nylorun 0.19.0-beta → 0.21.0-beta

package/dist/client/plan-diff.js

@@ -0,0 +1,86 @@
+/** The most diff lines one change prints. */
+const MAX_LINES = 40;
+/** Instructions as text: a string, or each block of an array, a blank line between. */
+function textOf(value) {
+    if (value === undefined)
+        return "";
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value) && value.every((item) => typeof item === "string"))
+        return value.join("\n\n");
+    return undefined;
+}
+/**
+ * The lines that differ between `before` and `after`, in order: `- line` for a removed one and
+ * `+ line` for an added one, with `…` between changes that are apart. A longest common
+ * subsequence of lines, so a moved block shows as removed and added.
+ */
+export function lineDiff(before, after) {
+    const a = before === "" ? [] : before.split("\n");
+    const b = after === "" ? [] : after.split("\n");
+    // Lines both start and end with stay out of the table.
+    let start = 0;
+    while (start < a.length && start < b.length && a[start] === b[start])
+        start += 1;
+    let endA = a.length;
+    let endB = b.length;
+    while (endA > start && endB > start && a[endA - 1] === b[endB - 1]) {
+        endA -= 1;
+        endB -= 1;
+    }
+    const x = a.slice(start, endA);
+    const y = b.slice(start, endB);
+    const ops = [];
+    if (x.length * y.length > 4_000_000) {
+        ops.push(...x.map((line) => ({ op: "-", line })), ...y.map((line) => ({ op: "+", line })));
+    }
+    else {
+        // lengths[i][j]: the longest common subsequence of x[i..] and y[j..].
+        const lengths = Array.from({ length: x.length + 1 }, () => new Uint32Array(y.length + 1));
+        for (let i = x.length - 1; i >= 0; i -= 1)
+            for (let j = y.length - 1; j >= 0; j -= 1)
+                lengths[i][j] = x[i] === y[j] ? lengths[i + 1][j + 1] + 1 : Math.max(lengths[i + 1][j], lengths[i][j + 1]);
+        let i = 0;
+        let j = 0;
+        while (i < x.length || j < y.length) {
+            if (i < x.length && j < y.length && x[i] === y[j]) {
+                ops.push({ op: "=", line: x[i] });
+                i += 1;
+                j += 1;
+            }
+            else if (i < x.length && (j === y.length || lengths[i + 1][j] >= lengths[i][j + 1])) {
+                ops.push({ op: "-", line: x[i] });
+                i += 1;
+            }
+            else {
+                ops.push({ op: "+", line: y[j] });
+                j += 1;
+            }
+        }
+    }
+    const lines = [];
+    let gap = false;
+    for (const { op, line } of ops) {
+        if (op === "=") {
+            gap = lines.length > 0;
+            continue;
+        }
+        if (gap)
+            lines.push("…");
+        gap = false;
+        lines.push(`${op} ${line}`.trimEnd());
+    }
+    return lines;
+}
+/** The diff lines to print under one of a plan's changes: the instructions' text, else none. */
+export function changeDiffLines(change, indent = "    ") {
+    if (change.section !== "harness" || change.path !== "instructions")
+        return [];
+    const before = textOf(change.from);
+    const after = textOf(change.to);
+    if (before === undefined || after === undefined)
+        return [];
+    const lines = lineDiff(before, after);
+    const shown = lines.length > MAX_LINES ? [...lines.slice(0, MAX_LINES), `… ${lines.length - MAX_LINES} more lines`] : lines;
+    return shown.map((line) => `${indent}${line}`);
+}

package/dist/client/tenant.d.ts

@@ -6,7 +6,7 @@
 import type { ManagementClient } from "@nylorun/admin";
 import { type StackDeps } from "../stack/commands.js";
 import { type Connection } from "./target.js";
-export declare const tenantUsage = "nylorun tenant <command>\n\nThe Management API of the installation's one Tenant, with a management key: the local Tenant\n--tenant names (else the linked project's, else the default one), or the installation that\nNYLORUN_RUNTIME_URL and NYLORUN_MANAGEMENT_KEY name.\n\n  reset [--sessions|--agents|--all] [--yes] [--tenant <name>]\n                                      clear the Tenant's sessions, its Agents (their vaults,\n                                      disks and sessions) or all its data (the Project link and\n                                      keys stay)\n  keys put <id> [--management] [--tenant <name>]\n                                      create the Tenant's application key <id> (--management: a\n                                      management key, on the Runtime's machine only), or rotate it\n                                      (the old key stops working); prints the key once\n  keys list [--tenant <name>] [--json]\n                                      the Tenant's keys: id, role, when issued (never the keys)\n  keys rm <id> [--tenant <name>]      delete key <id>: it stops working at once\n  signing-keys list [--tenant <name>]\n                                      the Tenant's token signing keys\n  signing-keys rotate [--force] [--tenant <name>]\n                                      rotate; --force ends outstanding links and run tokens\n  signing-keys revoke <kid> [--tenant <name>]\n                                      revoke a previous or standby key\n  models catalog [--tenant <name>] [--json]\n                                      every provider and model the Runtime knows\n  models providers [--tenant <name>] [--json]\n                                      the providers with a credential, and the one in use\n  models get [--tenant <name>] [--json]\n                                      the Tenant's model\n  models set [--tenant <name>]        sign in to a model provider and set the Tenant's model\n  models set --provider <id> --model <id> [--base-url <url>] [--tenant <name>]\n                                      the same with an API key piped in on stdin (CI)\n  models select <provider> [--model <id>] [--tenant <name>]\n                                      use a provider that has a credential (default: its model)\n  usage [--scope tenant|manifest|turn] [--id <id>] [--period day|month|total] [--tenant <name>]\n                                      what the model calls used and cost (JSON); --scope\n                                      manifest: the Agents made from agent manifest <id>\n  calls [--after <cursor>] [--limit <n>] [--tenant <name>]\n                                      every recorded model call, one JSON line each, until\n                                      caught up; prints the cursor to resume from on stderr\n  budgets [get | put <file|->] [--tenant <name>]\n                                      the model spend caps (scope tenant, manifest with id an\n                                      agent manifest's name, or turn); put replaces them all\n  tool-policy [get | put <file|->] [--tenant <name>]\n                                      the Tool Gate's rules; put replaces them all\n  settings sandbox [get | put <file|->] [--tenant <name>]\n                                      the Agents' environments: limits, stop grace, placement\n  settings artifacts [get | put <file|->] [--tenant <name>]\n                                      the artifact store's limits\n  settings skills [get | put <file|->] [--tenant <name>]\n                                      the most bytes one skill may hold\n  settings limits [get | put <file|->] [--tenant <name>]\n                                      the Runtime limits: sizes, counts and deadlines (record\n                                      entries, request bodies, Agents, model calls, tools)\n  coverage --agent <id> [--tenant <name>] [--json]\n                                      which secret of Agent <id>'s vault each MCP server and\n                                      HTTP tool of its manifest would get\n  mcp inspect <url> [--server <name>] [--agent <id>] [--sse] [--tenant <name>] [--json]\n                                      list a remote MCP server's tools, with Agent <id>'s\n                                      credential for <url> (none without it): model names, schema\n                                      sizes, renames, or that it needs a person's sign-in (the\n                                      Runtime calls no tool)\n\nA put reads a JSON body from a file, or from stdin for -, and replaces the whole document; what\nbudgets, tool-policy, settings artifacts, settings skills and settings limits get print, put takes back. An API key is read from\nstdin, never from the arguments.";
+export declare const tenantUsage = "nylorun tenant <command>\n\nThe Management API of the installation's one Tenant, with a management key: the local Tenant\n--tenant names (else the linked project's, else the default one), or the installation that\nNYLORUN_RUNTIME_URL and NYLORUN_MANAGEMENT_KEY name.\n\n  reset [--sessions|--agents|--all] [--yes] [--tenant <name>]\n                                      clear the Tenant's sessions, its Agents (their vaults,\n                                      disks and sessions) or all its data (the Project link and\n                                      keys stay)\n  keys put <id> [--management] [--tenant <name>]\n                                      create the Tenant's application key <id> (--management: a\n                                      management key, on the Runtime's machine only), or rotate it\n                                      (the old key stops working); prints the key once\n  keys list [--tenant <name>] [--json]\n                                      the Tenant's keys: id, role, when issued (never the keys)\n  keys rm <id> [--tenant <name>]      delete key <id>: it stops working at once\n  signing-keys list [--tenant <name>]\n                                      the Tenant's token signing keys\n  signing-keys rotate [--force] [--tenant <name>]\n                                      rotate; --force ends outstanding links and run tokens\n  signing-keys revoke <kid> [--tenant <name>]\n                                      revoke a previous or standby key\n  models catalog [--tenant <name>] [--json]\n                                      every provider and model the Runtime knows\n  models providers [--tenant <name>] [--json]\n                                      the providers with a credential, and the one in use\n  models get [--tenant <name>] [--json]\n                                      the Tenant's model\n  models set [--tenant <name>]        sign in to a model provider and set the Tenant's model\n  models set --provider <id> --model <id> [--base-url <url>] [--tenant <name>]\n                                      the same with an API key piped in on stdin (CI)\n  models set --provider google-vertex --model <id> --host-identity --project <id> --location <location> [--tenant <name>]\n                                      the same with the Host's Google identity, no key: on a Host\n                                      whose operator sets NYLORUN_MODEL_HOST_IDENTITY\n  models select <provider> [--model <id>] [--tenant <name>]\n                                      use a provider that has a credential (default: its model)\n  usage [--scope tenant|manifest|turn] [--id <id>] [--period day|month|total] [--tenant <name>]\n                                      what the model calls used and cost (JSON); --scope\n                                      manifest: the Agents made from agent manifest <id>\n  calls [--after <cursor>] [--limit <n>] [--tenant <name>]\n                                      every recorded model call, one JSON line each, until\n                                      caught up; prints the cursor to resume from on stderr\n  budgets [get | put <file|->] [--tenant <name>]\n                                      the model spend caps (scope tenant, manifest with id an\n                                      agent manifest's name, or turn); put replaces them all\n  tool-policy [get | put <file|->] [--tenant <name>]\n                                      the Tool Gate's rules; put replaces them all\n  settings sandbox [get | put <file|->] [--tenant <name>]\n                                      the Agents' environments: limits, stop grace, placement\n  settings artifacts [get | put <file|->] [--tenant <name>]\n                                      the artifact store's limits\n  settings skills [get | put <file|->] [--tenant <name>]\n                                      the most bytes one skill may hold\n  settings limits [get | put <file|->] [--tenant <name>]\n                                      the Runtime limits: sizes, counts and deadlines (record\n                                      entries, request bodies, Agents, model calls, tools)\n  coverage --agent <id> [--tenant <name>] [--json]\n                                      which secret of Agent <id>'s vault each MCP server and\n                                      HTTP tool of its manifest would get\n  mcp inspect <url> [--server <name>] [--agent <id>] [--sse] [--tenant <name>] [--json]\n                                      list a remote MCP server's tools, with Agent <id>'s\n                                      credential for <url> (none without it): model names, schema\n                                      sizes, renames, or that it needs a person's sign-in (the\n                                      Runtime calls no tool)\n\nA put reads a JSON body from a file, or from stdin for -, and replaces the whole document; what\nbudgets, tool-policy, settings artifacts, settings skills and settings limits get print, put takes back. An API key is read from\nstdin, never from the arguments.";
 /** The Management API client of the installation `--tenant` (or the environment) names. */
 export declare function tenantClient(deps: StackDeps, tenant: string | undefined): Promise<{
     connection: Connection;

package/dist/client/watch.d.ts

@@ -0,0 +1,23 @@
+import type { StackDeps } from "../stack/commands.js";
+/** Watches `paths` (folders recursively, or files), calling `onChange` with a path that changed. */
+export type FolderWatcher = (paths: readonly string[], onChange: (path: string) => void) => {
+    close(): void;
+};
+/** `node:fs` `watch`, recursive for a folder. */
+export declare const nodeWatcher: FolderWatcher;
+export interface WatchOptions {
+    watcher?: FolderWatcher;
+    /** Ends the watch; by default SIGINT or SIGTERM. */
+    signal?: AbortSignal;
+    /** How long changes settle before a cycle (default 200 ms). */
+    debounceMs?: number;
+}
+/**
+ * Checks and plans `dirs` (apply's other flags in `args`) now and on each change, saving with
+ * `save`, until the signal ends it.
+ */
+export declare function watchApply(deps: StackDeps, run: {
+    dirs: readonly string[];
+    args: readonly string[];
+    save: boolean;
+}, options?: WatchOptions): Promise<number>;

package/dist/client/watch.js

@@ -0,0 +1,87 @@
+/**
+ * `nylorun apply --watch [--save]` (track T7, design §6): checks the folders and plans their
+ * manifests at once, then again on each change to them (debounced), until interrupted. It saves
+ * only with `--save`: each save is a new immutable version that moves the Agents tracking the
+ * name, so `--watch --save` is for a development manifest. A cycle that fails (a Runtime that
+ * refuses, a folder that does not pack) prints why and the watch goes on. The file a
+ * `runtime.json` `extends` is watched too.
+ */
+import { watch as watchFiles } from "node:fs";
+import { relative, resolve } from "node:path";
+import { applyCommand } from "./apply.js";
+import { agentFolders, checkCommand, packed } from "./folder.js";
+/** `node:fs` `watch`, recursive for a folder. */
+export const nodeWatcher = (paths, onChange) => {
+    const watchers = paths.map((path) => watchFiles(path, { recursive: true }, (_event, file) => onChange(file ? resolve(path, String(file)) : path)));
+    return { close: () => watchers.forEach((watcher) => watcher.close()) };
+};
+/** What changes that never start a cycle: version control and dependencies. */
+const QUIET = /(^|[\\/])(\.git|node_modules|\.hg|\.svn)([\\/]|$)/;
+/**
+ * Checks and plans `dirs` (apply's other flags in `args`) now and on each change, saving with
+ * `save`, until the signal ends it.
+ */
+export async function watchApply(deps, run, options = {}) {
+    const cwd = deps.cwd ?? process.cwd();
+    const dirs = run.dirs.length > 0 ? run.dirs : ["."];
+    const controller = new AbortController();
+    const signal = options.signal ?? controller.signal;
+    const stop = () => controller.abort();
+    if (!options.signal) {
+        process.once("SIGINT", stop);
+        process.once("SIGTERM", stop);
+    }
+    const cycle = async () => {
+        try {
+            if ((await checkCommand(deps, dirs)) === 0)
+                await applyCommand(deps, run.args, { planOnly: !run.save, checked: true });
+        }
+        catch (error) {
+            deps.err(error instanceof Error ? error.message : String(error));
+        }
+        deps.out(`Watching ${dirs.join(", ")} for changes${run.save ? ", saving each" : ""} (Ctrl-C stops).`);
+    };
+    // The folders, and the files their runtime.json extends.
+    const paths = new Set(dirs.map((dir) => resolve(cwd, dir)));
+    for (const dir of dirs)
+        for (const folder of await agentFolders(resolve(cwd, dir)).catch(() => []))
+            for (const file of (await packed(folder).catch(() => undefined))?.extended ?? [])
+                paths.add(file);
+    let running = cycle();
+    let timer;
+    let changed;
+    const watcher = (options.watcher ?? nodeWatcher)([...paths], (path) => {
+        if (QUIET.test(path))
+            return;
+        changed = path;
+        clearTimeout(timer);
+        timer = setTimeout(() => {
+            const what = changed;
+            running = running.then(async () => {
+                if (signal.aborted)
+                    return;
+                deps.out("");
+                deps.out(`${what === undefined ? "A file" : relative(cwd, what) || "."} changed: checking again.`);
+                await cycle();
+            });
+        }, options.debounceMs ?? 200);
+    });
+    try {
+        await new Promise((done) => {
+            if (signal.aborted)
+                done();
+            else
+                signal.addEventListener("abort", () => done(), { once: true });
+        });
+    }
+    finally {
+        clearTimeout(timer);
+        watcher.close();
+        if (!options.signal) {
+            process.off("SIGINT", stop);
+            process.off("SIGTERM", stop);
+        }
+    }
+    await running;
+    return 0;
+}

package/dist/nylo.js

@@ -3,7 +3,7 @@ import "./baseline.js";
 import { runCommand } from "./command.js";
 import { CliError } from "./errors.js";
 /**
- * `nylo` became part of `nylorun`. Until nylorun 0.19, which removes it, this command names the
+ * `nylo` became part of `nylorun`. Until a later release removes it, this command names the
  * `nylorun` command that replaces each of its own and exits 2.
  */
 const REPLACEMENTS = {
@@ -18,7 +18,7 @@ function nyloMessage(argv) {
     const replacement = REPLACEMENTS[argv[0] ?? ""];
     return `${replacement
         ? `nylo is part of nylorun now: nylo ${argv[0]} is ${replacement}.`
-        : "nylo is part of nylorun now: run nylorun --help."} nylorun 0.19 removes nylo.`;
+        : "nylo is part of nylorun now: run nylorun --help."} A later nylorun release removes nylo.`;
 }
 runCommand(async () => {
     throw new CliError(nyloMessage(process.argv.slice(2)), 2);

package/dist/stack/compose-file.js

@@ -182,7 +182,11 @@ ${healthcheck("rustfs")}    restart: unless-stopped
       # MCP servers and HTTP tools on this machine: \`localhost\` in their URLs means the Docker host.
       NYLORUN_ENDPOINT_LOOPBACK: docker-host
       # Host tuning (timings, retries, internal sizes; JSON): from the shell that runs \`nylorun start\`.
-      NYLORUN_TUNING: \${NYLORUN_TUNING:-}${sandboxes ? SANDBOXES_GATEWAY_ENV : ""}
+      NYLORUN_TUNING: \${NYLORUN_TUNING:-}
+      # Providers whose models may call with this machine's own identity, such as google-vertex
+      # with Google's Application Default Credentials (ADR-71): from the shell that runs
+      # \`nylorun start\`. Empty: none. Every Tenant on this Host may use it.
+      NYLORUN_MODEL_HOST_IDENTITY: \${NYLORUN_MODEL_HOST_IDENTITY:-}${sandboxes ? SANDBOXES_GATEWAY_ENV : ""}
     extra_hosts:
       host.docker.internal: host-gateway # model servers, MCP servers and HTTP tools on this machine
     volumes:

package/dist/stack/versions.d.ts

@@ -1,3 +1,5 @@
+/** This CLI's version, from its `package.json` (`nylorun --version`). */
+export declare function cliVersion(): string;
 /** An image this CLI release pins in its `package.json` `nylorun` (D7). */
 export type PinnedImage = "runtime" | "studio";
 /**

package/dist/stack/versions.js

@@ -6,6 +6,18 @@ function cliPackageJsonPath() {
     // src/stack/*.ts and dist/stack/*.js both sit two levels below the package root.
     return join(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
 }
+/** This CLI's version, from its `package.json` (`nylorun --version`). */
+export function cliVersion() {
+    try {
+        const version = JSON.parse(readFileSync(cliPackageJsonPath(), "utf8")).version;
+        if (typeof version === "string")
+            return version;
+    }
+    catch (error) {
+        throw new CliError(`Cannot read CLI package.json: ${error instanceof Error ? error.message : String(error)}`, 1);
+    }
+    throw new CliError("nylorun's package.json has no version.", 1);
+}
 /**
  * The version this CLI release pins for an image, from its `package.json`
  * `nylorun.runtime` or `nylorun.studio`: the tag of `ghcr.io/nylorun/<name>`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nylorun",
-  "version": "0.19.0-beta",
+  "version": "0.21.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Set up and run local Nylorun Tenants (Runtime and Studio) with Docker Compose, and act on a Tenant through its Runtime and Management APIs",
@@ -30,12 +30,12 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@nylorun/admin": "0.19.3-beta",
-    "@nylorun/agents": "0.27.0-beta",
-    "@nylorun/core": "0.27.0-beta"
+    "@nylorun/admin": "0.19.5-beta",
+    "@nylorun/agents": "0.29.0-beta",
+    "@nylorun/core": "0.29.0-beta"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "1.2.0",
+    "@earendil-works/pi-ai": "1.3.0",
     "@nylorun/agents": "file:../../sdks/agents",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "@types/node": "^26.6.5",
@@ -46,7 +46,7 @@
     "nylo": "dist/nylo.js"
   },
   "nylorun": {
-    "runtime": "0.31.0-beta",
-    "studio": "0.31.1-beta"
+    "runtime": "0.33.0-beta",
+    "studio": "0.33.0-beta"
   }
 }