nylorun 0.22.0-beta → 0.23.0-beta

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/CHANGELOG.md +20 -0
  2. package/dist/stack/compose-file.js +10 -2
  3. package/package.json +6 -6
package/CHANGELOG.md CHANGED
@@ -1,5 +1,25 @@
1
1
  # nylorun
2
2
 
3
+ ## 0.23.0-beta
4
+
5
+ ### Minor Changes
6
+
7
+ - 2ef610b: An outside credential provider for the egress gate (Host feature `credential-provider`; no protocol change). A Host's operator names a service that holds people's keys with `NYLORUN_CREDENTIAL_PROVIDER_URL` and `NYLORUN_CREDENTIAL_PROVIDER_TOKEN`, which `nylorun start` passes from its shell to the `gateway` and `runtime` containers. For a pod Agent with an owner, egress-gate asks the provider (`POST /v1/hosts`, with the Agent and its owner) which hosts the owner connected, lets them through on 443 inside the Tenant's egress ceiling, terminates TLS for them and hands each request to `<url>/v1/forward/<path>` with the sandbox's own headers plus `nylorun-provider-host`, `nylorun-provider-agent`, `nylorun-provider-owner` and `nylorun-provider-token`; the provider adds the key and sends it on, so the Runtime never sees a value. Each segment's sandbox sees the variables the provider names (`POST /v1/environment`) as `nylorun_managed`, under the vault's own. A secret in the Agent's vault bound to the same host still wins. Answers are cached per Agent for 15 s (Host tuning `credentialProvider.*`); an Agent with no owner is never asked about, and a provider that fails answers nothing, so its hosts are refused as before.
8
+
9
+ ### Patch Changes
10
+
11
+ - Pin core to the tested release.
12
+ - Pin agents to the tested release.
13
+ - Pin admin to the tested release.
14
+ - Pin runtime to the tested release.
15
+ - Pin studio to the tested release.
16
+ - Updated dependencies [2ef610b]
17
+ - Updated dependencies
18
+ - Updated dependencies
19
+ - @nylorun/core@0.30.0-beta
20
+ - @nylorun/agents@0.29.1-beta
21
+ - @nylorun/admin@0.19.6-beta
22
+
3
23
  ## 0.22.0-beta
4
24
 
5
25
  ### Minor Changes
package/dist/stack/compose-file.js CHANGED
@@ -186,7 +186,11 @@ ${healthcheck("rustfs")} restart: unless-stopped
186
186
  # Providers whose models may call with this machine's own identity, such as google-vertex
187
187
  # with Google's Application Default Credentials (ADR-71): from the shell that runs
188
188
  # \`nylorun start\`. Empty: none. Every Tenant on this Host may use it.
189
- NYLORUN_MODEL_HOST_IDENTITY: \${NYLORUN_MODEL_HOST_IDENTITY:-}${sandboxes ? SANDBOXES_GATEWAY_ENV : ""}
189
+ NYLORUN_MODEL_HOST_IDENTITY: \${NYLORUN_MODEL_HOST_IDENTITY:-}
190
+ # An outside credential provider egress-gate hands an Agent owner's connected hosts to, and
191
+ # its bearer: from the shell that runs \`nylorun start\`. Empty: none.
192
+ NYLORUN_CREDENTIAL_PROVIDER_URL: \${NYLORUN_CREDENTIAL_PROVIDER_URL:-}
193
+ NYLORUN_CREDENTIAL_PROVIDER_TOKEN: \${NYLORUN_CREDENTIAL_PROVIDER_TOKEN:-}${sandboxes ? SANDBOXES_GATEWAY_ENV : ""}
190
194
  extra_hosts:
191
195
  host.docker.internal: host-gateway # model servers, MCP servers and HTTP tools on this machine
192
196
  volumes:
@@ -260,7 +264,11 @@ ${healthcheck("gateway")} restart: unless-stopped
260
264
  NYLORUN_TRACE_CONTENT: \${NYLORUN_TRACE_CONTENT:-}
261
265
  # Host tuning (timings, retries, internal sizes; JSON): from the shell that runs \`nylorun start\`.
262
266
  # Sandbox pods get its harness and engine groups from the runtime.
263
- NYLORUN_TUNING: \${NYLORUN_TUNING:-}${sandboxes ? SANDBOXES_RUNTIME_ENV : ""}${identity ? IDENTITY_RUNTIME_ENV : ""}
267
+ NYLORUN_TUNING: \${NYLORUN_TUNING:-}
268
+ # The outside credential provider, which names the variables a pod Agent's sessions see as
269
+ # nylorun_managed: from the shell that runs \`nylorun start\`, as for the gateway. Empty: none.
270
+ NYLORUN_CREDENTIAL_PROVIDER_URL: \${NYLORUN_CREDENTIAL_PROVIDER_URL:-}
271
+ NYLORUN_CREDENTIAL_PROVIDER_TOKEN: \${NYLORUN_CREDENTIAL_PROVIDER_TOKEN:-}${sandboxes ? SANDBOXES_RUNTIME_ENV : ""}${identity ? IDENTITY_RUNTIME_ENV : ""}
264
272
  extra_hosts:
265
273
  host.docker.internal: host-gateway # the Docker host, also on Linux Docker Engine
266
274
  volumes:
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "nylorun",
3
- "version": "0.22.0-beta",
3
+ "version": "0.23.0-beta",
4
4
  "type": "module",
5
5
  "license": "Apache-2.0",
6
6
  "description": "Set up and run local Nylorun Tenants (Runtime and Studio) with Docker Compose, and act on a Tenant through its Runtime and Management APIs",
@@ -30,9 +30,9 @@
30
30
  "prepack": "npm run build"
31
31
  },
32
32
  "dependencies": {
33
- "@nylorun/admin": "0.19.5-beta",
34
- "@nylorun/agents": "0.29.0-beta",
35
- "@nylorun/core": "0.29.0-beta"
33
+ "@nylorun/admin": "0.19.6-beta",
34
+ "@nylorun/agents": "0.29.1-beta",
35
+ "@nylorun/core": "0.30.0-beta"
36
36
  },
37
37
  "devDependencies": {
38
38
  "@earendil-works/pi-ai": "1.3.0",
@@ -46,7 +46,7 @@
46
46
  "nylo": "dist/nylo.js"
47
47
  },
48
48
  "nylorun": {
49
- "runtime": "0.33.0-beta",
50
- "studio": "0.33.0-beta"
49
+ "runtime": "0.34.0-beta",
50
+ "studio": "0.33.1-beta"
51
51
  }
52
52
  }