@kya-os/cli 1.8.1 → 1.8.3

package/dist/utils/agent-detector.js

@@ -0,0 +1,74 @@
+import { existsSync } from "fs";
+import { homedir as osHomedir } from "os";
+import { join } from "path";
+import { defaultWhich } from "./which.js";
+/**
+ * Detection table v1. Exported so tests enumerate every row and adding a
+ * later agent kind is a one-row addition, not a code change.
+ */
+export const AGENT_DETECTION_TABLE = [
+    { kind: "claude-code", binNames: ["claude"], homeConfigDirs: [".claude"] },
+    { kind: "codex", binNames: ["codex"], homeConfigDirs: [".codex"] },
+    { kind: "gemini-cli", binNames: ["gemini"], homeConfigDirs: [".gemini"] },
+    {
+        kind: "cursor",
+        binNames: ["cursor"],
+        homeConfigDirs: [],
+        darwinAppPaths: ["/Applications/Cursor.app"],
+    },
+    { kind: "opencode", binNames: ["opencode"], homeConfigDirs: [".opencode"] },
+    { kind: "aider", binNames: ["aider"], homeConfigDirs: [] },
+];
+function defaultDeps() {
+    return {
+        whichImpl: defaultWhich,
+        fsImpl: { existsSync },
+        homedir: osHomedir,
+        platform: process.platform,
+    };
+}
+/**
+ * Detect which agent harnesses are present. Returns only the kinds with at
+ * least one match; an empty array means nothing was detected (not an error).
+ */
+export async function detectAgents(deps = {}) {
+    const { whichImpl, fsImpl, homedir, platform } = {
+        ...defaultDeps(),
+        ...deps,
+    };
+    const home = homedir();
+    const results = [];
+    for (const row of AGENT_DETECTION_TABLE) {
+        const evidence = [];
+        let binPath;
+        let configDir;
+        for (const bin of row.binNames) {
+            const found = await whichImpl(bin);
+            if (found) {
+                binPath = found;
+                evidence.push(`\`${bin}\` on PATH`);
+                break;
+            }
+        }
+        for (const dir of row.homeConfigDirs) {
+            const full = join(home, dir);
+            if (fsImpl.existsSync(full)) {
+                configDir = full;
+                evidence.push(`${full} exists`);
+                break;
+            }
+        }
+        if (platform === "darwin") {
+            for (const appPath of row.darwinAppPaths ?? []) {
+                if (fsImpl.existsSync(appPath)) {
+                    evidence.push(`${appPath} exists`);
+                }
+            }
+        }
+        if (evidence.length > 0) {
+            results.push({ kind: row.kind, binPath, configDir, evidence });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=agent-detector.js.map

package/dist/utils/agent-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-detector.js","sourceRoot":"","sources":["../../src/utils/agent-detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,IAAI,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAuC1C;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwB;IACxD,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC,SAAS,CAAC,EAAE;IAC1E,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC,QAAQ,CAAC,EAAE;IAClE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC,SAAS,CAAC,EAAE;IACzE;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE,CAAC,0BAA0B,CAAC;KAC7C;IACD,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,WAAW,CAAC,EAAE;IAC3E,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE;CAC3D,CAAC;AAcF,SAAS,WAAW;IAClB,OAAO;QACL,SAAS,EAAE,YAAY;QACvB,MAAM,EAAE,EAAE,UAAU,EAAE;QACtB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAmC,EAAE;IAErC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG;QAC/C,GAAG,WAAW,EAAE;QAChB,GAAG,IAAI;KACR,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,OAA2B,CAAC;QAChC,IAAI,SAA6B,CAAC;QAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,GAAG,KAAK,CAAC;gBAChB,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,CAAC;gBACpC,MAAM;YACR,CAAC;QACH,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,IAAI,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC;gBAChC,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;gBAC/C,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,SAAS,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/utils/agent-profile-stage.d.ts

@@ -0,0 +1,70 @@
+import { type AgentKind, type DetectedAgent } from "./agent-detector.js";
+import { type AgentProfile } from "./agent-profiles.js";
+import { type WriteSigningKeyResult } from "./dco/signing-key-writer.js";
+/**
+ * Orchestrates `kya-os init`'s agent-profile stage: detect harnesses,
+ * subtract ones that already have a profile, decide (via flag or prompt)
+ * which remainder to set up, register each, write its signing key, and save
+ * the profile. Every side effect (detection, the existing-profile check, the
+ * confirm prompt, registration, and the save itself) is an injectable seam
+ * so the whole stage runs in tests with zero real registration or network
+ * access -- `registerIdentity` in particular has NO default: a caller that
+ * forgets to wire it gets a type error, not an accidental real registration.
+ */
+export interface RegisteredIdentity {
+    did: string;
+    claimUrl?: string;
+    agentSlug?: string;
+    privateKey: string;
+    publicKey?: string;
+}
+/**
+ * No `slug` field: the underlying registration API (`enableMCPIdentityCLI`)
+ * has no parameter for requesting a specific slug -- it assigns one
+ * server-side from `name`. A caller-supplied slug here would be silently
+ * ignored, which is exactly the bug this type used to invite (Bugbot,
+ * PR #699): local file naming would use one slug while the registered DID
+ * used another. `runAgentProfileStage` derives the slug it actually stores
+ * under from the registration RESULT (`agentSlug`), never from a request.
+ */
+export type RegisterAgentIdentity = (input: {
+    kind: AgentKind;
+    name: string;
+}) => Promise<RegisteredIdentity>;
+export interface AgentProfileStageOptions {
+    interactive: boolean;
+    /** `--profiles <kind,kind,...>` in non-interactive mode. */
+    profilesFlag?: AgentKind[];
+    /** `--skip-profiles`. */
+    skipProfiles?: boolean;
+    /** Used to suggest `<githubLogin>-<kind>` slugs; falls back to `agent-<kind>`. */
+    githubLogin?: string;
+    /** Asked once per remaining detected agent in interactive mode. */
+    confirmImpl?: (agent: DetectedAgent) => Promise<boolean>;
+    registerIdentity: RegisterAgentIdentity;
+    detectAgentsImpl?: () => Promise<DetectedAgent[]>;
+    findProfileByKindImpl?: (kind: AgentKind) => AgentProfile | undefined;
+    saveProfileImpl?: (profile: AgentProfile) => void;
+    writeSigningKeyImpl?: (slug: string, identity: {
+        privateKey: string;
+        publicKey?: string;
+    }) => WriteSigningKeyResult;
+    now?: () => string;
+}
+export interface AgentProfileStageResult {
+    detected: DetectedAgent[];
+    createdProfiles: AgentProfile[];
+    /** Kinds that already had a profile before this run. */
+    skippedKinds: AgentKind[];
+    claimUrls: Array<{
+        kind: AgentKind;
+        slug: string;
+        claimUrl: string;
+    }>;
+    errors: Array<{
+        kind: AgentKind;
+        message: string;
+    }>;
+}
+export declare function runAgentProfileStage(options: AgentProfileStageOptions): Promise<AgentProfileStageResult>;
+//# sourceMappingURL=agent-profile-stage.d.ts.map

package/dist/utils/agent-profile-stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profile-stage.d.ts","sourceRoot":"","sources":["../../src/utils/agent-profile-stage.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,6BAA6B,CAAC;AAGrC;;;;;;;;;GASG;AAEH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,OAAO,CAAC;IACrB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3B,yBAAyB;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAClD,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,YAAY,GAAG,SAAS,CAAC;IACtE,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;IAClD,mBAAmB,CAAC,EAAE,CACpB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACjD,qBAAqB,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,YAAY,EAAE,CAAC;IAChC,wDAAwD;IACxD,YAAY,EAAE,SAAS,EAAE,CAAC;IAC1B,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtE,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAkCD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CA6HlC"}

package/dist/utils/agent-profile-stage.js

@@ -0,0 +1,153 @@
+import { detectAgents as defaultDetectAgents, } from "./agent-detector.js";
+import { findProfileByKind as defaultFindProfileByKind, saveProfile as defaultSaveProfile, } from "./agent-profiles.js";
+import { writeAgentSigningKey as defaultWriteAgentSigningKey, } from "./dco/signing-key-writer.js";
+import { isValidSlug } from "./dco/paths.js";
+/**
+ * Always returns a slug matching SLUG_PATTERN (packages/cli/src/utils/dco/
+ * paths.ts): sanitizes githubLogin down to the allowed charset and strips
+ * leading/trailing dashes, falling back to "agent" if that leaves nothing
+ * usable (e.g. a login that is punctuation-only). `kind` is always one of
+ * the fixed AgentKind values, already in that charset, so the result is
+ * guaranteed valid -- signingKeyPath/profilePath's own isValidSlug checks
+ * are defense-in-depth, not the only thing standing between a bad login
+ * and a thrown "Invalid agent slug" deep in the per-agent loop below.
+ */
+function suggestSlug(githubLogin, kind) {
+    const sanitizedLogin = (githubLogin || "")
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    const base = sanitizedLogin || "agent";
+    return `${base}-${kind}`;
+}
+async function defaultConfirm(agent) {
+    const inquirer = (await import("inquirer")).default;
+    const { answer } = await inquirer.prompt([
+        {
+            type: "confirm",
+            name: "answer",
+            message: `Set up a KYA profile for ${agent.kind}?`,
+            default: true,
+        },
+    ]);
+    return answer;
+}
+export async function runAgentProfileStage(options) {
+    const detectAgentsImpl = options.detectAgentsImpl ?? defaultDetectAgents;
+    const findProfileByKindImpl = options.findProfileByKindImpl ?? defaultFindProfileByKind;
+    const saveProfileImpl = options.saveProfileImpl ?? defaultSaveProfile;
+    const writeSigningKeyImpl = options.writeSigningKeyImpl ?? defaultWriteAgentSigningKey;
+    const now = options.now ?? (() => new Date().toISOString());
+    const detected = await detectAgentsImpl();
+    const skippedKinds = [];
+    const remaining = [];
+    for (const agent of detected) {
+        if (findProfileByKindImpl(agent.kind)) {
+            skippedKinds.push(agent.kind);
+        }
+        else {
+            remaining.push(agent);
+        }
+    }
+    const result = {
+        detected,
+        createdProfiles: [],
+        skippedKinds,
+        claimUrls: [],
+        errors: [],
+    };
+    if (remaining.length === 0 || options.skipProfiles) {
+        return result;
+    }
+    let toSetUp;
+    if (options.interactive) {
+        const confirmImpl = options.confirmImpl ?? defaultConfirm;
+        toSetUp = [];
+        for (const agent of remaining) {
+            if (await confirmImpl(agent)) {
+                toSetUp.push(agent);
+            }
+        }
+    }
+    else if (options.profilesFlag && options.profilesFlag.length > 0) {
+        const wanted = new Set(options.profilesFlag);
+        toSetUp = remaining.filter((agent) => wanted.has(agent.kind));
+    }
+    else {
+        // Bare non-TTY: default to skip. `--yes` deliberately does NOT reach
+        // here -- creating identities always needs an explicit per-agent yes or
+        // an explicit --profiles listing.
+        toSetUp = [];
+    }
+    for (const agent of toSetUp) {
+        const suggestedSlug = suggestSlug(options.githubLogin, agent.kind);
+        let registered;
+        try {
+            registered = await options.registerIdentity({
+                kind: agent.kind,
+                name: `${options.githubLogin ?? "Agent"} (${agent.kind})`,
+            });
+        }
+        catch (error) {
+            result.errors.push({
+                kind: agent.kind,
+                message: error instanceof Error ? error.message : String(error),
+            });
+            continue;
+        }
+        // The slug used for local storage must be the one the SERVER actually
+        // assigned, not the one we suggested: registration has no parameter to
+        // request a specific slug, so `registered.agentSlug` is the only value
+        // that's guaranteed to match `registered.did`. Using the suggestion
+        // instead would write the signing key and profile under a slug that
+        // disagrees with the registered identity -- a later `dco setup <slug>`
+        // would sign as the wrong agent. Only trust it once validated (it's
+        // server-controlled data about to become a path segment); an invalid
+        // or absent value falls back to our own already-valid suggestion.
+        const slug = registered.agentSlug && isValidSlug(registered.agentSlug)
+            ? registered.agentSlug
+            : suggestedSlug;
+        // Write the signing key the way `dco setup` does (the shared, tested
+        // conversion in signing-key-writer.ts) before saving the profile: a
+        // profile whose key never made it to disk would be silently unusable.
+        // A registration already happened for this agent by this point (the
+        // registerIdentity call above succeeded), so any unexpected throw here
+        // (not just writeAgentSigningKey's own returned "failed" status) is
+        // caught too -- one agent's key-write bug must not abort the rest of
+        // the batch, matching the resilience already proven for registration
+        // failures above.
+        try {
+            const keyResult = writeSigningKeyImpl(slug, {
+                privateKey: registered.privateKey,
+                publicKey: registered.publicKey,
+            });
+            if (keyResult.status === "failed") {
+                result.errors.push({ kind: agent.kind, message: keyResult.detail });
+                continue;
+            }
+            const profile = {
+                slug,
+                kind: agent.kind,
+                did: registered.did,
+                binPath: agent.binPath,
+                createdAt: now(),
+                registryUrl: `https://knowthat.ai/agents/${slug}`,
+                claimUrl: registered.claimUrl,
+                commandAllowlist: [],
+            };
+            saveProfileImpl(profile);
+            result.createdProfiles.push(profile);
+            if (registered.claimUrl) {
+                result.claimUrls.push({ kind: agent.kind, slug, claimUrl: registered.claimUrl });
+            }
+        }
+        catch (error) {
+            result.errors.push({
+                kind: agent.kind,
+                message: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=agent-profile-stage.js.map

package/dist/utils/agent-profile-stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profile-stage.js","sourceRoot":"","sources":["../../src/utils/agent-profile-stage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,IAAI,mBAAmB,GAGpC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,IAAI,wBAAwB,EAC7C,WAAW,IAAI,kBAAkB,GAElC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,IAAI,2BAA2B,GAEpD,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAiE7C;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,WAA+B,EAAE,IAAe;IACnE,MAAM,cAAc,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;SACvC,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,cAAc,IAAI,OAAO,CAAC;IACvC,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAoB;IAChD,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACvC;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,4BAA4B,KAAK,CAAC,IAAI,GAAG;YAClD,OAAO,EAAE,IAAI;SACd;KACF,CAAC,CAAC;IACH,OAAO,MAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAiC;IAEjC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,mBAAmB,CAAC;IACzE,MAAM,qBAAqB,GACzB,OAAO,CAAC,qBAAqB,IAAI,wBAAwB,CAAC;IAC5D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,kBAAkB,CAAC;IACtE,MAAM,mBAAmB,GACvB,OAAO,CAAC,mBAAmB,IAAI,2BAA2B,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAE5D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAE1C,MAAM,YAAY,GAAgB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAoB,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,QAAQ;QACR,eAAe,EAAE,EAAE;QACnB,YAAY;QACZ,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,EAAE;KACX,CAAC;IAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAwB,CAAC;IAC7B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC;QAC1D,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7C,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,wEAAwE;QACxE,kCAAkC;QAClC,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC;gBAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,KAAK,KAAK,CAAC,IAAI,GAAG;aAC1D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,IAAI,GACR,UAAU,CAAC,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;YACvD,CAAC,CAAC,UAAU,CAAC,SAAS;YACtB,CAAC,CAAC,aAAa,CAAC;QAEpB,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,kBAAkB;QAClB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE;gBAC1C,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAiB;gBAC5B,IAAI;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,EAAE,UAAU,CAAC,GAAG;gBACnB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,GAAG,EAAE;gBAChB,WAAW,EAAE,8BAA8B,IAAI,EAAE;gBACjD,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,gBAAgB,EAAE,EAAE;aACrB,CAAC;YACF,eAAe,CAAC,OAAO,CAAC,CAAC;YACzB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACxB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/agent-profiles.d.ts

@@ -0,0 +1,27 @@
+import type { AgentKind } from "./agent-detector.js";
+/**
+ * Local record of a per-agent KYA identity created by `kya-os init`'s agent
+ * profile stage. Holds NO key material -- keys stay under
+ * `~/.mcpi/keys/<slug>` (see `packages/cli/src/utils/dco/paths.ts`); this
+ * store carries only the slug that locates them.
+ */
+export interface AgentProfile {
+    slug: string;
+    kind: AgentKind;
+    /** did:web:knowthat.ai:agents:<slug> */
+    did: string;
+    binPath?: string;
+    createdAt: string;
+    registryUrl: string;
+    claimUrl?: string;
+    /** Consumed by the harness wrapper; empty/absent means dispatch-disabled. */
+    commandAllowlist?: string[];
+}
+/** Absolute path to the profiles directory, e.g. ~/.mcpi/profiles. */
+export declare function profilesDir(): string;
+/** All saved profiles. An empty machine (no profiles dir yet) returns []. */
+export declare function listProfiles(): AgentProfile[];
+/** Persist a profile at 0600 inside a 0700 directory. Overwrites by slug. */
+export declare function saveProfile(profile: AgentProfile): void;
+export declare function findProfileByKind(kind: AgentKind): AgentProfile | undefined;
+//# sourceMappingURL=agent-profiles.d.ts.map

package/dist/utils/agent-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profiles.d.ts","sourceRoot":"","sources":["../../src/utils/agent-profiles.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,sEAAsE;AACtE,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AA+BD,6EAA6E;AAC7E,wBAAgB,YAAY,IAAI,YAAY,EAAE,CAkB7C;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAGvD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAE3E"}

package/dist/utils/agent-profiles.js

@@ -0,0 +1,61 @@
+import { existsSync, readFileSync, readdirSync } from "fs";
+import { join, resolve } from "path";
+import { ensureSecureDir, isValidSlug, stateDir, writeSecureFile, } from "./cli-kit/index.js";
+/** Absolute path to the profiles directory, e.g. ~/.mcpi/profiles. */
+export function profilesDir() {
+    return resolve(process.env.MCPI_PROFILES_DIR || stateDir("mcpi", "profiles"));
+}
+function profilePath(slug) {
+    if (!isValidSlug(slug)) {
+        throw new Error(`Invalid agent slug "${slug}": must be lowercase letters, numbers, and dashes.`);
+    }
+    return join(profilesDir(), `${slug}.json`);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((v) => typeof v === "string");
+}
+/** Runtime shape guard: a corrupt or hand-edited file must never crash listProfiles. */
+function isAgentProfile(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    return (typeof v.slug === "string" &&
+        typeof v.kind === "string" &&
+        typeof v.did === "string" &&
+        typeof v.createdAt === "string" &&
+        typeof v.registryUrl === "string" &&
+        (v.binPath === undefined || typeof v.binPath === "string") &&
+        (v.claimUrl === undefined || typeof v.claimUrl === "string") &&
+        (v.commandAllowlist === undefined || isStringArray(v.commandAllowlist)));
+}
+/** All saved profiles. An empty machine (no profiles dir yet) returns []. */
+export function listProfiles() {
+    const dir = profilesDir();
+    if (!existsSync(dir)) {
+        return [];
+    }
+    const profiles = [];
+    for (const entry of readdirSync(dir)) {
+        if (!entry.endsWith(".json"))
+            continue;
+        try {
+            const parsed = JSON.parse(readFileSync(join(dir, entry), "utf-8"));
+            if (isAgentProfile(parsed)) {
+                profiles.push(parsed);
+            }
+        }
+        catch {
+            // Skip an unreadable/corrupt profile rather than fail the whole list.
+        }
+    }
+    return profiles;
+}
+/** Persist a profile at 0600 inside a 0700 directory. Overwrites by slug. */
+export function saveProfile(profile) {
+    ensureSecureDir(profilesDir());
+    writeSecureFile(profilePath(profile.slug), JSON.stringify(profile, null, 2) + "\n");
+}
+export function findProfileByKind(kind) {
+    return listProfiles().find((p) => p.kind === kind);
+}
+//# sourceMappingURL=agent-profiles.js.map

package/dist/utils/agent-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profiles.js","sourceRoot":"","sources":["../../src/utils/agent-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EACL,eAAe,EACf,WAAW,EACX,QAAQ,EACR,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAsB5B,sEAAsE;AACtE,MAAM,UAAU,WAAW;IACzB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,oDAAoD,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,wFAAwF;AACxF,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC;QAC1D,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC5D,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAC5E,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,OAAqB;IAC/C,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/B,eAAe,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAe;IAC/C,OAAO,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACrD,CAAC"}

package/dist/utils/checkpoint-api.d.ts

@@ -1,5 +1,5 @@
 /**
- * HTTP client for the `mcpi checkpoint init` claim-token flow (KYA-1037).
+ * HTTP client for the `kya-os checkpoint init` claim-token flow (KYA-1037).
  *
  * Talks to the three public Checkpoint dashboard endpoints added for this
  * flow: register a claim token, poll its status, and exchange a claimed

package/dist/utils/checkpoint-api.js

@@ -1,5 +1,5 @@
 /**
- * HTTP client for the `mcpi checkpoint init` claim-token flow (KYA-1037).
+ * HTTP client for the `kya-os checkpoint init` claim-token flow (KYA-1037).
  *
  * Talks to the three public Checkpoint dashboard endpoints added for this
  * flow: register a claim token, poll its status, and exchange a claimed

package/dist/utils/checkpoint-env.d.ts

@@ -1,5 +1,5 @@
 /**
- * Minimal, dedicated `.env.local` writer for `mcpi checkpoint init`'s two
+ * Minimal, dedicated `.env.local` writer for `kya-os checkpoint init`'s two
  * variables.
  *
  * `EnvManager` (env-manager.ts) is intentionally NOT reused here: its

package/dist/utils/checkpoint-env.js

@@ -1,5 +1,5 @@
 /**
- * Minimal, dedicated `.env.local` writer for `mcpi checkpoint init`'s two
+ * Minimal, dedicated `.env.local` writer for `kya-os checkpoint init`'s two
  * variables.
  *
  * `EnvManager` (env-manager.ts) is intentionally NOT reused here: its
@@ -46,7 +46,7 @@ export function writeCheckpointEnv(projectRoot, vars) {
             updatedLines[updatedLines.length - 1] !== "") {
             updatedLines.push("");
         }
-        updatedLines.push("# Added by `mcpi checkpoint init`");
+        updatedLines.push("# Added by `kya-os checkpoint init`");
         for (const key of missing) {
             updatedLines.push(`${key}=${vars[key]}`);
         }

package/dist/utils/checkpoint-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"checkpoint-env.js","sourceRoot":"","sources":["../../src/utils/checkpoint-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,MAAM,QAAQ,GAAgC;IAC5C,oBAAoB;IACpB,uBAAuB;CACxB,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,IAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACtC,2DAA2D;QAC3D,sEAAsE;QACtE,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,qCAAqC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAwC,CAAC;QAC9D,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,GAAG,YAAY,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,IACE,YAAY,CAAC,MAAM,GAAG,CAAC;YACvB,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAC5C,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,MAAM,OAAO,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC;IACnE,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"checkpoint-env.js","sourceRoot":"","sources":["../../src/utils/checkpoint-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,MAAM,QAAQ,GAAgC;IAC5C,oBAAoB;IACpB,uBAAuB;CACxB,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,IAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACtC,2DAA2D;QAC3D,sEAAsE;QACtE,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,qCAAqC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAwC,CAAC;QAC9D,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,GAAG,YAAY,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,IACE,YAAY,CAAC,MAAM,GAAG,CAAC;YACvB,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAC5C,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACzD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,MAAM,OAAO,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC;IACnE,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC"}

package/dist/utils/checkpoint-scaffold.d.ts

@@ -1,5 +1,5 @@
 /**
- * Detect-layer scaffolding for `mcpi checkpoint init` (KYA-1037).
+ * Detect-layer scaffolding for `kya-os checkpoint init` (KYA-1037).
  *
  * Maps the repo's detected platform onto one of the three Detect layers
  * Checkpoint ships (Next.js middleware, Express snippet, the keyless

package/dist/utils/checkpoint-scaffold.js

@@ -1,5 +1,5 @@
 /**
- * Detect-layer scaffolding for `mcpi checkpoint init` (KYA-1037).
+ * Detect-layer scaffolding for `kya-os checkpoint init` (KYA-1037).
  *
  * Maps the repo's detected platform onto one of the three Detect layers
  * Checkpoint ships (Next.js middleware, Express snippet, the keyless

package/dist/utils/cli-kit/browser.d.ts

@@ -0,0 +1,24 @@
+export interface OpenUrlInBrowserOptions {
+    /** Wait for the user to press Enter before opening, when attached to a TTY. Default true. */
+    waitForEnter?: boolean;
+    /** Max time to wait for Enter, in ms. Default 30000. */
+    enterTimeoutMs?: number;
+}
+export interface OpenUrlInBrowserResult {
+    opened: boolean;
+    /** Present when `opened` is false: "non-tty", or the `open()` failure message. */
+    reason?: string;
+}
+/**
+ * Open a URL in the user's browser, but only when attached to an
+ * interactive terminal.
+ *
+ * A non-TTY run (CI, Docker, a piped process) has no user present to
+ * consent to a browser launching, so this never attempts to open one
+ * there — it returns immediately with `{ opened: false, reason: "non-tty" }`
+ * so the caller can print the URL instead. Auto-opening anyway after a
+ * short delay was a real bug in the code this replaces: a non-interactive
+ * `init` run would pop a browser window with no user watching for it.
+ */
+export declare function openUrlInBrowser(url: string, options?: OpenUrlInBrowserOptions): Promise<OpenUrlInBrowserResult>;
+//# sourceMappingURL=browser.d.ts.map

package/dist/utils/cli-kit/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../src/utils/cli-kit/browser.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,uBAAuB;IACtC,6FAA6F;IAC7F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,OAAO,CAAC;IAChB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CA+CjC"}

package/dist/utils/cli-kit/browser.js

@@ -0,0 +1,58 @@
+import chalk from "chalk";
+/**
+ * Open a URL in the user's browser, but only when attached to an
+ * interactive terminal.
+ *
+ * A non-TTY run (CI, Docker, a piped process) has no user present to
+ * consent to a browser launching, so this never attempts to open one
+ * there — it returns immediately with `{ opened: false, reason: "non-tty" }`
+ * so the caller can print the URL instead. Auto-opening anyway after a
+ * short delay was a real bug in the code this replaces: a non-interactive
+ * `init` run would pop a browser window with no user watching for it.
+ */
+export async function openUrlInBrowser(url, options = {}) {
+    const { waitForEnter = true, enterTimeoutMs = 30000 } = options;
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        return { opened: false, reason: "non-tty" };
+    }
+    if (waitForEnter) {
+        console.log(`   ${chalk.gray("Press Enter to open in browser...")}`);
+        // The two arms must cancel each other: a leaked timer would later fire
+        // process.stdin.pause() and freeze any interactive prompt on screen at
+        // that moment.
+        const cleanup = () => {
+            process.stdin.pause();
+            process.stdin.removeAllListeners("data");
+        };
+        let enterTimeout;
+        await Promise.race([
+            new Promise((resolve) => {
+                process.stdin.once("data", () => {
+                    if (enterTimeout)
+                        clearTimeout(enterTimeout);
+                    cleanup();
+                    resolve();
+                });
+                process.stdin.resume();
+            }),
+            new Promise((resolve) => {
+                enterTimeout = setTimeout(() => {
+                    cleanup();
+                    resolve();
+                }, enterTimeoutMs);
+            }),
+        ]);
+    }
+    try {
+        const open = (await import("open")).default;
+        await open(url);
+        return { opened: true };
+    }
+    catch (error) {
+        return {
+            opened: false,
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+//# sourceMappingURL=browser.js.map

package/dist/utils/cli-kit/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../../src/utils/cli-kit/browser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAe1B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,UAAmC,EAAE;IAErC,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,cAAc,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAEhE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC;QAErE,uEAAuE;QACvE,uEAAuE;QACvE,eAAe;QACf,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAC;QAEF,IAAI,YAAwC,CAAC;QAC7C,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;oBAC9B,IAAI,YAAY;wBAAE,YAAY,CAAC,YAAY,CAAC,CAAC;oBAC7C,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,CAAC,CAAC;YACF,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC7B,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,CAAC;gBACZ,CAAC,EAAE,cAAc,CAAC,CAAC;YACrB,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5C,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/utils/cli-kit/claim-polling.d.ts

@@ -0,0 +1,18 @@
+export interface ClaimPollingOptions {
+    verbose?: boolean;
+    maxAttempts?: number;
+    pollInterval?: number;
+}
+/**
+ * Poll a claim-status endpoint until claimed, timed out, or interrupted.
+ *
+ * Endpoint-agnostic: `endpoint` is the base URL and `statusPath` builds the
+ * per-check path from it, so a caller can point this at knowthat.ai's
+ * `/api/agents/:slug` today or a Checkpoint `/api/v1/cli/claim-status`
+ * tomorrow without forking the polling logic. A response is "claimed" when
+ * `isClaimed` returns true for its parsed JSON body.
+ *
+ * Returns true when claimed, false on timeout or user interrupt (Ctrl+C).
+ */
+export declare function pollForClaimStatus(statusUrl: string, isClaimed: (body: unknown) => boolean, options?: ClaimPollingOptions): Promise<boolean>;
+//# sourceMappingURL=claim-polling.d.ts.map

package/dist/utils/cli-kit/claim-polling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-polling.d.ts","sourceRoot":"","sources":["../../../src/utils/cli-kit/claim-polling.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,EACrC,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CA4FlB"}