@kybernesis/create 0.13.4 → 0.14.1

package/dist/upgrade.js

@@ -1,6 +1,10 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { upsertEnv } from "./envfile.js";
+import { reconcileHostArtifact } from "./host-artifacts.js";
+import { repairManageRestart } from "./systemd.js";
+import { repairTerminalSandboxCleanupHooks } from "./sandbox-cleanup.js";
+import { repairRemovedDefaultTools as repairRemovedDefaultTools_ } from "./removed-default-tools.js";
 import { EVE_VERSION, bold, capture, dim, green, red, run, yellow } from "./util.js";
 /**
  * Which packages to upgrade: every `@kybernesis/*` this agent depends on.
@@ -179,54 +183,125 @@ function repairBuzzSetup(cwd, deps) {
         console.log(`    ${dim("Takes effect after the next build and restart.")}\n`);
     }
 }
+/** Quote one argument for the manual shell commands printed after a failed repair. */
+function shellQuote(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
 /**
- * Keep the agent host from filling up with what the runtime leaves behind.
- *
- * @remarks
- * eve builds a sandbox template image per session configuration and never
- * collects the old ones, and it leaves session CONTAINERS running — a turn that
- * took four minutes can still own a container, and its writable layer, eight
- * days later. Forty stale images accumulated on one agent in a week; another
- * reached 94% full and began failing in ways that looked like anything but a
- * disk problem. Every self-hosted agent hits this; it is a property of the
- * runtime, not of any one deployment.
- *
- * Installed rather than documented, and DAILY rather than weekly, because the
- * accumulation is measured in gigabytes per day on an agent doing real work.
- * The first version of this ran weekly and was already too slow.
+ * eve 0.39 removed glob and grep from the default tool set; see
+ * removed-default-tools.ts. Runs before typecheck because a stale disable
+ * file is a compile error from 0.39 on, and an upgrade must never leave an
+ * agent that cannot build.
  */
-function repairDockerPrune(cwd, deps) {
+function repairRemovedDefaultTools(cwd) {
+    const { removed, optedIn } = repairRemovedDefaultTools_(cwd);
+    for (const file of removed) {
+        console.log(`  ${green("-")} removed ${file} ${dim("(disabled a tool eve no longer provides by default; a compile error from eve 0.39)")}`);
+    }
+    for (const file of optedIn) {
+        console.log(`  ${green("+")} wrote ${file} ${dim("(keeps the tool this scope had on eve 0.38)")}`);
+    }
+    if (removed.length || optedIn.length)
+        console.log();
+}
+function repairSandboxCleanupHooks(cwd, deps) {
     if (!deps["@kybernesis/exe"])
         return;
-    if (capture("sh", ["-c", "command -v docker >/dev/null && echo yes"])?.trim() !== "yes")
+    const added = repairTerminalSandboxCleanupHooks(cwd);
+    if (added.length === 0)
         return;
-    const installed = capture("sh", ["-c", "test -x /etc/cron.daily/kyb-docker-prune && echo yes"]);
-    if (installed?.trim() === "yes")
-        return;
-    const source = join(cwd, "node_modules/@kybernesis/exe/scripts/docker-prune.sh");
-    if (!existsSync(source))
+    console.log(`  ${green("+")} installed terminal sandbox cleanup for ${added.length} agent scope(s) ` +
+        `${dim("(completed and failed sessions only)")}\n`);
+}
+/**
+ * Keep package-owned host files synchronized with the package that installed them.
+ *
+ * Existing artifacts are compared even when the capability they support is
+ * temporarily unavailable. Missing cron installation remains Docker-gated, and
+ * a missing systemd unit remains an explicit operator choice.
+ */
+function repairHostArtifacts(cwd, deps) {
+    if (!deps["@kybernesis/exe"])
         return;
-    // `sudo -n`: this runs inside an upgrade, and an upgrade that stops to ask
-    // for a password in the middle of an unattended run is worse than one that
-    // says what it could not do.
-    const ok = run("sh", [
-        "-c",
-        // The weekly predecessor is removed in the same breath: two jobs pruning
-        // the same host is not twice as safe, it is one more thing to reason
-        // about when something unexpected disappears.
-        `sudo -n cp ${JSON.stringify(source)} /etc/cron.daily/kyb-docker-prune && ` +
-            `sudo -n chmod 755 /etc/cron.daily/kyb-docker-prune && ` +
-            `sudo -n rm -f /etc/cron.weekly/docker-prune`,
-    ], { cwd, allowFail: true, quiet: true });
-    if (ok) {
-        console.log(`  ${green("+")} installed the daily docker reclaim (/etc/cron.daily/kyb-docker-prune)`);
-        console.log(`    ${dim("eve leaves sandbox images and running session containers behind; this collects them.")}\n`);
+    const scripts = join(cwd, "node_modules/@kybernesis/exe/scripts");
+    const pruneSource = join(scripts, "docker-prune.sh");
+    const pruneTarget = "/etc/cron.daily/kyb-docker-prune";
+    const hasDocker = capture("sh", ["-c", "command -v docker >/dev/null && echo yes"])?.trim() === "yes";
+    if (existsSync(pruneSource)) {
+        const pruneResult = reconcileHostArtifact({
+            targetPath: pruneTarget,
+            desiredContent: readFileSync(pruneSource),
+            expectedMode: 0o755,
+            installIfMissing: hasDocker,
+            owner: "@kybernesis/exe/scripts/docker-prune.sh",
+            update: () => run("sudo", ["-n", "install", "-m", "0755", pruneSource, pruneTarget], {
+                cwd,
+                allowFail: true,
+                quiet: true,
+            }),
+            manualCommand: `sudo install -m 0755 ${shellQuote(pruneSource)} ${pruneTarget}`,
+        });
+        if ((pruneResult === "current" || pruneResult === "updated") && existsSync("/etc/cron.weekly/docker-prune")) {
+            const removed = run("sudo", ["-n", "rm", "-f", "/etc/cron.weekly/docker-prune"], {
+                cwd,
+                allowFail: true,
+                quiet: true,
+            });
+            if (!removed) {
+                console.log(`  ${yellow("!")} the daily docker reclaim is current, but the legacy weekly job remains. Run:\n` +
+                    `    ${dim("sudo rm -f /etc/cron.weekly/docker-prune")}`);
+            }
+        }
     }
-    else {
-        console.log(`  ${yellow("!")} could not install the docker reclaim job (needs sudo). Without it this host ` +
-            `fills with stale sandbox images. Run:\n` +
-            `    ${dim("sudo cp node_modules/@kybernesis/exe/scripts/docker-prune.sh /etc/cron.daily/kyb-docker-prune && sudo chmod 755 /etc/cron.daily/kyb-docker-prune")}`);
+    const serviceScript = join(scripts, "install-service.sh");
+    if (!existsSync(serviceScript))
+        return;
+    const unitTarget = capture("bash", [serviceScript, "--unit-path"], cwd)?.trim();
+    const unitContent = capture("bash", [serviceScript, "--print-unit"], cwd);
+    const marker = capture("bash", [serviceScript, "--managed-marker"], cwd)?.trim();
+    if (!unitTarget || unitContent === null || !marker)
+        return;
+    /**
+     * Only a unit this package wrote is this package's to rewrite.
+     *
+     * Every host from before the installer existed has a hand-written unit —
+     * some with Environment= lines the renderer knows nothing about. Reconciling
+     * those would report "drifted (content)" and replace them, and a warning
+     * that scrolls past in the middle of an upgrade is not consent. The marker
+     * is the first line of every generated unit; a unit without it is reported
+     * and left exactly as it is.
+     */
+    if (existsSync(unitTarget)) {
+        let installed;
+        try {
+            installed = readFileSync(unitTarget, "utf8");
+        }
+        catch (error) {
+            console.log(`  ${yellow("!")} could not read ${unitTarget} to check whether it is package-managed ` +
+                `(${error.message}); leaving it alone.`);
+            return;
+        }
+        if (!installed.includes(marker)) {
+            console.log(`  ${yellow("!")} ${unitTarget} was not written by @kybernesis/exe, so it was left as is.\n` +
+                `    To adopt the package-managed unit (the current file is kept at ${unitTarget}.bak):\n` +
+                `    ${dim(`bash ${shellQuote(serviceScript)} --refresh-unit`)}\n` +
+                `    Host-specific settings belong in a drop-in: ${dim(`sudo systemctl edit <name>-agent`)}`);
+            return;
+        }
     }
+    reconcileHostArtifact({
+        targetPath: unitTarget,
+        desiredContent: Buffer.from(unitContent),
+        expectedMode: 0o644,
+        installIfMissing: false,
+        owner: "@kybernesis/exe/scripts/install-service.sh",
+        update: () => run("env", ["KYB_NONINTERACTIVE=1", "bash", serviceScript, "--refresh-unit"], {
+            cwd,
+            allowFail: true,
+            quiet: true,
+        }),
+        manualCommand: `bash ${shellQuote(serviceScript)} --refresh-unit`,
+    });
 }
 export async function upgrade(skipEval) {
     const cwd = process.cwd();
@@ -286,6 +361,7 @@ export async function upgrade(skipEval) {
         console.log(`\n${yellow(`Checked what could be read. ${unresolved.length} package(s) could not be ` +
             `resolved, so this is not a clean bill of health.`)}\n` +
             `  ${dim("Usually: dependencies are not installed here. Run npm install, then kyb upgrade.")}\n`);
+        repairManageRestart(cwd, deps);
         return;
     }
     if (toUpgrade.length === 0) {
@@ -293,11 +369,24 @@ export async function upgrade(skipEval) {
         // Still repair: being on the right versions is not the same as being set
         // up. An agent can sit at latest for weeks with a capability switched off.
         repairBuzzSetup(cwd, deps);
-        repairDockerPrune(cwd, deps);
+        repairRemovedDefaultTools(cwd);
+        repairSandboxCleanupHooks(cwd, deps);
+        repairHostArtifacts(cwd, deps);
+        repairManageRestart(cwd, deps);
         return;
     }
     console.log(bold(`\nInstalling: ${toUpgrade.join(", ")}\n`));
-    run("npm", ["install", ...toUpgrade], { cwd });
+    /**
+     * One install, with peers relaxed. Every @kybernesis package peers on a
+     * narrow eve range, and eve moves with them: the installed set demands the
+     * old eve, the new set demands the new one, and npm's resolver refuses
+     * either order — eve first, packages first, or all at once — under strict
+     * peers (seen on Kyber moving 0.38 → 0.49: ERESOLVE all three ways). The
+     * set being installed is exactly the certified combination, so relaxing
+     * peer resolution for this one command changes nothing about what ends up
+     * on disk; the version check above is what guards correctness.
+     */
+    run("npm", ["install", ...toUpgrade, "--legacy-peer-deps"], { cwd });
     /**
      * Repairs run AFTER the install, not before.
      *
@@ -308,7 +397,10 @@ export async function upgrade(skipEval) {
      * bug that hides itself, because by then it looks like it always worked.
      */
     repairBuzzSetup(cwd, deps);
-    repairDockerPrune(cwd, deps);
+    repairRemovedDefaultTools(cwd);
+    repairSandboxCleanupHooks(cwd, deps);
+    repairHostArtifacts(cwd, deps);
+    repairManageRestart(cwd, deps);
     run("npm", ["run", "typecheck"], { cwd });
     if (eveChanged) {
         // A framework bump must also pass discovery/compile, not just types.

package/dist/util.d.ts

@@ -1,4 +1,4 @@
-export declare const EVE_VERSION = "0.38.3";
+export declare const EVE_VERSION = "0.49.0";
 export declare const REGISTRY_URL = "https://registry.kybernesis.ai/r/{name}.json";
 export declare const DEFAULT_ISSUER = "https://agent.kybernesis.ai";
 export declare const green: (s: string) => string;

package/dist/util.js

@@ -1,6 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { createInterface } from "node:readline/promises";
-export const EVE_VERSION = "0.38.3";
+export const EVE_VERSION = "0.49.0";
 export const REGISTRY_URL = "https://registry.kybernesis.ai/r/{name}.json";
 export const DEFAULT_ISSUER = "https://agent.kybernesis.ai";
 const TTY = process.stdout.isTTY === true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.13.4",
+  "version": "0.14.1",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent — plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",
@@ -33,7 +33,8 @@
     "build": "tsc -p tsconfig.build.json",
     "prepack": "tsc -p tsconfig.build.json",
     "typecheck": "tsc --noEmit",
-    "prepublishOnly": "node ../../scripts/prepublish.mjs"
+    "prepublishOnly": "node ../../scripts/prepublish.mjs",
+    "test": "node --test \"test/**/*.test.mjs\""
   },
   "devDependencies": {
     "@types/node": "24.x",

package/skills/fde-engagement/references/playbook.md

@@ -188,7 +188,7 @@ something. Chase them a week out — an unprovisioned Vercel team on Day 1 costs
       `@kybernesis/arcana@0.1.1`, `@kybernesis/enterprise@0.1.2`,
       `@kybernesis/multiplayer@0.1.0`, `@kybernesis/evals@0.2.1`,
       `@kybernesis/create@0.1.4`, `@kybernesis/engineer@0.2.0`, and
-      `eve@0.38.3` (the Kybernesis-certified version). All public on npm;
+      `eve@0.49.0` (the Kybernesis-certified version). All public on npm;
       `kyb doctor` checks the wiring.
 
 ---
@@ -354,8 +354,8 @@ npx eve registry view @kybernesis/arcana
 ### 3.4 Pin your versions
 
 Before you install anything else, decide and record the versions this engagement pins.
-Put them in the repo README. Pin `eve@0.38.3` — the **Kybernesis-certified** version
-(certification run 2026-08-17: full suite green; one schedule API change, see HANDOFF). Never pin blind
+Put them in the repo README. Pin `eve@0.49.0` — the **Kybernesis-certified** version
+(certification run 2026-09-01: full suite green; one schedule API change, see HANDOFF). Never pin blind
 npm-latest; `kyb upgrade` carries a client to the certified pin behind their own eval
 gate, and that upgrade is a **deliberate, eval-gated step**, never something that
 happens by accident mid-pilot.

package/skills/kybernesis-packages/SKILL.md

@@ -10,7 +10,10 @@ Twelve packages, npm-public under `@kybernesis`, Apache-2.0, monorepo
 then `eve add @kybernesis/<item>`). Each covers one axis:
 
 - **arcana** — memory. Extension mount `arcana({ apiKey, workspace,
-  resolveWorkspace? })`. Workspace-scoped `kb_` keys (403 outside their
+  resolveWorkspace? })`; from eve 0.49 also a memory PROVIDER:
+  `arcanaMemory()` from `@kybernesis/arcana/memory` in an `agent/memory/*.ts`
+  slot (`kyb add memory` writes it) — recall before every turn, skipped
+  under 4 words, capture off by default, tools left to the extension. Workspace-scoped `kb_` keys (403 outside their
   workspace — one key per brain). `resolveWorkspace` only from VERIFIED
   session context, never model output, and only key-reachable workspaces.
   Subagents: local extension mount (`subagents/<id>/extensions/arcana.ts`,
@@ -127,7 +130,7 @@ then `eve add @kybernesis/<item>`). Each covers one axis:
   asterisks onto the URL in Slack and breaks it. Coach agents in prose, not
   shell (WAFs eat shell-syntax Slack messages).
 - **ESM packaging**: relative imports need `.js` extensions (tsc doesn't
-  rewrite); eve is a peer dep with an explicit range (`>=0.38.0 <0.39.0`),
+  rewrite); eve is a peer dep with an explicit range (`>=0.49.0 <0.50.0`),
   pinned exactly in devDeps.
 - **Eval fixtures are hardened on purpose** — in-test nonces (eve caches
   compiled eval modules), per-run unique keys (workspaces accumulate),