@dharma-ai-labs/agent-fabric 0.2.79 → 0.2.81

package/dist/index.js

@@ -33,7 +33,8 @@ import { askRepositoryRoleQuestion, readRepositoryRoleReply } from './repository
 import { deriveRepositoryRole } from './repositoryRoleDerivation.js';
 import { withOnboardingStage } from './onboardingStage.js';
 import { waitForRepositoryReadiness } from './repositoryReadinessWait.js';
-const VERSION = '0.2.79';
+import { connectDemoDevice, verifyDemoDevice } from './demoEnrollment.js';
+const VERSION = '0.2.81';
 const USAGE = CLI_USAGE;
 const execFileAsync = promisify(execFile);
 const LOCAL_PROVIDER_IDS = ['codex', 'claude', 'agy', 'hermes'];
@@ -252,12 +253,13 @@ export function rawLocalRetentionDays(policy) {
     }
     return Number(value);
 }
-async function syncPendingRetentionCapsules(vault, fabric, policy, workspaceId) {
+export async function syncPendingRetentionCapsules(vault, fabric, policy, workspaceId) {
     // The caller must obtain this policy from an authoritative control-plane
     // refresh. An expired policy pauses the queue instead of mutating it.
     assertPolicy(policy);
     let synced = 0;
     let offset = 0;
+    let warnedPreviousDevice = false;
     for (;;) {
         const pending = await vault.listPendingCapsuleSyncs(1_000, offset);
         if (pending.length === 0)
@@ -274,6 +276,15 @@ async function syncPendingRetentionCapsules(vault, fabric, policy, workspaceId)
                 vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, 'capsule_integrity_failed');
                 continue;
             }
+            if (item.capsule.organizationId === fabric.config.organizationId
+                && item.capsule.deviceId !== fabric.config.deviceId) {
+                vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, 'device_binding_changed');
+                if (!warnedPreviousDevice) {
+                    process.stderr.write('Queued trajectory capsules from a previous device were preserved locally and excluded from upload. Recapture eligible provider sessions under the current device.\n');
+                    warnedPreviousDevice = true;
+                }
+                continue;
+            }
             // Policy expiry and signature failure pause the queue. Only a capsule
             // mismatch under a still-current policy is an authoritative discard.
             assertPolicy(policy);
@@ -2204,6 +2215,10 @@ async function capture(flags, batch = false) {
     const fabric = flags.has('sync')
         ? await client()
         : null;
+    if (fabric && (fabric.config.organizationId !== device.organizationId
+        || fabric.config.deviceId !== device.deviceId)) {
+        throw new Error('The enrolled device changed during evidence capture. Retry from the current device home.');
+    }
     if (fabric)
         policy = await refreshVerifiedWorkspacePolicyForTransmission(policyPath, registered.workspaceId, fabric);
     const vault = await LocalVault.open({
@@ -5361,6 +5376,42 @@ export async function run(argv) {
         return USAGE;
     if (flags.has('version') || command === 'version')
         return { version: VERSION };
+    if (command === 'demo' && ['connect', 'status'].includes(String(subcommand))) {
+        const hqUrl = normalizeHqUrl(portalUrl(flags));
+        const organizationId = required(flags, 'organization-id');
+        const repositoryId = required(flags, 'repository-id');
+        const normalizedRepository = required(flags, 'normalized-repository');
+        const workspace = await realpath(String(flags.get('workspace') || '.'));
+        const root = await gitValue(workspace, ['rev-parse', '--show-toplevel']);
+        if (!root)
+            throw new Error('Demo device setup must run inside the exact Git repository.');
+        const remote = await gitValue(workspace, ['config', '--get', 'remote.origin.url']);
+        if (!remote || normalizeGitRemoteIdentity(remote) !== normalizedRepository) {
+            throw new Error('Local Git remote does not match the private Demo repository binding.');
+        }
+        if (flags.has('dry-run'))
+            return { ok: true, stage: 'demo_device_plan',
+                organizationId, repositoryId, normalizedRepository, workspaceVerified: true,
+                repositoryPackageState: 'not_connected' };
+        const grant = subcommand === 'connect' ? required(flags, 'grant') : null;
+        const scope = {
+            hqUrl, organizationId, repositoryId, normalizedRepository,
+            installationId: await loadOrCreateInstallationId(), stateRoot: dharmaHome(),
+        };
+        const connected = subcommand === 'status'
+            ? await verifyDemoDevice(scope)
+            : await connectDemoDevice({
+                ...scope, grant: grant,
+                deviceName: String(flags.get('device-name') || `${process.env.USER || process.env.USERNAME || 'developer'} device`),
+                platform: await platform(),
+            }, { onApprovalRequired: async (url) => {
+                    if (!flags.has('no-browser'))
+                        await openVerificationUri(url);
+                    process.stderr.write(`Approve this exact Demo device in your signed-in Dharma session: ${url}\n`);
+                } });
+        const { configPath: _configPath, ...receipt } = connected;
+        return receipt;
+    }
     if (command === 'bootstrap')
         return bootstrap(flags);
     if (command === 'onboard')