.slice(0, at), version: Number(version) };
 }
 async function send(deps, args) {
-    const usage = "nylorun sessions send <id> [<text>] [--data <json>] [--file <artifact>[@<version>]]... [--idempotency-key <k>]";
-    const flags = parseFlags(args, { values: ["--data", "--idempotency-key"], lists: ["--file"] }, usage);
+    const usage = "nylorun sessions send <id> [<text>] [--data <json>] [--file <artifact>[@<version>]]... [--idempotency-key <k>] [--reject-if-busy]";
+    const flags = parseFlags(args, { values: ["--data", "--idempotency-key"], lists: ["--file"], booleans: ["--reject-if-busy"] }, usage);
     if (flags.rest.length < 1 || flags.rest.length > 2)
         throw usageError(`Usage: ${usage}`);
     const [id, text] = flags.rest;
@@ -125,7 +133,10 @@ async function send(deps, args) {
     if (data === undefined && text === undefined && files.length === 0)
         throw usageError(`Nothing to send. Usage: ${usage}`);
     const parts = files.map(filePart);
-    const options = { idempotencyKey: flags.values.get("--idempotency-key") ?? randomUUID() };
+    const options = {
+        idempotencyKey: flags.values.get("--idempotency-key") ?? randomUUID(),
+        ...(flags.booleans.has("--reject-if-busy") ? { delivery: "reject" } : {}),
+    };
     const { client } = await runtimeClient(deps, flags);
     const session = client.session(id);
     const accepted = await runtimeCall(() => data !== undefined

package/dist/client/settings.d.ts

@@ -1,12 +1,12 @@
 import { type StackDeps } from "../stack/commands.js";
-export declare const settingsUsage = "  budgets [get | put <file|->] [--tenant <name>]\n                                      the model spend caps; put replaces them all\n  tool-policy [get | put <file|->] [--tenant <name>]\n                                      the Tool Gate's rules; put replaces them all\n  settings sandbox [get | put <file|->] [--tenant <name>]\n                                      the Environment settings: limits, stop grace, placement\n  settings artifacts [get | put <file|->] [--tenant <name>]\n                                      the artifact store's limits\n  coverage --agent <id> [--environment <id>] [--tenant <name>] [--json]\n                                      which secret of the Environment each of the agent's MCP\n                                      servers and HTTP tools would get";
+export declare const settingsUsage = "  budgets [get | put <file|->] [--tenant <name>]\n                                      the model spend caps (scope tenant, manifest with id an\n                                      agent manifest's name, or turn); put replaces them all\n  tool-policy [get | put <file|->] [--tenant <name>]\n                                      the Tool Gate's rules; put replaces them all\n  settings sandbox [get | put <file|->] [--tenant <name>]\n                                      the Agents' environments: limits, stop grace, placement\n  settings artifacts [get | put <file|->] [--tenant <name>]\n                                      the artifact store's limits\n  settings skills [get | put <file|->] [--tenant <name>]\n                                      the most bytes one skill may hold\n  settings limits [get | put <file|->] [--tenant <name>]\n                                      the Runtime limits: sizes, counts and deadlines (record\n                                      entries, request bodies, Agents, model calls, tools)\n  coverage --agent <id> [--tenant <name>] [--json]\n                                      which secret of Agent <id>'s vault each MCP server and\n                                      HTTP tool of its manifest would get";
 export declare const budgetsCommand: (deps: StackDeps, args: readonly string[]) => Promise<number>;
 export declare const toolPolicyCommand: (deps: StackDeps, args: readonly string[]) => Promise<number>;
-/** `nylorun tenant settings sandbox | artifacts ...` */
+/** `nylorun tenant settings sandbox | artifacts | skills | limits ...` */
 export declare function settingsCommand(deps: StackDeps, args: readonly string[]): Promise<number>;
 /**
- * `nylorun tenant coverage`: which secret of `--environment` each remote MCP server and HTTP tool
- * of saved agent `--agent` would get in a session (none without an Environment). It reads no
- * secret and calls no server.
+ * `nylorun tenant coverage`: which secret of Agent `--agent`'s vault each remote MCP server and
+ * HTTP tool of the manifest version it runs would get in its sessions. It reads no secret and
+ * calls no server.
  */
 export declare function coverageCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/client/settings.js

@@ -1,19 +1,25 @@
-import { PutModelBudgetsRequestSchema, PutTenantArtifactsRequestSchema, PutTenantEnvironmentsRequestSchema, PutToolPolicyRequestSchema, } from "@nylorun/core/contracts";
+import { PutModelBudgetsRequestSchema, PutTenantArtifactsRequestSchema, PutTenantEnvironmentsRequestSchema, PutTenantLimitsRequestSchema, PutTenantSkillsRequestSchema, PutToolPolicyRequestSchema, } from "@nylorun/core/contracts";
 import { CliError } from "../errors.js";
 import { parseStackFlags } from "../stack/commands.js";
 import { printJson, printTable, readBody } from "./io.js";
 import { connect, managementClient } from "./target.js";
 export const settingsUsage = `  budgets [get | put <file|->] [--tenant <name>]
-                                      the model spend caps; put replaces them all
+                                      the model spend caps (scope tenant, manifest with id an
+                                      agent manifest's name, or turn); put replaces them all
   tool-policy [get | put <file|->] [--tenant <name>]
                                       the Tool Gate's rules; put replaces them all
   settings sandbox [get | put <file|->] [--tenant <name>]
-                                      the Environment settings: limits, stop grace, placement
+                                      the Agents' environments: limits, stop grace, placement
   settings artifacts [get | put <file|->] [--tenant <name>]
                                       the artifact store's limits
-  coverage --agent <id> [--environment <id>] [--tenant <name>] [--json]
-                                      which secret of the Environment each of the agent's MCP
-                                      servers and HTTP tools would get`;
+  settings skills [get | put <file|->] [--tenant <name>]
+                                      the most bytes one skill may hold
+  settings limits [get | put <file|->] [--tenant <name>]
+                                      the Runtime limits: sizes, counts and deadlines (record
+                                      entries, request bodies, Agents, model calls, tools)
+  coverage --agent <id> [--tenant <name>] [--json]
+                                      which secret of Agent <id>'s vault each MCP server and
+                                      HTTP tool of its manifest would get`;
 const usageError = (message = `Usage:\n${settingsUsage}`) => new CliError(message, 2);
 /* The bodies' `requestId` is optional in the contracts; the client adds one when it is absent. */
 const budgets = {
@@ -42,6 +48,18 @@ const artifacts = {
     get: (admin) => admin.settings.artifacts.get(),
     put: (admin, body) => admin.settings.artifacts.put(body),
 };
+const skillSettings = {
+    name: "settings skills",
+    schema: PutTenantSkillsRequestSchema,
+    get: (admin) => admin.settings.skills.get(),
+    put: (admin, body) => admin.settings.skills.put(body),
+};
+const limitSettings = {
+    name: "settings limits",
+    schema: PutTenantLimitsRequestSchema,
+    get: (admin) => admin.settings.limits.get(),
+    put: (admin, body) => admin.settings.limits.put(body),
+};
 /** `<document> [get | put <file|->]`: `get` when no verb is given. */
 async function documentCommand(deps, document, args) {
     const usage = `nylorun tenant ${document.name} [get | put <file|->] [--tenant <name>]`;
@@ -56,38 +74,40 @@ async function documentCommand(deps, document, args) {
 }
 export const budgetsCommand = (deps, args) => documentCommand(deps, budgets, args);
 export const toolPolicyCommand = (deps, args) => documentCommand(deps, toolPolicy, args);
-/** `nylorun tenant settings sandbox | artifacts ...` */
+/** `nylorun tenant settings sandbox | artifacts | skills | limits ...` */
 export async function settingsCommand(deps, args) {
     const [which, ...rest] = args;
     if (which === "sandbox")
         return documentCommand(deps, sandbox, rest);
     if (which === "artifacts")
         return documentCommand(deps, artifacts, rest);
+    if (which === "skills")
+        return documentCommand(deps, skillSettings, rest);
+    if (which === "limits")
+        return documentCommand(deps, limitSettings, rest);
     throw usageError();
 }
-const COVERAGE_USAGE = "nylorun tenant coverage --agent <id> [--environment <id>] [--tenant <name>] [--json]";
+const COVERAGE_USAGE = "nylorun tenant coverage --agent <id> [--tenant <name>] [--json]";
 /**
- * `nylorun tenant coverage`: which secret of `--environment` each remote MCP server and HTTP tool
- * of saved agent `--agent` would get in a session (none without an Environment). It reads no
- * secret and calls no server.
+ * `nylorun tenant coverage`: which secret of Agent `--agent`'s vault each remote MCP server and
+ * HTTP tool of the manifest version it runs would get in its sessions. It reads no secret and
+ * calls no server.
  */
 export async function coverageCommand(deps, args) {
-    const flags = parseStackFlags(args, { booleans: ["--json"], values: ["--tenant", "--agent", "--environment"] }, COVERAGE_USAGE);
+    if (args.includes("--environment"))
+        throw usageError("--environment was removed in protocol 16: pass the Agent, --agent <id>, whose vault its sessions use.");
+    const flags = parseStackFlags(args, { booleans: ["--json"], values: ["--tenant", "--agent"] }, COVERAGE_USAGE);
     const agentId = flags.values.get("--agent");
-    const environmentId = flags.values.get("--environment");
     if (flags.rest.length || agentId === undefined)
         throw usageError(`Usage: ${COVERAGE_USAGE}`);
     const admin = managementClient(deps, await connect(deps, "management", flags.values.get("--tenant")));
-    const coverage = await admin.coverage({
-        agentId,
-        ...(environmentId === undefined ? {} : { environmentId }),
-    });
+    const coverage = await admin.coverage({ agentId });
     if (flags.booleans.has("--json")) {
         printJson(deps, coverage);
         return 0;
     }
     const missing = coverage.entries.filter((entry) => entry.status === "missing").length;
-    deps.out(`${coverage.agentId} in ${coverage.environmentId ?? "no Environment"}: ${coverage.complete ? "every credential is covered" : `${missing} of ${coverage.entries.length} missing`}`);
+    deps.out(`Agent ${coverage.agentId}: ${coverage.complete ? "every credential is covered" : `${missing} of ${coverage.entries.length} missing`}`);
     if (coverage.entries.length)
         printTable(deps, [
             ["STATUS", "KIND", "NAME", "URL", "SECRET"],

package/dist/client/tenant.d.ts

@@ -6,7 +6,7 @@
 import type { ManagementClient } from "@nylorun/admin";
 import { type StackDeps } from "../stack/commands.js";
 import { type Connection } from "./target.js";
-export declare const tenantUsage = "nylorun tenant <command>\n\nThe Management API of the installation's one Tenant, with a management key: the local Tenant\n--tenant names (else the linked project's, else the default one), or the installation that\nNYLORUN_RUNTIME_URL and NYLORUN_MANAGEMENT_KEY name.\n\n  reset [--sessions|--environments|--all] [--yes] [--tenant <name>]\n                                      clear the Tenant's sessions, Environments or all its data\n                                      (the Project link and keys stay)\n  keys put <id> [--management] [--tenant <name>]\n                                      create the Tenant's application key <id> (--management: a\n                                      management key, on the Runtime's machine only), or rotate it\n                                      (the old key stops working); prints the key once\n  keys list [--tenant <name>] [--json]\n                                      the Tenant's keys: id, role, when issued (never the keys)\n  keys rm <id> [--tenant <name>]      delete key <id>: it stops working at once\n  signing-keys list [--tenant <name>]\n                                      the Tenant's token signing keys\n  signing-keys rotate [--force] [--tenant <name>]\n                                      rotate; --force ends outstanding links and run tokens\n  signing-keys revoke <kid> [--tenant <name>]\n                                      revoke a previous or standby key\n  models catalog [--tenant <name>] [--json]\n                                      every provider and model the Runtime knows\n  models providers [--tenant <name>] [--json]\n                                      the providers with a credential, and the one in use\n  models get [--tenant <name>] [--json]\n                                      the Tenant's model\n  models set [--tenant <name>]        sign in to a model provider and set the Tenant's model\n  models set --provider <id> --model <id> [--base-url <url>] [--tenant <name>]\n                                      the same with an API key piped in on stdin (CI)\n  models select <provider> [--model <id>] [--tenant <name>]\n                                      use a provider that has a credential (default: its model)\n  usage [--scope tenant|agent|turn] [--id <id>] [--period day|month|total] [--tenant <name>]\n                                      what the model calls used and cost (JSON)\n  calls [--after <cursor>] [--limit <n>] [--tenant <name>]\n                                      every recorded model call, one JSON line each, until\n                                      caught up; prints the cursor to resume from on stderr\n  budgets [get | put <file|->] [--tenant <name>]\n                                      the model spend caps; put replaces them all\n  tool-policy [get | put <file|->] [--tenant <name>]\n                                      the Tool Gate's rules; put replaces them all\n  settings sandbox [get | put <file|->] [--tenant <name>]\n                                      the Environment settings: limits, stop grace, placement\n  settings artifacts [get | put <file|->] [--tenant <name>]\n                                      the artifact store's limits\n  coverage --agent <id> [--environment <id>] [--tenant <name>] [--json]\n                                      which secret of the Environment each of the agent's MCP\n                                      servers and HTTP tools would get\n  mcp inspect <url> [--server <name>] [--environment <id>] [--sse] [--tenant <name>] [--json]\n                                      list a remote MCP server's tools, with Environment <id>'s\n                                      credential for <url> (none without it): model names, schema\n                                      sizes, renames, or that it needs a person's sign-in (the\n                                      Runtime calls no tool)\n\nA put reads a JSON body from a file, or from stdin for -, and replaces the whole document; what\nbudgets, tool-policy and settings artifacts get print, put takes back. An API key is read from\nstdin, never from the arguments.";
+export declare const tenantUsage = "nylorun tenant <command>\n\nThe Management API of the installation's one Tenant, with a management key: the local Tenant\n--tenant names (else the linked project's, else the default one), or the installation that\nNYLORUN_RUNTIME_URL and NYLORUN_MANAGEMENT_KEY name.\n\n  reset [--sessions|--agents|--all] [--yes] [--tenant <name>]\n                                      clear the Tenant's sessions, its Agents (their vaults,\n                                      disks and sessions) or all its data (the Project link and\n                                      keys stay)\n  keys put <id> [--management] [--tenant <name>]\n                                      create the Tenant's application key <id> (--management: a\n                                      management key, on the Runtime's machine only), or rotate it\n                                      (the old key stops working); prints the key once\n  keys list [--tenant <name>] [--json]\n                                      the Tenant's keys: id, role, when issued (never the keys)\n  keys rm <id> [--tenant <name>]      delete key <id>: it stops working at once\n  signing-keys list [--tenant <name>]\n                                      the Tenant's token signing keys\n  signing-keys rotate [--force] [--tenant <name>]\n                                      rotate; --force ends outstanding links and run tokens\n  signing-keys revoke <kid> [--tenant <name>]\n                                      revoke a previous or standby key\n  models catalog [--tenant <name>] [--json]\n                                      every provider and model the Runtime knows\n  models providers [--tenant <name>] [--json]\n                                      the providers with a credential, and the one in use\n  models get [--tenant <name>] [--json]\n                                      the Tenant's model\n  models set [--tenant <name>]        sign in to a model provider and set the Tenant's model\n  models set --provider <id> --model <id> [--base-url <url>] [--tenant <name>]\n                                      the same with an API key piped in on stdin (CI)\n  models select <provider> [--model <id>] [--tenant <name>]\n                                      use a provider that has a credential (default: its model)\n  usage [--scope tenant|manifest|turn] [--id <id>] [--period day|month|total] [--tenant <name>]\n                                      what the model calls used and cost (JSON); --scope\n                                      manifest: the Agents made from agent manifest <id>\n  calls [--after <cursor>] [--limit <n>] [--tenant <name>]\n                                      every recorded model call, one JSON line each, until\n                                      caught up; prints the cursor to resume from on stderr\n  budgets [get | put <file|->] [--tenant <name>]\n                                      the model spend caps (scope tenant, manifest with id an\n                                      agent manifest's name, or turn); put replaces them all\n  tool-policy [get | put <file|->] [--tenant <name>]\n                                      the Tool Gate's rules; put replaces them all\n  settings sandbox [get | put <file|->] [--tenant <name>]\n                                      the Agents' environments: limits, stop grace, placement\n  settings artifacts [get | put <file|->] [--tenant <name>]\n                                      the artifact store's limits\n  settings skills [get | put <file|->] [--tenant <name>]\n                                      the most bytes one skill may hold\n  settings limits [get | put <file|->] [--tenant <name>]\n                                      the Runtime limits: sizes, counts and deadlines (record\n                                      entries, request bodies, Agents, model calls, tools)\n  coverage --agent <id> [--tenant <name>] [--json]\n                                      which secret of Agent <id>'s vault each MCP server and\n                                      HTTP tool of its manifest would get\n  mcp inspect <url> [--server <name>] [--agent <id>] [--sse] [--tenant <name>] [--json]\n                                      list a remote MCP server's tools, with Agent <id>'s\n                                      credential for <url> (none without it): model names, schema\n                                      sizes, renames, or that it needs a person's sign-in (the\n                                      Runtime calls no tool)\n\nA put reads a JSON body from a file, or from stdin for -, and replaces the whole document; what\nbudgets, tool-policy, settings artifacts, settings skills and settings limits get print, put takes back. An API key is read from\nstdin, never from the arguments.";
 /** The Management API client of the installation `--tenant` (or the environment) names. */
 export declare function tenantClient(deps: StackDeps, tenant: string | undefined): Promise<{
     connection: Connection;

package/dist/client/tenant.js

@@ -13,9 +13,10 @@ The Management API of the installation's one Tenant, with a management key: the
 --tenant names (else the linked project's, else the default one), or the installation that
 NYLORUN_RUNTIME_URL and NYLORUN_MANAGEMENT_KEY name.
 
-  reset [--sessions|--environments|--all] [--yes] [--tenant <name>]
-                                      clear the Tenant's sessions, Environments or all its data
-                                      (the Project link and keys stay)
+  reset [--sessions|--agents|--all] [--yes] [--tenant <name>]
+                                      clear the Tenant's sessions, its Agents (their vaults,
+                                      disks and sessions) or all its data (the Project link and
+                                      keys stay)
 ${keyUsage}
 ${signingKeysUsage}
 ${modelsUsage}
@@ -24,7 +25,7 @@ ${settingsUsage}
 ${mcpUsage}
 
 A put reads a JSON body from a file, or from stdin for -, and replaces the whole document; what
-budgets, tool-policy and settings artifacts get print, put takes back. An API key is read from
+budgets, tool-policy, settings artifacts, settings skills and settings limits get print, put takes back. An API key is read from
 stdin, never from the arguments.`;
 const usageError = (message) => new CliError(message, 2);
 /** The Management API client of the installation `--tenant` (or the environment) names. */
@@ -64,16 +65,18 @@ export async function remoteStatus(deps, args) {
     deps.out(`sandbox  ${body.sandbox.backend ?? "none"}`);
     return 0;
 }
-const RESET_USAGE = "nylorun tenant reset [--sessions|--environments|--all] [--yes] [--tenant <name>]";
-const SCOPES = { "--sessions": "sessions", "--environments": "environments", "--all": "all" };
+const RESET_USAGE = "nylorun tenant reset [--sessions|--agents|--all] [--yes] [--tenant <name>]";
+const SCOPES = { "--sessions": "sessions", "--agents": "agents", "--all": "all" };
 /** `nylorun tenant reset`; `--all` asks first. */
 async function reset(deps, args) {
+    if (args.includes("--environments"))
+        throw usageError("--environments is --agents in protocol 16: Environments are Agents. Pass --agents.");
     const flags = parseStackFlags(args, { booleans: ["--yes", ...Object.keys(SCOPES)], values: ["--tenant"], aliases: { "-y": "--yes" } }, RESET_USAGE);
     if (flags.rest.length)
         throw usageError(`Usage: ${RESET_USAGE}`);
     const chosen = Object.keys(SCOPES).filter((flag) => flags.booleans.has(flag));
     if (chosen.length > 1)
-        throw usageError("Pass only one of --sessions, --environments, --all.");
+        throw usageError("Pass only one of --sessions, --agents, --all.");
     const scope = chosen.length ? SCOPES[chosen[0]] : "sessions";
     const { connection, admin } = await tenantClient(deps, flags.values.get("--tenant"));
     if (scope === "all" && !flags.booleans.has("--yes")) {

package/dist/project/seed.js

@@ -3,6 +3,7 @@ import { readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { parseEnv } from "node:util";
 import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "@nylorun/core/compatibility";
+import { cliTuning } from "../tuning.js";
 /**
  * The Project's `.env` as a value map. It is never applied to this process or written back:
  * a Project's `.env` never configures the Host.
@@ -56,7 +57,7 @@ async function call(fetch, url, managementKey, init = {}) {
         },
         ...(init.body === undefined ? {} : { body: JSON.stringify(init.body) }),
         redirect: "error",
-        signal: AbortSignal.timeout(15_000),
+        signal: AbortSignal.timeout(cliTuning().stack.seedRequestMs),
     });
     const body = (await response.json().catch(() => ({})));
     if (!response.ok)

package/dist/sandbox/commands.js

@@ -10,6 +10,7 @@ import { apiRoute, readClusterFile, removeClusterFiles, writeClusterFiles, } fro
 import { contexts, kube } from "./kubectl.js";
 import { CONTROLLER_DEPLOYMENT, CONTROLLER_NAMESPACE, CONTROLLER_SHA256, CONTROLLER_URL, CONTROLLER_VERSION, networkPolicy, SANDBOX_API_VERSION, SANDBOX_CRD, tenantLabel, tenantManifests, tenantNamespace, TOKEN_SECRET, } from "./manifests.js";
 import { assertIPv4, runProbe } from "./probe.js";
+import { cliTuning } from "../tuning.js";
 export const sandboxUsage = `  sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]
                                       run the Tenant's sandboxes as pods on that kubeconfig context (agent-sandbox ${CONTROLLER_VERSION})
   sandbox disable [--tenant <name>] [--delete-namespace]
@@ -52,7 +53,7 @@ async function ensureController(k, fetch, err) {
         return;
     }
     err(`Installing agent-sandbox ${CONTROLLER_VERSION} into ${k.context}.`);
-    const response = await fetch(CONTROLLER_URL, { signal: AbortSignal.timeout(60_000) });
+    const response = await fetch(CONTROLLER_URL, { signal: AbortSignal.timeout(cliTuning().sandbox.manifestDownloadMs) });
     if (!response.ok)
         throw new CliError(`Downloading ${CONTROLLER_URL} failed (HTTP ${response.status}).`, 1);
     const manifest = await response.text();
@@ -60,12 +61,13 @@ async function ensureController(k, fetch, err) {
     if (digest !== CONTROLLER_SHA256)
         throw new CliError(`${CONTROLLER_URL} has sha256 ${digest}, not the pinned ${CONTROLLER_SHA256}; not applying it.`, 1);
     await k.check("Installing agent-sandbox", ["apply", "--server-side", "-f", "-"], { input: manifest });
-    await k.check("Waiting for the Sandbox CRD", ["wait", "--for=condition=Established", `crd/${SANDBOX_CRD}`, "--timeout=60s"]);
-    await k.check("Waiting for the agent-sandbox controller", ["rollout", "status", `deployment/${CONTROLLER_DEPLOYMENT}`, "-n", CONTROLLER_NAMESPACE, "--timeout=180s"], { timeoutMs: 200_000 });
+    await k.check("Waiting for the Sandbox CRD", ["wait", "--for=condition=Established", `crd/${SANDBOX_CRD}`, `--timeout=${cliTuning().sandbox.crdWaitSeconds}s`]);
+    const tuning = cliTuning().sandbox;
+    await k.check("Waiting for the agent-sandbox controller", ["rollout", "status", `deployment/${CONTROLLER_DEPLOYMENT}`, "-n", CONTROLLER_NAMESPACE, `--timeout=${tuning.rolloutWaitSeconds}s`], { timeoutMs: tuning.rolloutWaitSeconds * 1000 + tuning.kubectlMarginMs });
 }
 /** The ServiceAccount token the token controller writes into the Secret. */
 async function serviceAccountToken(k, namespace, pollMs) {
-    const deadline = Date.now() + 60_000;
+    const deadline = Date.now() + cliTuning().sandbox.tokenWaitMs;
     for (;;) {
         const secret = await k.getJson(["secret", TOKEN_SECRET, "-n", namespace]);
         if (secret?.data?.token)
@@ -82,7 +84,7 @@ async function serviceAccountToken(k, namespace, pollMs) {
 export async function installCluster(deps, input) {
     const { stack } = deps;
     const k = kube(deps.kubectl, input.context);
-    const pollMs = deps.pollMs ?? 1000;
+    const pollMs = deps.pollMs ?? cliTuning().sandbox.pollMs;
     const { server, caData } = await readKubeconfig(k);
     let route;
     try {
@@ -189,7 +191,7 @@ async function enable(deps, args) {
         bind: installed.cluster.bindAddress,
     };
     await restartTenant(stack, { name: tenant.name, sandboxes: settings });
-    const ready = await stack.docker.stream(tenant.compose("up", "--detach", "--wait", "--wait-timeout", "120", "sandboxes"));
+    const ready = await stack.docker.stream(tenant.compose("up", "--detach", "--wait", "--wait-timeout", String(cliTuning().sandbox.composeWaitSeconds), "sandboxes"));
     if (ready !== 0)
         throw new CliError(`The sandboxes service did not become ready (image ${images.sandboxes}). See "nylorun local logs sandboxes" and "nylorun local sandbox status".`, 7);
     const c = installed.cluster;
@@ -226,7 +228,7 @@ async function disable(deps, args) {
     return 0;
 }
 /** Asks the sandboxes service from inside the runtime container, which holds the token. */
-const INFO_SCRIPT = "fetch(process.env.NYLORUN_SANDBOXES_URL+'/v1/info',{headers:{authorization:'Bearer '+process.env.NYLORUN_SANDBOXES_TOKEN},signal:AbortSignal.timeout(5000)}).then(async r=>{process.stdout.write(await r.text());process.exit(r.ok?0:1)},()=>process.exit(1))";
+const infoScript = (timeoutMs) => `fetch(process.env.NYLORUN_SANDBOXES_URL+'/v1/info',{headers:{authorization:'Bearer '+process.env.NYLORUN_SANDBOXES_TOKEN},signal:AbortSignal.timeout(${timeoutMs})}).then(async r=>{process.stdout.write(await r.text());process.exit(r.ok?0:1)},()=>process.exit(1))`;
 async function status(deps, args) {
     const { stack } = deps;
     const usage = "nylorun local sandbox status [--tenant <name>] [--json]";
@@ -245,7 +247,7 @@ async function status(deps, args) {
     }
     await dockerPreflight(stack.docker);
     const ready = (await stack.docker.run(tenant.compose("exec", "-T", "sandboxes", "/sandboxes", "healthcheck"))).code === 0;
-    const answer = await stack.docker.run(tenant.compose("exec", "-T", "runtime", "node", "-e", INFO_SCRIPT));
+    const answer = await stack.docker.run(tenant.compose("exec", "-T", "runtime", "node", "-e", infoScript(cliTuning().sandbox.infoRequestMs)));
     let info;
     try {
         info = answer.code === 0 ? JSON.parse(answer.stdout) : undefined;

package/dist/sandbox/kubectl.js

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { CliError } from "../errors.js";
+import { cliTuning } from "../tuning.js";
 /** The real `kubectl` on PATH. */
 export function spawnKubectl(env, binary = "kubectl") {
     const childEnv = Object.fromEntries(Object.entries(env).filter((entry) => entry[1] !== undefined));
@@ -9,7 +10,7 @@ export function spawnKubectl(env, binary = "kubectl") {
                 let stdout = "";
                 let stderr = "";
                 const child = spawn(binary, [...args], { env: childEnv, stdio: ["pipe", "pipe", "pipe"] });
-                const timer = setTimeout(() => child.kill("SIGKILL"), options.timeoutMs ?? 300_000);
+                const timer = setTimeout(() => child.kill("SIGKILL"), options.timeoutMs ?? cliTuning().sandbox.kubectlTimeoutMs);
                 child.stdout.on("data", (chunk) => (stdout += chunk));
                 child.stderr.on("data", (chunk) => (stderr += chunk));
                 child.once("error", (error) => {

package/dist/sandbox/manifests.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { cliTuning } from "../tuning.js";
 /**
  * What `nylorun local sandbox enable` installs into a cluster. The agent-sandbox controller is
  * pinned (D32, Experiment 2): v1.0.5, API agents.x-k8s.io/v1beta1, its release manifest
@@ -119,7 +120,7 @@ export function probePod(namespace, name, options) {
         spec: {
             automountServiceAccountToken: false,
             enableServiceLinks: false,
-            terminationGracePeriodSeconds: 1,
+            terminationGracePeriodSeconds: cliTuning().sandbox.probeGraceSeconds,
             restartPolicy: options.command ? "Never" : "Always",
             ...(options.nodeName ? { nodeName: options.nodeName } : {}),
             securityContext: { runAsNonRoot: true, runAsUser: 1000, seccompProfile: { type: "RuntimeDefault" } },
@@ -130,7 +131,7 @@ export function probePod(namespace, name, options) {
                     imagePullPolicy: "IfNotPresent",
                     command,
                     securityContext: { allowPrivilegeEscalation: false, capabilities: { drop: ["ALL"] } },
-                    resources: { limits: { cpu: "200m", memory: "64Mi" } },
+                    resources: { limits: { cpu: cliTuning().sandbox.probeCpu, memory: cliTuning().sandbox.probeMemory } },
                 },
             ],
         },

package/dist/sandbox/probe.js

@@ -1,6 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { CliError } from "../errors.js";
 import { networkPolicy, PROBE_IMAGE, probePod } from "./manifests.js";
+import { cliTuning } from "../tuning.js";
 const DOCKER_DESKTOP_HOST = "192.168.65.254";
 /** Docker Desktop and OrbStack forward the host address to this machine's loopback. */
 export function defaultBind(context, hostAddress) {
@@ -27,7 +28,7 @@ async function sleep(ms) {
 }
 /** `wget` from a probe pod; true when the connection succeeds. */
 async function reaches(kube, namespace, pod, address, port) {
-    const result = await kube.run(["exec", "-n", namespace, pod, "--", "wget", "-q", "-O", "-", "-T", "3", `http://${address}:${port}/`], { timeoutMs: 20_000 });
+    const result = await kube.run(["exec", "-n", namespace, pod, "--", "wget", "-q", "-O", "-", "-T", String(cliTuning().sandbox.probeWgetSeconds), `http://${address}:${port}/`], { timeoutMs: cliTuning().sandbox.probeExecMs });
     return result.code === 0;
 }
 export async function runProbe(deps, options) {
@@ -35,7 +36,8 @@ export async function runProbe(deps, options) {
     const suffix = randomBytes(3).toString("hex");
     const namespace = `nylorun-sbx-probe-${suffix}`;
     const listener = namespace;
-    const poll = deps.pollMs ?? 1000;
+    const tuning = cliTuning().sandbox;
+    const poll = deps.pollMs ?? tuning.pollMs;
     let listenerStarted = false;
     const fail = (message) => new CliError(`Refusing context ${kube.context}: ${message}`, 6);
     try {
@@ -46,8 +48,8 @@ export async function runProbe(deps, options) {
             probePod(namespace, "restricted", { role: "restricted" }),
         ]);
         await kube.check("Waiting for the probe pods", [
-            "wait", "--for=condition=Ready", "pod", "--all", "-n", namespace, "--timeout=180s",
-        ], { timeoutMs: 200_000 });
+            "wait", "--for=condition=Ready", "pod", "--all", "-n", namespace, `--timeout=${tuning.probeReadySeconds}s`,
+        ], { timeoutMs: tuning.probeReadySeconds * 1000 + tuning.kubectlMarginMs });
         let hostAddress = options.hostAddress;
         if (!hostAddress) {
             const lookup = await kube.run(["exec", "-n", namespace, "control", "--", "nslookup", "host.docker.internal"]);
@@ -80,7 +82,7 @@ export async function runProbe(deps, options) {
         await kube.apply("Applying the probe NetworkPolicy", [
             networkPolicy(namespace, hostAddress, [allowed], { name: "probe", podSelector: { "nylorun.dev/probe": "restricted" } }),
         ]);
-        const deadline = Date.now() + (deps.policyTimeoutMs ?? 30_000);
+        const deadline = Date.now() + (deps.policyTimeoutMs ?? tuning.policyTimeoutMs);
         while (await reaches(kube, namespace, "restricted", peer, 8080)) {
             if (Date.now() > deadline)
                 throw fail("NetworkPolicy is not enforced: a pod under a deny policy still reached another pod. Sandboxes need a CNI that enforces NetworkPolicy (kindnet with policy support, Calico, Cilium).");
@@ -117,7 +119,7 @@ async function prePull(deps, namespace, images) {
     await kube.apply("Pre-pulling images", pods.map((pod) => pod.manifest));
     const failed = new Set();
     const done = new Set();
-    const deadline = Date.now() + 300_000;
+    const deadline = Date.now() + cliTuning().sandbox.prepullMs;
     while (done.size + failed.size < pods.length && Date.now() < deadline) {
         const list = await kube.getJson(["pods", "-n", namespace, "-l", "nylorun.dev/probe=pull"]);
         for (const item of list?.items ?? []) {
@@ -131,7 +133,7 @@ async function prePull(deps, namespace, images) {
                 done.add(pod.name);
         }
         if (done.size + failed.size < pods.length)
-            await sleep(deps.pollMs ?? 2000);
+            await sleep(deps.pollMs ?? cliTuning().sandbox.prepullPollMs);
     }
     return images.filter((image) => pods.some((pod) => pod.image === image && !done.has(pod.name)));
 }

package/dist/stack/commands.js

@@ -15,6 +15,7 @@ import { prepareStack, readStackEnv } from "./prepare.js";
 import { assertTenantName, chooseTenantName, DEFAULT_TENANT, defaultNylorunRoot, listTenants, moveStackRoots, readTenantRecord, removeOldProxy, sanitizeTenantName, tenantRoot, tenantsDir, writeTenantRecord, } from "./stacks.js";
 import { mintStudioLogin, studioOrigin } from "./studio-login.js";
 import { CLI_KEY_ID, hostKey, keyAuthenticates, PROJECT_KEY_ID, } from "./operator-keys.js";
+import { cliTuning } from "../tuning.js";
 export const STACK_SERVICES = [
     "postgres",
     "restate",
@@ -199,7 +200,7 @@ async function sleep(ms) {
 async function fetchHealth(deps, runtimeUrl) {
     try {
         const response = await deps.fetch(`${runtimeUrl}/health`, {
-            signal: AbortSignal.timeout(3000),
+            signal: AbortSignal.timeout(cliTuning().stack.probeTimeoutMs),
             redirect: "error",
         });
         if (!response.ok)
@@ -211,7 +212,7 @@ async function fetchHealth(deps, runtimeUrl) {
     }
 }
 async function waitForHealth(ctx, runtimeUrl, hostId) {
-    const deadline = Date.now() + (ctx.deps.healthTimeoutMs ?? 60_000);
+    const deadline = Date.now() + (ctx.deps.healthTimeoutMs ?? cliTuning().stack.healthWaitMs);
     for (;;) {
         const health = await fetchHealth(ctx.deps, runtimeUrl);
         if (health?.status === "ok") {
@@ -221,7 +222,7 @@ async function waitForHealth(ctx, runtimeUrl, hostId) {
         }
         if (Date.now() > deadline)
             throw new CliError(`The Runtime did not answer ${runtimeUrl}/health. See "nylorun local logs runtime".`, 7);
-        await sleep(ctx.deps.pollMs ?? 500);
+        await sleep(ctx.deps.pollMs ?? cliTuning().stack.pollMs);
     }
 }
 /** The Runtime's `/ready` (503 while not ready, same body); undefined when it does not answer. */
@@ -229,7 +230,7 @@ async function fetchReady(deps, runtimeUrl) {
     try {
         const response = await deps.fetch(`${runtimeUrl}/ready`, {
             headers: { accept: "application/json" },
-            signal: AbortSignal.timeout(3000),
+            signal: AbortSignal.timeout(cliTuning().stack.probeTimeoutMs),
             redirect: "error",
         });
         const body = (await response.json());
@@ -289,11 +290,11 @@ function tenantCauseMessage(ctx, tenant) {
  * Tenant cannot open (`schema-too-new`, `database-layout-old`), which ends the wait.
  */
 async function waitForTenant(ctx, runtimeUrl) {
-    const deadline = Date.now() + (ctx.deps.healthTimeoutMs ?? 60_000);
+    const deadline = Date.now() + (ctx.deps.healthTimeoutMs ?? cliTuning().stack.tenantWaitMs);
     for (let poll = 1;; poll += 1) {
         const open = (await fetchReady(ctx.deps, runtimeUrl))?.tenant === true;
         const late = Date.now() > deadline;
-        if (open || late || poll % 10 === 0) {
+        if (open || late || poll % cliTuning().stack.operateEveryPolls === 0) {
             const tenant = await operateStatus(ctx);
             if (tenant?.state === "open" && tenant.id)
                 return { ...tenant, id: tenant.id };
@@ -302,7 +303,7 @@ async function waitForTenant(ctx, runtimeUrl) {
             if (late)
                 throw new CliError(`Tenant ${ctx.name} did not open (${runtimeUrl}/ready: ${open ? "open, but nylorun-operate status did not answer" : "not open"})${tenant?.message ? `: ${tenant.message.replace(/\.$/, "")}` : ""}. See "nylorun status" and "nylorun local logs runtime".`, 7);
         }
-        await sleep(ctx.deps.pollMs ?? 500);
+        await sleep(ctx.deps.pollMs ?? cliTuning().stack.pollMs);
     }
 }
 /**
@@ -427,7 +428,7 @@ async function bringUp(ctx, options) {
     const up = await deps.docker.stream(
     // --remove-orphans: a service this start's file no longer has (the harness after a rollback
     // to NYLORUN_HARNESS=in-process, sandboxes after disable) is removed, not left running.
-    composeArgs(ctx, "up", "--detach", "--wait", "--wait-timeout", "300", "--remove-orphans", ...coreServices(prepared.env.harness)));
+    composeArgs(ctx, "up", "--detach", "--wait", "--wait-timeout", String(cliTuning().stack.composeWaitSeconds), "--remove-orphans", ...coreServices(prepared.env.harness)));
     if (up !== 0) {
         // A Runtime whose Tenant cannot open fails readiness; nylorun-operate names the cause.
         const tenant = await operateStatus(ctx);
@@ -444,7 +445,7 @@ async function bringUp(ctx, options) {
     }
     let studioStarted = false;
     if (options.studio) {
-        const studio = await deps.docker.stream(composeArgs(ctx, "up", "--detach", "--wait", "--wait-timeout", "120", "studio"));
+        const studio = await deps.docker.stream(composeArgs(ctx, "up", "--detach", "--wait", "--wait-timeout", String(cliTuning().stack.studioWaitSeconds), "studio"));
         studioStarted = studio === 0;
         if (!studioStarted)
             deps.err(`Warning: Studio did not start (image ${prepared.env.studioImage}). The Runtime is up; see "nylorun local logs studio".`);
@@ -466,7 +467,7 @@ const errorText = (error) => (error instanceof Error ? error.message : String(er
 async function tryStudioLogin(ctx, studioPort, adminKey) {
     const { deps } = ctx;
     const origin = studioOrigin(studioPort);
-    const deadline = Date.now() + (deps.loginTimeoutMs ?? 15_000);
+    const deadline = Date.now() + (deps.loginTimeoutMs ?? cliTuning().stack.loginWaitMs);
     let lastError = "";
     for (;;) {
         try {
@@ -477,7 +478,7 @@ async function tryStudioLogin(ctx, studioPort, adminKey) {
         }
         if (Date.now() > deadline)
             break;
-        await sleep(deps.pollMs ?? 500);
+        await sleep(deps.pollMs ?? cliTuning().stack.pollMs);
     }
     deps.err(`Warning: Studio at ${origin} is not reachable for a login (${lastError}).`);
     return undefined;