Models
Select a provider for the local Runtime process and store it in the vault.
From a generated project, select a provider and model against a running Runtime:
nylorun up
npm run configureThe wizard writes the provider, model, and key to the host vault
(PUT /v1/host/model). Configuration does not make a test model request; verify
connectivity by sending a message in Studio.
Applications do not pass model on Agent({}). Runtime selects and calls the
model. The executable server (@nylorun/runtime/server, started by the CLI)
reads the host vault when NYLORUN_PROJECT_PROVIDER=1. startRuntime() without
a supplied model and without useHostModel uses a credential-free
scriptedModel() — a fixed development response, not a conversation or tool
simulator.
The wizard shows the providers and models supported by the installed Runtime version. You can seed the vault once from environment variables when it is empty:
MODEL_PROVIDER=custom
MODEL=your-model-id
MODEL_PROVIDER_API_KEY=your-key
MODEL_PROVIDER_BASE_URL=https://your-provider.example/v1MODEL_PROVIDER_BASE_URL is required only for MODEL_PROVIDER=custom. Omit it
for built-in providers. After the first write, change the provider with
nylorun configure or Studio Model Settings — do not treat .env as the live
store.
Studio can keep multiple providers in the vault and switch the active
provider/model (PUT /v1/host/model/selection) without sending a new secret.
GET /v1/host/model never returns the secret.
| Name or path | Purpose | Commit it? |
|---|---|---|
Host vault (.nylorun/) | Encrypted provider credentials and the active selection. | No |
MODEL_* | Optional one-time seed when the vault is empty. | No |
.nylorun/auth.json | Legacy OAuth file imported once when seeding. | No |
configure requires a Runtime that is already listening. dev and serve
prompt on first start in an interactive terminal and store the credential in
the vault.
How the server picks a model
The executable entry point, not startRuntime itself, chooses among:
| Condition | Model used |
|---|---|
NYLORUN_DEV_MODEL=fixture | Credential-free starter fixture. Not a general model. |
NYLORUN_PROJECT_PROVIDER=1 | Host vault via useHostModel. |
NYLORUN_MODEL_GATEWAY_URL | gatewayModel with NYLORUN_MODEL_GATEWAY_KEY and NYLORUN_MODEL. |
| None of the above | scriptedModel (NYLORUN_SCRIPTED_OUTPUT optional). |
NYLORUN_DEV_MODEL=fixture and NYLORUN_MODEL_GATEWAY_URL remain separate
from the vault.
Custom hosts that call startRuntime must pass model or useHostModel
themselves if they want a real provider. Environment and gateway selection is
not implied by omitting that option.
Keep credentials in the host
Do not place provider keys or Runtime tokens in agent definitions, manifests, Studio settings, session records, or source control. For CI, supply them through your platform's secret facilities or seed the vault once.
For provider failures, confirm the active vault selection matches the
credential you supplied, check model access and quota, then re-run
nylorun configure.
See Vault, Runtime, and Harness for custom hosts.