@kybernesis/create 0.12.3 → 0.13.0

package/dist/doctor.js

@@ -275,6 +275,32 @@ export async function doctor() {
         else {
             add("fail", `self-hosted: ${shortQueueTimeouts.join(" and ")} left at the 30s default`, "one queue delivery holds a connection open for the entire turn, so any turn slower than the timeout is redelivered and its steps re-run — the agent answers the same question twice, with two different answers, and nothing reports an error. Set both to 900000 in .env.local and restart the server");
         }
+        /**
+         * Instructions that name a tool the agent does not have.
+         *
+         * `deliver` mounts with the engineer layer, which is mounted on the builder
+         * subagent — so an agent whose ROOT is told to hand over files (by its own
+         * instructions, or by our playbook, which says to) promises a file it
+         * cannot send. It cannot see the mismatch either: it writes the contents to
+         * a memory note, or apologises without a cause, and the delivery
+         * infrastructure passes every check while nobody can receive anything.
+         */
+        const rootDeliver = existsSync(join(cwd, "agent/tools/deliver.ts"));
+        const instructionsMentionDeliver = (() => {
+            try {
+                const dir = join(cwd, "agent/instructions");
+                return readdirSync(dir).some((file) => readFileSync(join(dir, file), "utf8").includes("deliver"));
+            }
+            catch {
+                return false;
+            }
+        })();
+        if (instructionsMentionDeliver && !rootDeliver) {
+            add("fail", "instructions tell this agent to deliver files, but the root has no deliver tool", 'add agent/tools/deliver.ts: export { deliver as default } from "@kybernesis/engineer/tools" — the engineer layer mounts it on the builder subagent only');
+        }
+        else if (rootDeliver) {
+            add("pass", "the agent that talks to people can also hand them a file");
+        }
         // The exe VM sandbox backend needs a credential that cannot be scoped.
         // Surface the blast radius here, where it is still cheap to change course.
         const sandboxFile = join(cwd, "agent/sandbox/sandbox.ts");
@@ -350,7 +376,11 @@ export async function doctor() {
             add("fail", "engineer subagent has NO sandbox of its own", "subagents do not inherit the root sandbox — add agent/subagents/builder/sandbox/sandbox.ts or the vision loop cannot run");
         }
         if (existsSync(join(builderDir, "extensions/engineer.ts"))) {
-            add("pass", "engineer mounted locally on the subagent (root keeps no shell)");
+            // Not "the root keeps no shell": every eve agent has a sandbox with bash,
+            // read_file, write_file, glob and grep. What the local mount withholds is
+            // the build loop and any shell ON THE HOST. This sentence is one people
+            // reason about security boundaries from, so it says the true thing.
+            add("pass", "engineer mounted locally on the subagent (root gets no host shell, no build loop)");
         }
         else {
             add("warn", "engineer extension not mounted on the subagent", "agent/subagents/builder/extensions/engineer.ts");

package/dist/templates.js

@@ -513,18 +513,39 @@ export default defineAgent({
     "Builds and runs software: scaffolds projects, writes code, installs dependencies, runs builds and dev servers, and visually verifies rendered pages. Use when the user asks for something to be BUILT, prototyped, deployed, or fixed in code — not for questions, planning, or scheduling.",
   model: ${JSON.stringify(model)},
 });
+`,
+        },
+        {
+            path: "agent/tools/deliver.ts",
+            content: `// Handing a file to the person you are talking to.
+//
+// The engineer layer mounts on \`builder\`, so building stays there — but
+// DELIVERING is not building. It reads one file from this agent's own sandbox
+// and copies it to storage, runs no commands and writes nothing back, and the
+// agent that needs it is the one talking to the user.
+//
+// Without this the root is told (by its instructions, and by our own playbook)
+// to deliver files and has no such tool. It cannot detect the mismatch, so it
+// promises a file and then quietly puts the contents somewhere nobody can
+// reach — a memory note, or an apology with no cause given.
+export { deliver as default } from "@kybernesis/engineer/tools";
 `,
         },
         {
             path: "agent/subagents/builder/extensions/engineer.ts",
             content: `// Engineer layer mounted LOCALLY on this subagent (eve >=0.30): screenshot,
 // deliver, and the trade-school skills belong to \`builder\` alone, so the root
-// agent has no shell.
+// gets no shell ON THE HOST and none of the build loop.
+//
+// Not "the root has no shell" — every eve agent has a sandbox with bash,
+// read_file, write_file, glob and grep, and this app builds two templates
+// (root and builder). The root's shell is its own container. The distinction
+// that matters is host access, and the old wording blurred exactly the line
+// people read this comment to understand.
 //
 // The root DOES get a browser and GitHub tools — the engineer layer installs
 // extension/agent-browser and extension/github-tools at the root, deliberately,
 // because reading a page is not the same blast radius as running a command.
-// This comment used to claim otherwise, which is worse than saying nothing.
 export { default } from "@kybernesis/engineer";
 `,
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.12.3",
+  "version": "0.13.0",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent — plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",

package/skills/fde-engagement/references/playbook.md

@@ -2052,9 +2052,23 @@ tool. Reads went from unreliable to deterministic with about sixty lines.
 ### 11.6 The engineer layer, self-hosted
 
 `--engineer` scaffolds a **builder subagent** that owns the build capability, so
-the root agent never gets a shell. It comes with the full production loop —
-workshop sandbox, Playwright, screenshots, visual verification, delivery — not a
-reduced version of the Vercel one.
+the root agent gets **no shell on the host and no build loop**. It comes with the
+full production loop — workshop sandbox, Playwright, screenshots, visual
+verification, delivery — not a reduced version of the Vercel one.
+
+> Say it that way rather than "the root never gets a shell". Every eve agent has
+> a sandbox with `bash`, `read_file`, `write_file`, `glob` and `grep`, and an
+> `--engineer` app builds two templates. The root's shell is its own container.
+> The line that matters is host access, and the shorter phrasing blurs exactly
+> the boundary people quote this passage to explain.
+
+**Delivery belongs to the root as well.** The engineer layer mounts on `builder`,
+but the agent that talks to people is the one asked for files — and delivering
+reads one file and copies it, which is not the blast radius that justified
+keeping the build loop away from the root. `kyb init --engineer` now scaffolds
+`agent/tools/deliver.ts` for exactly this. An agent instructed to hand over files
+without that mount cannot tell it is missing: it writes the contents to a memory
+note and reports success.
 
 - **Subagents own their sandbox; they do NOT inherit the root's.** A builder
   without its own `sandbox/sandbox.ts` gets a bare template and every screenshot