nylorun 0.7.0-beta → 0.8.0-beta

package/dist/stack/index.js

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 import { runStackCommand, runStudioCommand } from "./commands.js";
 import { spawnDocker } from "./docker.js";
+import { sandboxCommand as runSandboxCommand } from "./sandbox.js";
 import { pinnedVersion } from "./versions.js";
 import { loopbackPorts } from "./ports.js";
 export { ensureStack, isStackCommand, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
@@ -79,6 +80,11 @@ export function defaultStackDeps(env) {
 export async function stackCommand(name, args, env) {
     return await runStackCommand(name, args, defaultStackDeps(env));
 }
+/** Entry for `nylorun sandbox ls|rm`. */
+export async function sandboxCommand(args, env) {
+    return await runSandboxCommand(defaultStackDeps(env), args);
+}
+export { sandboxUsage } from "./sandbox.js";
 /** `nylorun studio`, landing on `next` when given, else on the Tenant's page. */
 export async function studioCommand(args, env, options = {}) {
     return await runStudioCommand(args, defaultStackDeps(env), options);

package/dist/stack/paths.d.ts

@@ -12,6 +12,21 @@ export interface StackPaths {
     record: string;
     /** The Tenant directory: homes, sandboxes, plugin data, logs. */
     tenant: string;
+    /**
+     * The Tenant directory's parts the harness container mounts (F6.2): workspaces, plugin data,
+     * and the home and temporary directory of MCP stdio servers.
+     */
+    harness: {
+        sandboxes: string;
+        pluginData: string;
+        home: string;
+        tmp: string;
+    };
+    /**
+     * Plugin roots on this machine (`plugins/`), mounted read-only at the same path into the
+     * runtime and harness containers, so a stdio MCP server's plugin root resolves there.
+     */
+    plugins: string;
     /** The keys directory, mounted only into the gateway (F4.2). */
     keys: string;
     /** The Tenant's vault key (KEK), `keys/vault-kek`. */

package/dist/stack/paths.js

@@ -9,6 +9,13 @@ export function stackPaths(hostRoot) {
         state: join(root, "host-state.json"),
         record: join(root, "tenant.json"),
         tenant: join(root, "tenant"),
+        harness: {
+            sandboxes: join(root, "tenant", "sandboxes"),
+            pluginData: join(root, "tenant", "plugin-data"),
+            home: join(root, "tenant", "home"),
+            tmp: join(root, "tenant", "tmp"),
+        },
+        plugins: join(root, "plugins"),
         keys: join(root, "keys"),
         vaultKey: join(root, "keys", "vault-kek"),
         home: join(root, "home"),

package/dist/stack/prepare.d.ts

@@ -1,4 +1,4 @@
-import { type StackEnv } from "./env-file.js";
+import { type SandboxStackEnv, type StackEnv } from "./env-file.js";
 import { type HostConfigFile } from "./host-files.js";
 import type { StackImages } from "./images.js";
 import type { StackPaths } from "./paths.js";
@@ -16,7 +16,8 @@ export declare function readStackEnv(paths: Pick<StackPaths, "env">): Promise<im
  * Write everything `docker compose up` needs under the Host root:
  * host.json, host-credentials.json (0600), docker/compose.yaml,
  * docker/.env (0600) and docker/restate-identity.pem (0600). Ports and the
- * Postgres password persist in .env; the identity key persists in its PEM.
+ * Postgres password persist in .env; the identity key persists in its PEM. The harness token
+ * and mode persist too; whether Restate's UI is published is decided on every start.
  */
 export declare function prepareStack(input: {
     paths: StackPaths;
@@ -43,4 +44,11 @@ export declare function prepareStack(input: {
     };
     /** The measurement id Studio reports page views to; absent when telemetry is off. */
     studioAnalyticsId?: string;
+    /**
+     * The sandboxes settings (`nylorun sandbox enable`); null removes them (`disable`).
+     * Undefined keeps the persisted ones while `sandboxes/cluster.json` exists.
+     */
+    sandboxes?: SandboxStackEnv | null;
+    /** Publish Restate's UI and admin port (`start --restate-ui`); undefined keeps the last start's choice. */
+    restateUi?: boolean;
 }): Promise<PreparedStack>;

package/dist/stack/prepare.js

@@ -4,6 +4,7 @@ import { renderComposeFile } from "./compose-file.js";
 import { parseFrameAncestors } from "@nylorun/core/contracts";
 import { CliError } from "../errors.js";
 import { DEFAULT_STUDIO_FRAME_ANCESTORS, parseDerivedPrincipals, parsePersisted, renderEnvFile, } from "./env-file.js";
+import { sandboxesEnabled } from "../sandbox/cluster-file.js";
 import { ensureHostCredentials, ensureVaultKey, ensureHostLayout, writeStackHostConfig, } from "./host-files.js";
 import { choosePort, DEFAULT_PORTS } from "./ports.js";
 import { ensureIdentityKey } from "./restate-identity.js";
@@ -30,7 +31,8 @@ export async function readStackEnv(paths) {
  * Write everything `docker compose up` needs under the Host root:
  * host.json, host-credentials.json (0600), docker/compose.yaml,
  * docker/.env (0600) and docker/restate-identity.pem (0600). Ports and the
- * Postgres password persist in .env; the identity key persists in its PEM.
+ * Postgres password persist in .env; the identity key persists in its PEM. The harness token
+ * and mode persist too; whether Restate's UI is published is decided on every start.
  */
 export async function prepareStack(input) {
     const { paths } = input;
@@ -69,6 +71,12 @@ export async function prepareStack(input) {
         postgresPassword: persisted.postgresPassword ?? randomBytes(24).toString("hex"),
         // Kept across starts: a new token would recreate the runtime and gateway containers.
         gatesToken: persisted.gatesToken ?? randomBytes(32).toString("hex"),
+        // Kept across starts: a new token would recreate the runtime and harness containers.
+        harnessToken: persisted.harnessToken ?? randomBytes(32).toString("hex"),
+        harness: persisted.harness ?? "remote",
+        restateUi: input.restateUi ?? persisted.restateUi ?? false,
+        // Kept across starts: a new key would recreate the runtime, gateway and rustfs containers.
+        objectStoreSecretKey: persisted.objectStoreSecretKey ?? randomBytes(32).toString("hex"),
         restateIdentityKey: identity.publicKey,
         uid: input.uid,
         gid: input.gid,
@@ -82,6 +90,12 @@ export async function prepareStack(input) {
             ? parseDerivedPrincipals(input.derivedPrincipals, "NYLORUN_DERIVED_PRINCIPALS")
             : (persisted.derivedPrincipals ?? ["project"])).join(","),
     };
+    const sandboxes = input.sandboxes === null
+        ? undefined
+        : (input.sandboxes ?? (sandboxesEnabled(paths.root) ? persisted.sandboxes : undefined));
+    // The sandboxes image follows the Runtime's, like the runtime image, on every start.
+    if (sandboxes)
+        env.sandboxes = { ...sandboxes, image: input.images.sandboxes };
     const { adminKey } = await ensureHostCredentials(paths);
     await ensureVaultKey(paths);
     const host = await writeStackHostConfig(paths, {
@@ -90,6 +104,10 @@ export async function prepareStack(input) {
         runtimeVersion: input.runtimeVersion,
     });
     await writeFileMode(paths.env, renderEnvFile(env), 0o600);
-    await writeFileMode(paths.compose, renderComposeFile(input.project, input.name), 0o644);
+    await writeFileMode(paths.compose, renderComposeFile(input.project, input.name, {
+        harness: env.harness,
+        ...(env.sandboxes ? { sandboxes: true } : {}),
+        ...(env.restateUi ? { restateUi: true } : {}),
+    }), 0o644);
     return { env, host, adminKey, firstRun };
 }

package/dist/stack/sandbox.d.ts

@@ -0,0 +1,4 @@
+import { type StackDeps } from "./commands.js";
+export declare const sandboxUsage = "  sandbox ls [--tenant <name>] [--label <key=value>]... [--json]\n                                      the Tenant's sandboxes: id, kind, state, attached sessions and labels\n  sandbox rm <id> [--tenant <name>]   delete a sandbox and its files (refused while a turn runs in it)\n  sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]\n                                      run the Tenant's sandboxes as pods on that kubeconfig context (agent-sandbox v1.0.5)\n  sandbox disable [--tenant <name>] [--delete-namespace]\n                                      stop the sandboxes service and forget the cluster\n  sandbox status [--tenant <name>] [--json]\n                                      the cluster, the sandboxes service's readiness and what it reports";
+/** `nylorun sandbox <ls|rm|enable|disable|status> ...` */
+export declare function sandboxCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/stack/sandbox.js

@@ -0,0 +1,106 @@
+/**
+ * `nylorun sandbox ls | rm`: the running local Tenant's sandbox resources (Host feature
+ * `sandboxes`), through its Tenant API as the Project's derived principal. Neither starts the
+ * Tenant. `nylorun sandbox enable|disable|status` (sandbox pods on a cluster, F7.2) live in
+ * `../sandbox/commands.ts`.
+ */
+import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "@nylorun/core/compatibility";
+import { CliError } from "../errors.js";
+import { runSandboxCommand, sandboxUsage as clusterUsage } from "../sandbox/commands.js";
+import { spawnKubectl } from "../sandbox/kubectl.js";
+import { parseStackFlags, runningTenantApi } from "./commands.js";
+export const sandboxUsage = `  sandbox ls [--tenant <name>] [--label <key=value>]... [--json]
+                                      the Tenant's sandboxes: id, kind, state, attached sessions and labels
+  sandbox rm <id> [--tenant <name>]   delete a sandbox and its files (refused while a turn runs in it)
+${clusterUsage}`;
+const usageError = (message) => new CliError(message, 2);
+async function call(deps, api, method, path) {
+    const response = await deps.fetch(`${api.runtimeUrl}${path}`, {
+        method,
+        headers: {
+            authorization: `Bearer ${api.applicationKey}`,
+            [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
+            accept: "application/json",
+        },
+        redirect: "error",
+        signal: AbortSignal.timeout(15_000),
+    });
+    const body = (await response.json().catch(() => ({})));
+    if (response.status === 404 && path === "/v1/sandboxes")
+        throw new CliError(`Tenant ${api.name} runs a Runtime without sandboxes. Update it: npx nylorun@latest start.`, 1);
+    if (!response.ok && response.status !== 404)
+        throw new CliError(`${method} ${path} returned ${response.status}${typeof body.message === "string" ? `: ${body.message}` : ""}`, 1);
+    return { status: response.status, body };
+}
+function labelsText(labels) {
+    const entries = Object.entries(labels);
+    return entries.length === 0 ? "-" : entries.map(([key, value]) => `${key}=${value}`).join(",");
+}
+async function ls(deps, args) {
+    const usage = "nylorun sandbox ls [--tenant <name>] [--label <key=value>]... [--json]";
+    const flags = parseStackFlags(args, { booleans: ["--json"], values: ["--tenant"], lists: ["--label"] }, usage);
+    if (flags.rest.length)
+        throw usageError(`Usage: ${usage}`);
+    const query = new URLSearchParams();
+    for (const label of flags.lists.get("--label") ?? []) {
+        if (label.indexOf("=") <= 0)
+            throw usageError(`--label must be key=value, not ${label}`);
+        query.append("label", label);
+    }
+    const name = flags.values.get("--tenant");
+    const api = await runningTenantApi(deps, name === undefined ? {} : { name });
+    const search = query.toString();
+    const { body } = await call(deps, api, "GET", `/v1/sandboxes${search ? `?${search}` : ""}`);
+    const sandboxes = (body.sandboxes ?? []);
+    if (flags.booleans.has("--json")) {
+        deps.out(JSON.stringify(sandboxes, null, 2));
+        return 0;
+    }
+    if (sandboxes.length === 0) {
+        deps.out(`No sandboxes on Tenant ${api.name}.`);
+        return 0;
+    }
+    const rows = [
+        ["ID", "KIND", "STATE", "SESSIONS", "LABELS"],
+        ...sandboxes.map((sandbox) => [
+            sandbox.id,
+            sandbox.kind,
+            sandbox.state,
+            String(sandbox.sessions.length),
+            labelsText(sandbox.labels),
+        ]),
+    ];
+    const widths = rows[0].map((_, column) => Math.max(...rows.map((row) => row[column].length)));
+    for (const row of rows)
+        deps.out(row
+            .map((cell, column) => (column === row.length - 1 ? cell : cell.padEnd(widths[column])))
+            .join("  "));
+    return 0;
+}
+async function rm(deps, args) {
+    const usage = "nylorun sandbox rm <id> [--tenant <name>]";
+    const flags = parseStackFlags(args, { values: ["--tenant"] }, usage);
+    if (flags.rest.length !== 1)
+        throw usageError(`Usage: ${usage}`);
+    const id = flags.rest[0];
+    const name = flags.values.get("--tenant");
+    const api = await runningTenantApi(deps, name === undefined ? {} : { name });
+    const { status, body } = await call(deps, api, "DELETE", `/v1/sandboxes/${encodeURIComponent(id)}`);
+    if (status === 404 || body.deleted !== true) {
+        deps.err(`No sandbox ${id} on Tenant ${api.name}.`);
+        return 1;
+    }
+    deps.out(`Deleted sandbox ${id} and its files.`);
+    return 0;
+}
+/** `nylorun sandbox <ls|rm|enable|disable|status> ...` */
+export async function sandboxCommand(deps, args) {
+    const [sub, ...rest] = args;
+    if (sub === "ls" || sub === "list")
+        return ls(deps, rest);
+    if (sub === "rm" || sub === "delete")
+        return rm(deps, rest);
+    if (sub === "enable" || sub === "disable" || sub === "status")
+        return runSandboxCommand(args, { stack: deps, kubectl: spawnKubectl(deps.env) });
+    throw usageError(`Usage:\n${sandboxUsage}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nylorun",
-  "version": "0.7.0-beta",
+  "version": "0.8.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Set up and run local Nylorun Tenants (Runtime and Studio) with Docker Compose",
@@ -30,18 +30,18 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@nylorun/core": "0.11.0-beta"
+    "@nylorun/core": "0.12.0-beta"
   },
   "devDependencies": {
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "@types/node": "^26.5.0",
-    "vitest": "^5.0.1"
+    "vitest": "^5.0.2"
   },
   "bin": {
     "nylorun": "dist/cli.js"
   },
   "nylorun": {
-    "runtime": "0.15.2-beta",
-    "studio": "0.18.0-beta"
+    "runtime": "0.16.0-beta",
+    "studio": "0.19.0-beta"
   }
 }