@kybernesis/create 0.11.0 → 0.12.1

package/dist/doctor.js

@@ -367,9 +367,23 @@ export async function doctor() {
         }
     }
     // ── eve discovery + local port ─────────────────────────────────────────
-    const info = capture("npx", ["eve", "info"], cwd);
-    if (info === null)
-        add("fail", "eve info failed", "run npx eve info for details");
+    /**
+     * Discovery, run with the environment the SERVER runs with.
+     *
+     * `eve info` compiles the agent, and an agent that reads a variable at module
+     * scope — a model id, a required credential — throws without it. eve does not
+     * load .env.local itself, so running this with a bare environment reported a
+     * healthy agent as a failed discovery, on a host where the service starts it
+     * correctly every time. That red is the one thing a person is told must be
+     * green before going further, so it stopped a deployment that was fine.
+     *
+     * `env` here is the same merged view every other check reads: .env.local
+     * underneath, the real environment on top.
+     */
+    const info = capture("npx", ["eve", "info"], cwd, env);
+    if (info === null) {
+        add("fail", "eve info failed", "run: set -a && . ./.env.local && set +a && npx eve info — the agent's own error is in that output");
+    }
     else {
         const diag = /Diagnostics\s+(\d+) errors?, (\d+) warnings?/.exec(info);
         if (diag && diag[1] === "0")

package/dist/init.js

@@ -209,6 +209,30 @@ export async function init(rawName, options = {}) {
         catch {
             console.log(yellow("  ! could not install scripts/eve-server.sh — copy it from node_modules/@kybernesis/exe/scripts/"));
         }
+        /**
+         * The Claude subscription, as a script rather than a procedure.
+         *
+         * Same reasoning as the restart script above, and the same history: the
+         * provider (`claudeSubscription()`) was generalised into @kybernesis/exe
+         * after the first agent used it, but STANDING THE PROXY UP stayed a thing
+         * someone did by hand on one VM. So the capability was in every agent's
+         * packages while the only written procedure was a patch README telling the
+         * next person to clone a third-party repository — which is how a client
+         * ends up being walked through a git checkout by their consultant.
+         *
+         * Installed unconditionally for an exe host: it costs one file, and the
+         * alternative is rediscovering the procedure per deployment.
+         */
+        try {
+            const proxySource = join(dir, "node_modules/@kybernesis/exe/scripts/claude-subscription.sh");
+            const proxyTarget = join(dir, "scripts/claude-subscription.sh");
+            copyFileSync(proxySource, proxyTarget);
+            chmodSync(proxyTarget, 0o755);
+            console.log(dim("     scripts/claude-subscription.sh — put this agent on a Claude subscription, no API key"));
+        }
+        catch {
+            console.log(yellow("  ! could not install scripts/claude-subscription.sh — copy it from node_modules/@kybernesis/exe/scripts/"));
+        }
         /**
          * Point the management routes at that script.
          *

package/dist/util.d.ts

@@ -11,7 +11,7 @@ export declare function run(command: string, args: string[], options?: {
     allowFail?: boolean;
     quiet?: boolean;
 }): boolean;
-export declare function capture(command: string, args: string[], cwd?: string): string | null;
+export declare function capture(command: string, args: string[], cwd?: string, extraEnv?: Record<string, string>): string | null;
 export declare function ask(question: string, fallback: string): Promise<string>;
 export declare function closePrompts(): void;
 /** Parse KEY="value" / KEY=value lines from an env file's contents. */

package/dist/util.js

@@ -24,8 +24,12 @@ export function run(command, args, options) {
     }
     return ok;
 }
-export function capture(command, args, cwd) {
-    const result = spawnSync(command, args, { cwd, encoding: "utf8", env: process.env });
+export function capture(command, args, cwd, extraEnv) {
+    const result = spawnSync(command, args, {
+        cwd,
+        encoding: "utf8",
+        env: extraEnv ? { ...process.env, ...extraEnv } : process.env,
+    });
     return result.status === 0 ? result.stdout : null;
 }
 let rl = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent — plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",

package/skills/fde-engagement/references/playbook.md

@@ -1968,6 +1968,53 @@ nowhere in its context. Verify from the host — the configured model id and the
 credential in use — never by asking the agent. Expect a client to ask it in a
 demo, and have the real answer ready.
 
+**Claude, on a Claude Max / Pro / Claude Code subscription.** The one that is
+a process rather than a file. Anthropic's billing validator accepts an OAuth
+bearer *instead of* an API key, and that bearer expires — so something has to
+own the refresh. A small proxy holds Claude Code's own credentials, refreshes
+them, and swaps them in; the agent speaks ordinary Anthropic API to loopback and
+never holds a long-lived secret.
+
+```bash
+# on the host, installed by kyb init for an exe host
+bash scripts/claude-subscription.sh up
+bash scripts/claude-subscription.sh login     # "Sign in with Claude", never an API key
+bash scripts/claude-subscription.sh status    # signed in? bound to loopback?
+```
+
+```ts title="agent/agent.ts"
+import { createAnthropic } from "@ai-sdk/anthropic";
+import { claudeSubscription, CLAUDE_SUBSCRIPTION_CONTEXT_WINDOW } from "@kybernesis/exe";
+
+export default defineAgent({
+  model: claudeSubscription({ model: "claude-opus-5", createAnthropic }),
+  modelContextWindowTokens: CLAUDE_SUBSCRIPTION_CONTEXT_WINDOW,
+});
+```
+
+Four things to know before you promise it:
+
+- **The exe LLM integration also serves `anthropic/*` ids, and that is NOT this.**
+  It reaches Anthropic through a gateway, which bills metered usage. Same model,
+  entirely different invoice. If the point is that the client pays nothing
+  incremental, it has to be the proxy.
+- **If the agent searches the web, build the patched image** —
+  `scripts/claude-subscription.sh build-patched`. The published proxy renames
+  provider-defined tools, which Anthropic validates by name, and the failure
+  (`tools.N.web_search_20250305.name: Input should be 'web_search'`) reads like
+  a bug in the agent's own tool definitions.
+- **The sign-in is per host and interactive** — a browser step, once, in the
+  container. It survives restarts because it lives in a named volume, but a new
+  VM needs its own.
+- **It is a process to keep alive.** If the container stops, every turn fails
+  with a connection error from inside the model SDK, which reads like the model
+  being down. `hostPreflight({ claudeProxyUrl })` asks about it at boot; the
+  restart policy keeps it up.
+
+Scope it honestly with the client: this is their own subscription, on their own
+infrastructure, for their own agent. It is not a shared gateway or a resale of
+Anthropic access, and it should not be built as one.
+
 ### 11.5 Third-party APIs: broker the credential, pin the version
 
 Do not put a client's API token on the agent host. Put it in an exe.dev