@agentorg/cli 0.0.5 → 0.0.7

package/dist/src/live.js

@@ -0,0 +1,109 @@
+// A live surface of an agent's unit, for a page: the page opens a socket here, same-origin, and
+// this asks management for a one-time ticket, dials it, and pipes the bytes both ways. The ticket
+// and every token stay out of the page.
+import WebSocket from "ws";
+/** What one live frame can be, either way. */
+export const LIVE_MAX = 4 * 1024 * 1024;
+/** The page didn't say its session, or the session is gone. */
+const SIGN_IN_AGAIN = 4401;
+/** The surface couldn't be opened; the reason says why. */
+const NOT_OPENED = 4404;
+const HELLO_TIMEOUT_MS = 10_000;
+/** What a page may send before the surface opens; past it, the socket closes rather than drop. */
+const WAITING_MAX = 1024 * 1024;
+/** Past this much unsent to the page, the surface waits; it goes on below the lower mark. */
+const BEHIND = 8 * 1024 * 1024;
+const CAUGHT_UP = 1024 * 1024;
+/** A close code a page may be given: the peer's when it's an ordinary one. */
+const codeOf = (code) => code === 1000 || code === 1001 || (code >= 3000 && code <= 4999) ? code : 1011;
+/** A close reason fits in 123 bytes. */
+const reasonOf = (text) => {
+    let reason = text;
+    while (Buffer.byteLength(reason) > 123)
+        reason = reason.slice(0, -1);
+    return reason;
+};
+/**
+ * Pipe a page's socket to a surface. A tab says its session first, as on `/api`, and is then
+ * answered `{"op":"live","protocol"}`; after that every frame is the surface's own. The CLI is in
+ * by its token.
+ */
+export function pipeLive(page, options) {
+    let upstream;
+    let opening = false;
+    const waiting = [];
+    let waitingBytes = 0;
+    const sizeOf = (data) => Array.isArray(data)
+        ? data.reduce((sum, one) => sum + one.length, 0)
+        : data.byteLength;
+    const open = async () => {
+        opening = true;
+        let ticket;
+        try {
+            ticket = await options.ticket();
+        }
+        catch (error) {
+            return page.close(NOT_OPENED, reasonOf(error instanceof Error ? error.message : "Not opened."));
+        }
+        if (page.readyState !== WebSocket.OPEN)
+            return;
+        let socket;
+        try {
+            // A server's socket, dialled from here: no browser Origin goes with it.
+            socket = new WebSocket(ticket.url, { maxPayload: LIVE_MAX });
+        }
+        catch {
+            // Its message would hold the ticket.
+            return page.close(NOT_OPENED, "The surface didn't open.");
+        }
+        upstream = socket;
+        socket.on("open", () => {
+            page.send(JSON.stringify({ op: "live", protocol: ticket.protocol }));
+            for (const [data, binary] of waiting.splice(0))
+                socket.send(data, { binary });
+        });
+        socket.on("message", (data, binary) => {
+            page.send(data, { binary }, () => {
+                if (page.bufferedAmount < CAUGHT_UP)
+                    socket.resume();
+            });
+            // A page that can't keep up isn't sent more until it has.
+            if (page.bufferedAmount > BEHIND)
+                socket.pause();
+        });
+        socket.on("close", (code, reason) => page.close(codeOf(code), reasonOf(String(reason))));
+        socket.on("error", () => page.close(NOT_OPENED, "The surface didn't open."));
+    };
+    const timer = options.cli
+        ? undefined
+        : setTimeout(() => page.close(SIGN_IN_AGAIN, "No session"), HELLO_TIMEOUT_MS);
+    const opened = () => open().catch(() => page.close(NOT_OPENED, "The surface didn't open."));
+    if (options.cli)
+        void opened();
+    page.on("message", (data, binary) => {
+        if (!opening) {
+            clearTimeout(timer);
+            let hello;
+            try {
+                hello = binary ? undefined : JSON.parse(String(data));
+            }
+            catch {
+                // Not a hello.
+            }
+            if (hello?.op !== "hello" || !options.isSession(hello.session))
+                return page.close(SIGN_IN_AGAIN, "Sign in again");
+            return void opened();
+        }
+        if (upstream?.readyState === WebSocket.OPEN)
+            return upstream.send(data, { binary });
+        waitingBytes += sizeOf(data);
+        if (waitingBytes > WAITING_MAX)
+            return page.close(1009, "Too much before the surface opened.");
+        waiting.push([data, binary]);
+    });
+    page.on("close", () => {
+        clearTimeout(timer);
+        upstream?.close();
+    });
+    page.on("error", () => page.terminate());
+}

package/dist/src/notes.d.ts

@@ -0,0 +1,11 @@
+/** A file of JSON values by key, answering as `kv@1` does. Each write replaces it whole. */
+export declare class Notes {
+    #private;
+    constructor(file: string);
+    get(key: string): {
+        value?: unknown;
+    };
+    set(key: string, value: unknown): object;
+    /** One `kv@1` call, checked as a call through the Hub would be. */
+    call(method: string, input: unknown): unknown;
+}

package/dist/src/notes.js

@@ -0,0 +1,64 @@
+// The app's own notes: what the person's pages and the gateway keep, in one private file.
+import { readFileSync, renameSync, writeFileSync } from "node:fs";
+import { kv } from "@agentorg/interfaces";
+import { Refused } from "@agentorg/sdk";
+/** Keys read at once by a `list`. */
+const PAGE = 1000;
+/** A file of JSON values by key, answering as `kv@1` does. Each write replaces it whole. */
+export class Notes {
+    #file;
+    #values;
+    constructor(file) {
+        this.#file = file;
+        let raw;
+        try {
+            raw = readFileSync(file, "utf8");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        this.#values = raw === undefined ? {} : JSON.parse(raw);
+    }
+    get(key) {
+        return Object.hasOwn(this.#values, key) ? { value: this.#values[key] } : {};
+    }
+    set(key, value) {
+        this.#values[key] = value;
+        this.#save();
+        return {};
+    }
+    /** One `kv@1` call, checked as a call through the Hub would be. */
+    call(method, input) {
+        const spec = Object.hasOwn(kv.methods, method)
+            ? kv.methods[method]
+            : undefined;
+        if (!spec)
+            throw new Refused("invalid", `store has no method ${method}.`);
+        const parsed = spec.input.safeParse(input);
+        if (!parsed.success)
+            throw new Refused("invalid", `store.${method}: ${parsed.error.message}`);
+        const given = parsed.data;
+        if (method === "get")
+            return this.get(given.key);
+        if (method === "set")
+            return this.set(given.key, given.value);
+        if (method === "delete") {
+            const deleted = Object.hasOwn(this.#values, given.key);
+            delete this.#values[given.key];
+            if (deleted)
+                this.#save();
+            return { deleted };
+        }
+        const { prefix = "", after, limit = PAGE } = given;
+        const found = Object.keys(this.#values)
+            .filter((key) => key.startsWith(prefix) && (after === undefined || key > after))
+            .sort();
+        const keys = found.slice(0, limit);
+        return { keys, next: found.length > limit ? (keys.at(-1) ?? null) : null };
+    }
+    #save() {
+        writeFileSync(`${this.#file}.tmp`, JSON.stringify(this.#values), { mode: 0o600, flush: true });
+        renameSync(`${this.#file}.tmp`, this.#file);
+    }
+}

package/dist/src/oauth.d.ts

@@ -0,0 +1,16 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+/**
+ * How the app's parts reach the Hub: the person's own calls, as `/api` makes them. A call that
+ * doesn't reach its provider rejects with an error named `NotConnected`, as `/api` names it.
+ */
+export interface PersonCalls {
+    call(slot: string, method: string, input: unknown): Promise<unknown>;
+}
+/**
+ * `/oauth/chatgpt`: where ChatGPT sends the browser back. It hands the whole callback address to
+ * the person's `login.complete`, then sends the tab on to `?result=<outcome>`, an address without
+ * the sign-in's code, so the code stays out of the tab's address and history; that page says how
+ * it went and links back to the shell. The code is never logged or shown, and no page sends a
+ * referrer.
+ */
+export declare function oauthRoute(person: PersonCalls): (request: IncomingMessage, response: ServerResponse, url: URL) => void;

package/dist/src/oauth.js

@@ -0,0 +1,46 @@
+/** What the sign-in tab says, by outcome: `complete`'s refusal code, or `signed_in`. */
+const SAYS = {
+    signed_in: "Signed in to ChatGPT. You can close this tab.",
+    denied: "You declined on ChatGPT's page. Start again from AgentOrg when you're ready.",
+    expired: "This sign-in expired. Start again from AgentOrg.",
+};
+const FAILED = "The sign-in didn't work. Start again from AgentOrg.";
+/**
+ * `/oauth/chatgpt`: where ChatGPT sends the browser back. It hands the whole callback address to
+ * the person's `login.complete`, then sends the tab on to `?result=<outcome>`, an address without
+ * the sign-in's code, so the code stays out of the tab's address and history; that page says how
+ * it went and links back to the shell. The code is never logged or shown, and no page sends a
+ * referrer.
+ */
+export function oauthRoute(person) {
+    return (request, response, url) => {
+        if (request.method !== "GET")
+            return void response.writeHead(405).end();
+        const result = url.searchParams.get("result");
+        if (result !== null && [...url.searchParams.keys()].length === 1)
+            return page(response, result === "signed_in" ? 200 : 400, Object.hasOwn(SAYS, result) ? SAYS[result] : FAILED);
+        const after = (outcome) => {
+            response.writeHead(303, {
+                Location: `${url.pathname}?result=${encodeURIComponent(outcome)}`,
+                "Cache-Control": "no-store",
+                "Referrer-Policy": "no-referrer",
+            });
+            response.end();
+        };
+        void person.call("login", "complete", { callbackUrl: url.href }).then(() => after("signed_in"), (error) => {
+            const code = error?.code;
+            after(typeof code === "string" && Object.hasOwn(SAYS, code) ? code : "failed");
+        });
+    };
+}
+function page(response, status, text) {
+    response.writeHead(status, {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store",
+        "Referrer-Policy": "no-referrer",
+        "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'",
+    });
+    response.end(`<!doctype html><meta charset="utf-8"><title>AgentOrg</title>` +
+        `<style>body{font:15px system-ui,sans-serif;margin:20vh auto;max-width:28rem;padding:0 16px}</style>` +
+        `<p>${text}</p><p><a href="/">Back to AgentOrg</a></p>`);
+}

package/dist/src/programs.d.ts

@@ -0,0 +1,36 @@
+import type { PersonCalls } from "./oauth.js";
+export interface ProgramsOptions {
+    home: string;
+    hubUrl: string;
+    /** Where the first run says what it couldn't do. */
+    log?: (message: string) => void;
+    /** How ChatGPT's requests leave, instead of the network. For tests. */
+    fetch?: (request: Request, init: RequestInit) => Promise<Response>;
+    /** Where the computer connector looks for a local service, the web unit's server, and agents' folders. For tests. */
+    computer?: {
+        dataFolder?: string;
+        webUrl?: string;
+        agentsFolder?: string;
+    };
+}
+export interface Programs {
+    /** The Actors running now, by program. */
+    chatgpt?: string;
+    agents?: string;
+    mcp?: string;
+    computer?: string;
+    management?: string;
+    /** Leave the Hub, in the order that lets each finish. What each keeps stays. */
+    close(): Promise<void>;
+}
+/**
+ * Close every Actor that runs a package, as an earlier release's do: the programs replace them.
+ * Before the Hub opens. Each stays listed as closed; the files it left in the home stay too, unread.
+ */
+export declare function closePackageActors(home: string): void;
+/**
+ * Make what is missing and start each program. A program whose Actor exists keeps it and its
+ * credential. A step that fails is logged, the programs that don't need it still start, and the
+ * next start tries again.
+ */
+export declare function startPrograms(person: PersonCalls, options: ProgramsOptions): Promise<Programs>;

package/dist/src/programs.js

@@ -0,0 +1,198 @@
+// The app's programs: ChatGPT, the agent provider, the MCP provider, the computer connector and management, each an Actor
+// of its own that this process runs on its own channel, with its own private folder under the home.
+// Every step reads what is there before it acts, so each start converges on the same system.
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { startComputerProvider } from "@agentorg/computer-connector";
+import { HubState, PERSON } from "@agentorg/hub";
+import { startManager } from "@agentorg/manager";
+import { startMcpProvider } from "@agentorg/mcp";
+import { startAgentProvider } from "assistant/provider";
+import { startChatGPT } from "chatgpt";
+/**
+ * Close every Actor that runs a package, as an earlier release's do: the programs replace them.
+ * Before the Hub opens. Each stays listed as closed; the files it left in the home stay too, unread.
+ */
+export function closePackageActors(home) {
+    if (!existsSync(join(home, "hub.db")))
+        return;
+    const state = HubState.open(home);
+    try {
+        for (const { actorId, package: from, state: now } of state.actors())
+            if (now !== "closed" && from !== "external" && from !== "builtin")
+                state.closeActor(PERSON, actorId);
+    }
+    finally {
+        state.close();
+    }
+}
+/** The bundled Assistant: the base, a computer on a service the person chooses, and the web. */
+const ASSISTANT_TEMPLATE = {
+    id: "assistant",
+    title: "Assistant",
+    description: "An agent with a computer of its own and the web.",
+    base: { provider: "AgentOrg", creatable: "assistant" },
+    units: [
+        { provider: "Computers", unit: "computer", values: { access: "terminal", browser: true } },
+        { provider: "Computers", unit: "web", values: { service: "exa" } },
+    ],
+};
+/** The Hub's exports each program holds. */
+const hubBinding = (name) => ({ slot: name, provider: "hub", export: name });
+/**
+ * Make what is missing and start each program. A program whose Actor exists keeps it and its
+ * credential. A step that fails is logged, the programs that don't need it still start, and the
+ * next start tries again.
+ */
+export async function startPrograms(person, options) {
+    const log = options.log ?? (() => { });
+    const { hubUrl } = options;
+    const root = join(options.home, "programs");
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    chmodSync(root, 0o700);
+    const call = (slot, method, input = {}) => person.call(slot, method, input);
+    const programLog = {
+        info() { },
+        warn() { },
+        error: (message) => log(message),
+    };
+    const dirOf = (name) => join(root, name);
+    const identityFile = (name) => join(root, `${name}.identity`);
+    /** The program's Actor: the one kept for it unless that is closed, or a new one. */
+    const identity = async (name, title, bindings) => {
+        let kept;
+        try {
+            kept = JSON.parse(readFileSync(identityFile(name), "utf8"));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        if (kept) {
+            const { actors } = await call("actors", "list");
+            const { actorId } = kept;
+            if (actors.some((actor) => actor.actorId === actorId && actor.state !== "closed"))
+                return kept;
+        }
+        const made = await call("actors", "create", { name: title, bindings });
+        const file = identityFile(name);
+        writeFileSync(`${file}.tmp`, JSON.stringify(made), { mode: 0o600, flush: true });
+        renameSync(`${file}.tmp`, file);
+        return made;
+    };
+    /** Bind the person's `slot` to `export` of `provider`, unless it is bound already. */
+    const personSlot = async (slot, provider, exported) => {
+        const { bindings } = await call("bindings", "list", {
+            actor: "person",
+        });
+        if (bindings.some((binding) => binding.consumer === "person" && binding.slot === slot))
+            return;
+        await call("grants", "bind", { consumer: "person", slot, provider, export: exported });
+    };
+    const closers = [];
+    const attempt = async (what, run) => {
+        try {
+            return await run();
+        }
+        catch (error) {
+            log(`First run: ${what} didn't work: ${error instanceof Error ? error.message : String(error)}`);
+            return undefined;
+        }
+    };
+    const chatgpt = await attempt("ChatGPT", async () => {
+        const { actorId, credential } = await identity("chatgpt", "ChatGPT", []);
+        const running = await startChatGPT({
+            hubUrl,
+            actorId,
+            credential,
+            dir: dirOf("chatgpt"),
+            log: programLog,
+            ...(options.fetch ? { fetch: options.fetch } : {}),
+        });
+        closers.unshift(() => running.close());
+        await personSlot("login", actorId, "login");
+        return actorId;
+    });
+    // Each agent's binding to the model comes from the provider's own, so ChatGPT goes first.
+    const agents = chatgpt &&
+        (await attempt("the agent provider", async () => {
+            const { actorId, credential } = await identity("agents", "AgentOrg", [
+                hubBinding("actors"),
+                { slot: "model", provider: chatgpt, export: "session" },
+            ]);
+            const running = await startAgentProvider({
+                hubUrl,
+                actorId,
+                credential,
+                model: { actor: chatgpt, export: "session" },
+                dir: dirOf("agents"),
+                log: programLog,
+            });
+            closers.unshift(() => running.close());
+            return actorId;
+        }));
+    const mcp = await attempt("the MCP provider", async () => {
+        const { actorId, credential } = await identity("mcp", "Local", [hubBinding("actors")]);
+        const running = await startMcpProvider({
+            hubUrl,
+            actorId,
+            credential,
+            dir: dirOf("mcp"),
+            log: programLog,
+        });
+        closers.unshift(() => running.close());
+        return actorId;
+    });
+    const computer = await attempt("the computer connector", async () => {
+        const { actorId, credential } = await identity("computer", "Computers", [hubBinding("actors")]);
+        const running = await startComputerProvider({
+            hubUrl,
+            actorId,
+            credential,
+            dir: dirOf("computer"),
+            log: programLog,
+            ...options.computer,
+        });
+        closers.unshift(() => running.close());
+        return actorId;
+    });
+    const management = await attempt("management", async () => {
+        const { actorId, credential } = await identity("management", "Management", [
+            hubBinding("actors"),
+            hubBinding("grants"),
+            hubBinding("bindings"),
+        ]);
+        // Management outlasts the providers at the end and is up before they're connected to it.
+        const running = await startManager({
+            hubUrl,
+            actorId,
+            credential,
+            dir: dirOf("management"),
+            log: programLog,
+            templates: [ASSISTANT_TEMPLATE],
+        });
+        closers.push(() => running.close());
+        for (const [slot, exported] of [
+            ["agents", "agents"],
+            ["connections", "connections"],
+            ["skills", "skills"],
+        ])
+            await personSlot(slot, actorId, exported);
+        return actorId;
+    });
+    if (management)
+        for (const provider of [agents, mcp, computer])
+            if (provider)
+                await attempt("connecting a provider to management", () => call("grants", "expose", { provider, export: "provider", to: management }));
+    return {
+        ...(chatgpt ? { chatgpt } : {}),
+        ...(agents ? { agents } : {}),
+        ...(mcp ? { mcp } : {}),
+        ...(computer ? { computer } : {}),
+        ...(management ? { management } : {}),
+        async close() {
+            for (const close of closers)
+                await close().catch((error) => log(`A program didn't stop: ${String(error)}`));
+        },
+    };
+}

package/dist/src/signin.d.ts

@@ -1,15 +1,24 @@
+/** Where the sessions' hashes outlast the app: read once, when first needed, and written at each sign-in. */
+export interface KeptSessions {
+    /** What was written last; anything that isn't a list is read as none. */
+    read(): unknown;
+    write(hashes: string[]): void;
+}
 /**
  * Who may use the gateway: browser tabs with a session, made from a one-time code, and the CLI
  * with the token in the home. A code works once, within 60 s, and travels only in a URL's
- * fragment, which no request carries. A session is a random id the gateway holds in memory, so a
- * restart signs every tab out. It is no cookie, which every port on 127.0.0.1 would receive: the
- * shell keeps it in its origin's own storage and says it in its socket's first message.
+ * fragment, which no request carries. A session is a random id of which the gateway holds only a
+ * hash. With `kept`, the hashes outlast the app, so a tab is still signed in when the app starts
+ * again; a session ends only when `SESSIONS_MAX` newer ones have been given.
+ * It is no cookie, which every port on 127.0.0.1 would receive: the shell keeps it in its origin's
+ * own storage and says it in its socket's first message.
  */
 export declare class SignIn {
     #private;
     readonly cliToken: string;
     constructor(options?: {
         now?: () => number;
+        kept?: KeptSessions;
     });
     /** A new one-time code, for `/signin#<code>`. */
     code(): string;

package/dist/src/signin.js

@@ -1,10 +1,12 @@
-import { randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 /** How long a sign-in code works. */
 const CODE_TTL_MS = 60_000;
 /** Codes not yet used; past it, the oldest go, so nothing grows without bound. */
 const MAX_CODES = 16;
 const SESSIONS_MAX = 256;
 const token = () => randomBytes(32).toString("base64url");
+/** What is kept of a session: enough to know it again, and nothing that signs anyone in. */
+const hashOf = (session) => createHash("sha256").update(session).digest("base64url");
 const same = (a, b) => {
     const left = Buffer.from(a);
     const right = Buffer.from(b);
@@ -13,17 +15,34 @@ const same = (a, b) => {
 /**
  * Who may use the gateway: browser tabs with a session, made from a one-time code, and the CLI
  * with the token in the home. A code works once, within 60 s, and travels only in a URL's
- * fragment, which no request carries. A session is a random id the gateway holds in memory, so a
- * restart signs every tab out. It is no cookie, which every port on 127.0.0.1 would receive: the
- * shell keeps it in its origin's own storage and says it in its socket's first message.
+ * fragment, which no request carries. A session is a random id of which the gateway holds only a
+ * hash. With `kept`, the hashes outlast the app, so a tab is still signed in when the app starts
+ * again; a session ends only when `SESSIONS_MAX` newer ones have been given.
+ * It is no cookie, which every port on 127.0.0.1 would receive: the shell keeps it in its origin's
+ * own storage and says it in its socket's first message.
  */
 export class SignIn {
     cliToken = token();
     #codes = new Map();
+    /** The hash of each session, the oldest first. */
     #sessions = new Set();
     #now;
+    #kept;
+    #restored = false;
     constructor(options = {}) {
         this.#now = options.now ?? Date.now;
+        this.#kept = options.kept;
+    }
+    /** Take back what was kept, the first time a session is given or asked about. */
+    #restore() {
+        if (this.#restored)
+            return;
+        this.#restored = true;
+        const read = this.#kept?.read();
+        const hashes = Array.isArray(read) ? read : [];
+        for (const hash of hashes.slice(-SESSIONS_MAX))
+            if (typeof hash === "string")
+                this.#sessions.add(hash);
     }
     /** A new one-time code, for `/signin#<code>`. */
     code() {
@@ -48,17 +67,22 @@ export class SignIn {
         if (this.#now() > expires)
             return undefined;
         const session = token();
-        this.#sessions.add(session);
+        this.#restore();
+        this.#sessions.add(hashOf(session));
         while (this.#sessions.size > SESSIONS_MAX)
             this.#sessions.delete(this.#sessions.values().next().value);
+        // Kept before it is given: a session the tab holds is one a restart still knows.
+        this.#kept?.write([...this.#sessions]);
         return session;
     }
     /** Whether a session is live. */
     isSession(session) {
         if (typeof session !== "string")
             return false;
+        this.#restore();
+        const hash = hashOf(session);
         for (const known of this.#sessions)
-            if (same(known, session))
+            if (same(known, hash))
                 return true;
         return false;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentorg/cli",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "description": "AgentOrg as one app: the Hub, the person's gateway and the shell, on loopback.",
   "license": "MIT",
   "repository": {
@@ -23,22 +23,15 @@
   },
   "files": [
     "dist/src",
-    "dist/bundled",
     "static",
     "dist/node_modules"
   ],
   "dependencies": {
-    "@assistant-ui/react": "^0.15.32",
+    "@modelcontextprotocol/client": "2.4.0",
     "ajv": "^8.20.0",
-    "esbuild": "0.28.2",
-    "radix-ui": "^1.8.1",
-    "react": "^19.3.1",
-    "react-dom": "^19.3.1",
-    "react-markdown": "^10.1.0",
-    "react-resizable-panels": "^4.19.1",
-    "remark-gfm": "^4.0.1",
-    "remend": "^1.4.0",
+    "react-diff-view": "3.3.3",
     "ws": "^8.22.1",
+    "yaml": "2.9.1",
     "zod": "^4.6.7"
   },
   "publishConfig": {

package/dist/bundled/index.json

@@ -1,6 +0,0 @@
-{
-  "installer": "sha256-4055f8fddf6b90f3d356543f554b2a9e9a2c4a8827a8774f8f87952dc1692331.agentorg",
-  "chatgpt": "sha256-e356ea3c1899138a8494baf521556831006f38534fa9e92ae873e7e6956c3a46.agentorg",
-  "assistant": "sha256-1f64ca62a0209d767d6aa6c4feb50b0653d60f10bebbc301f79bd3a37e0153c1.agentorg",
-  "board": "sha256-0e91cc3d0e9762b81abc2427b5496b20f383abcd6fb97d928a8d50e956b54d1f.agentorg"
-}

package/dist/node_modules/@agentorg/hub/dist/src/build.d.ts

@@ -1,17 +0,0 @@
-/** What a package's source may total, paths and text: it fits in one frame. */
-export declare const MAX_SOURCE: number;
-/**
- * The source as given, checked before anything is written or queued: its paths (no two the same
- * but for case, none both a file and a folder), its size.
- */
-export declare function checkSource(files: unknown): [string, string][];
-/**
- * Build a package from its source, given as data, and add it with `add`: the files are written to
- * a fresh folder in the home, built as `agentorg build` builds (importing by name only the SDK,
- * the interfaces, zod, React, react-dom and the kit, and nothing outside the folder; reading no tsconfig; at most 16
- * modules and 16 MiB built), and the folder is gone after, whatever happened. A build that fails
- * is `Refused("build")` with the build's message, which names no path outside the package.
- */
-export declare function buildSource<T>(home: string, entries: [string, string][], sandbox: (paths: string[]) => string[], add: (file: string) => T): Promise<T>;
-/** Folders of builds a crash interrupted: removed when the Hub opens. */
-export declare function sweepBuilds(home: string): void;