@dharma-ai-labs/agent-fabric 0.2.109 → 0.2.111

package/dist/index.js

@@ -39,13 +39,16 @@ import { connectDemoDevice, verifyDemoDevice } from './demoEnrollment.js';
 import { performDemoPeerAction, withDemoDeviceLock } from './demoPeer.js';
 import { demoRepositoryPackage } from './demoPackage.js';
 import { demoDeviceAndPackageStatus } from './demoStatus.js';
+import { prepareDemoSigningUpgradeProof, readDemoSigningUpgradeContext } from './demoSigningUpgradeProof.js';
+import { submitDemoSigningUpgradeProof } from './demoSigningUpgradeSubmission.js';
+import { createDemoDeviceTransport } from './demoDeviceTransport.js';
 import { runDemoWatch } from './demoWatch.js';
 import { runDemoSupervisor } from './demoSupervisor.js';
 import { demoWatchRegistrationKey, listDemoWatchRegistrations } from './demoWatchRegistry.js';
 import { createDemoWatchHealthRecorder } from './demoWatchHealth.js';
 import { demoWatchStatus, disableDemoWatch, enableDemoWatch, inspectDemoWatchSupervisor } from './demoWatchControl.js';
 export { openCooperativeInboxSession } from './cooperativeInboxSession.js';
-const VERSION = '0.2.109';
+const VERSION = '0.2.111';
 const USAGE = CLI_USAGE;
 const execFileAsync = promisify(execFile);
 const LOCAL_PROVIDER_IDS = ['codex', 'claude', 'agy', 'hermes'];
@@ -1604,14 +1607,15 @@ async function supervisedDemoCycle(registration, signal) {
     const nativeDirectory = registration.provider === 'codex' ? resolve(workspace, '.agents', 'skills')
         : registration.provider === 'claude' ? resolve(workspace, '.claude', 'skills')
             : nativeSkillDirectory(registration.provider);
-    return withDemoDeviceLock(scope, () => {
+    return withDemoDeviceLock(scope, async () => {
         signal.throwIfAborted();
-        return demoRepositoryPackage({ scope, workspace, provider: registration.provider,
-            nativeSkillDirectory: nativeDirectory }, { fetcher: (url, options) => {
+        const deps = await createDemoDeviceTransport(scope, { fetcher: (url, options) => {
                 signal.throwIfAborted();
                 return fetch(url, { ...options,
                     signal: options?.signal ? AbortSignal.any([options.signal, signal]) : signal });
             } });
+        return demoRepositoryPackage({ scope, workspace, provider: registration.provider,
+            nativeSkillDirectory: nativeDirectory }, deps);
     });
 }
 async function relaySupervise(flags) {
@@ -5896,7 +5900,8 @@ export async function run(argv) {
     if (flags.has('version') || command === 'version')
         return { version: VERSION };
     if (command === 'demo' && ['connect', 'status', 'role', 'peers', 'ask', 'reply', 'inbox', 'ack', 'resume',
-        'package', 'package-status', 'watch', 'watch-enable', 'watch-status', 'watch-disable']
+        'package', 'package-status', 'watch', 'watch-enable', 'watch-status', 'watch-disable',
+        'signing-client-proof', 'signing-owner-proof', 'transport-connect']
         .includes(String(subcommand))) {
         const hqUrl = normalizeHqUrl(portalUrl(flags));
         const organizationId = required(flags, 'organization-id');
@@ -5911,18 +5916,41 @@ export async function run(argv) {
             throw new Error('Local Git remote does not match the private Demo repository binding.');
         }
         const watchControl = ['watch-enable', 'watch-status', 'watch-disable'].includes(String(subcommand));
+        const signingProof = ['signing-client-proof', 'signing-owner-proof'].includes(String(subcommand));
+        if (signingProof && subcommand === 'signing-owner-proof' && flags.has('submit')) {
+            throw new Error('Owner signing approval requires explicit browser confirmation.');
+        }
         if (watchControl && await realpath(root) !== workspace) {
             throw new Error('Demo watch setup must select the exact Git repository root.');
         }
+        let transportOrigin = null;
+        if (subcommand === 'transport-connect') {
+            transportOrigin = required(flags, 'transport-origin');
+            try {
+                const target = new URL(transportOrigin);
+                if (transportOrigin.length > 2048 || target.protocol !== 'https:' || target.origin !== transportOrigin || transportOrigin === hqUrl)
+                    throw new Error();
+            }
+            catch {
+                throw new Error('Demo transport recovery target_invalid. Use the exact reviewed HTTPS origin.');
+            }
+        }
         if (flags.has('dry-run'))
-            return { ok: true, stage: watchControl ? 'demo_watch_plan' : 'demo_device_plan',
+            return { ok: true, stage: transportOrigin ? 'demo_transport_plan' : signingProof ? 'demo_signing_proof_plan'
+                    : watchControl ? 'demo_watch_plan' : 'demo_device_plan',
                 organizationId, repositoryId, normalizedRepository, workspaceVerified: true,
-                repositoryPackageState: 'not_connected' };
+                repositoryPackageState: 'not_connected', ...(transportOrigin ? { transportOrigin } : {}) };
         const grant = subcommand === 'connect' ? required(flags, 'grant') : null;
         const scope = {
             hqUrl, organizationId, repositoryId, normalizedRepository,
             installationId: await loadOrCreateInstallationId(), stateRoot: dharmaHome(),
         };
+        if (signingProof) {
+            const context = await readDemoSigningUpgradeContext(resolve(required(flags, 'review-context')));
+            if (flags.has('submit'))
+                return withDemoDeviceLock(scope, async () => submitDemoSigningUpgradeProof(scope, context, await createDemoDeviceTransport(scope)));
+            return withDemoDeviceLock(scope, () => prepareDemoSigningUpgradeProof(scope, context, subcommand === 'signing-owner-proof' ? 'owner' : 'client'));
+        }
         if (watchControl) {
             const existing = (await listDemoWatchRegistrations(dharmaHome()))
                 .find(row => row.hqUrl === hqUrl && row.organizationId === organizationId && row.repositoryId === repositoryId);
@@ -5935,7 +5963,9 @@ export async function run(argv) {
                 hqUrl, organizationId, repositoryId, normalizedRepository, provider, workspace };
             const input = { home: dharmaHome(), registration, version: VERSION };
             const deps = {
-                verify: async () => { await withDemoDeviceLock(scope, () => verifyDemoDevice(scope)); },
+                verify: async () => {
+                    await withDemoDeviceLock(scope, async () => verifyDemoDevice(scope, await createDemoDeviceTransport(scope)));
+                },
                 exclusive: operation => withRelayStartupMutation(operation),
                 prepareStartup: async () => {
                     const launcher = await installStableRepositoryLauncher(workspace);
@@ -5963,9 +5993,9 @@ export async function run(argv) {
             const demoNativeSkillDirectory = provider === 'codex' ? resolve(workspace, '.agents', 'skills')
                 : provider === 'claude' ? resolve(workspace, '.claude', 'skills')
                     : nativeSkillDirectory(provider);
-            const cycle = () => withDemoDeviceLock(scope, () => demoRepositoryPackage({ scope, workspace,
+            const cycle = () => withDemoDeviceLock(scope, async () => demoRepositoryPackage({ scope, workspace,
                 statusOnly: subcommand === 'package-status', provider,
-                nativeSkillDirectory: demoNativeSkillDirectory }));
+                nativeSkillDirectory: demoNativeSkillDirectory }, await createDemoDeviceTransport(scope)));
             if (subcommand !== 'watch')
                 return cycle();
             const rawInterval = flags.get('interval-ms');
@@ -5988,8 +6018,6 @@ export async function run(argv) {
             }
         }
         return withDemoDeviceLock(scope, async () => {
-            if (subcommand === 'status')
-                return demoDeviceAndPackageStatus(scope, workspace);
             if (subcommand === 'connect') {
                 const connected = await connectDemoDevice({
                     ...scope, grant: grant,
@@ -6003,6 +6031,11 @@ export async function run(argv) {
                 const { configPath: _configPath, ...receipt } = connected;
                 return receipt;
             }
+            const deps = await createDemoDeviceTransport(scope);
+            if (transportOrigin)
+                return deps.connectTransport(transportOrigin);
+            if (subcommand === 'status')
+                return demoDeviceAndPackageStatus(scope, workspace, deps);
             let action = null;
             if (subcommand === 'role') {
                 const categories = repeated.get('category') || [];
@@ -6026,7 +6059,7 @@ export async function run(argv) {
                 action = { kind: 'inbox' };
             if (subcommand === 'ack')
                 action = { kind: 'ack', messageId: required(flags, 'message-id') };
-            return performDemoPeerAction(scope, action);
+            return performDemoPeerAction(scope, action, deps);
         });
     }
     if (command === 'bootstrap')