@kybernesis/create 0.16.0 → 0.17.0

package/README.md

@@ -97,7 +97,7 @@ Before an eve version change, upgrade reads `.eve/.workflow-data/runs`, prints
 sessions when available, and requires explicit confirmation. Noninteractive
 runs fail closed unless `--yes` (or `-y`) is supplied. The warning is still printed with
 `--yes` and is not bypassed by `--skip-eval`. Existing direct `eve eval` scripts
-are migrated to `kyb-eval`; custom scripts are left untouched with a manual fix.
+are migrated to `kyb-eval` (shipped as a binary of this package from 0.17); custom scripts are left untouched with a manual fix.
 The wrapper counts corruption diagnostics beside the eval result and turns a
 nominally green eve exit into a failure when condemned durable state was seen.
 It also identifies failures from `judge.autoevals.*` assertions as judge

package/dist/agent-limits.js

@@ -10,7 +10,10 @@ export const CERTIFIED_INHERITED_MAX_INPUT_TOKENS_PER_SESSION = 40_000_000;
 export function parseEveInfoInspection(output, readText = (path) => readFileSync(path, "utf8")) {
     let info;
     try {
-        info = JSON.parse(output);
+        // eve ≥0.62 prints its terminal header ("☰eve  v0.68.0 …") ahead of the
+        // JSON even with --json, so parse from the first object literal.
+        const start = output.indexOf("{");
+        info = JSON.parse(start > 0 ? output.slice(start) : output);
     }
     catch (error) {
         return unresolved(`eve info --json was not valid JSON: ${error.message}`);

package/dist/doctor.js

@@ -313,7 +313,7 @@ export async function doctor() {
         const vercelConn = join(cwd, "agent/connections/vercel.ts");
         const selfHostedAgent = Boolean(deps["@kybernesis/exe"]) ||
             (existsSync(join(cwd, "agent/subagents/builder/sandbox/sandbox.ts")) &&
-                readFileSync(join(cwd, "agent/subagents/builder/sandbox/sandbox.ts"), "utf8").includes("docker("));
+                /docker\(|DockerSandbox/.test(readFileSync(join(cwd, "agent/subagents/builder/sandbox/sandbox.ts"), "utf8")));
         if (selfHostedAgent && !existsSync(vercelConn)) {
             add("pass", "no Vercel MCP connection (self-hosted)", "public deploys need the CLIENT's own Vercel token — Vercel Connect does not work off-Vercel");
         }
@@ -399,7 +399,7 @@ export async function doctor() {
     // deployment. None of them are theoretical.
     const selfHosted = Boolean(deps["@kybernesis/exe"]) ||
         existsSync(join(cwd, "agent/sandbox/sandbox.ts")) &&
-            readFileSync(join(cwd, "agent/sandbox/sandbox.ts"), "utf8").includes("docker(");
+            /docker\(|DockerSandbox/.test(readFileSync(join(cwd, "agent/sandbox/sandbox.ts"), "utf8"));
     const templateInspection = await inspectDockerTemplatesViaExe(cwd);
     for (const check of templateInspection ? dockerTemplateDoctorChecks(templateInspection) : []) {
         add(check.verdict, check.label, check.detail);

package/dist/eval-cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/eval-cli.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+/**
+ * `kyb-eval`: `eve eval` with the two checks eve's own exit code does not make.
+ *
+ * `kyb upgrade` migrates every agent's `scripts.eval` to this command and runs
+ * it as the deploy gate, and the README has described it since 0.14 — but no
+ * binary ever shipped, so a migrated agent's `npm run eval` failed with
+ * "command not found" and the gate reported red for the wrong reason.
+ *
+ * What it adds on top of `eve eval <args>`:
+ * - a nominally green run that logged condemned durable state
+ *   (`CORRUPTED_EVENT_LOG`, `REPLAY_DIVERGENCE`) exits 1 — those runs are
+ *   terminal and a suite that passed beside them proves less than it says;
+ * - a run whose failures are all judge errors (evaluation model unreachable,
+ *   HTTP failures from the judge provider) says so, rather than reading as the
+ *   agent under test failing.
+ */
+import { spawn } from "node:child_process";
+const CONDEMNED = /CORRUPTED_EVENT_LOG|REPLAY_DIVERGENCE/;
+const JUDGE_FAILURE = /judge[^\n]*(unreachable|ECONNREFUSED|fetch failed|HTTP \d{3}|Unauthenticated|no credentials|not valid)/i;
+function main() {
+    const args = process.argv.slice(2);
+    const child = spawn("npx", ["eve", "eval", ...args], { stdio: ["inherit", "pipe", "pipe"], env: process.env });
+    let condemned = 0;
+    let judgeFailures = 0;
+    const scan = (chunk, out) => {
+        const text = chunk.toString();
+        out.write(text);
+        for (const line of text.split("\n")) {
+            if (CONDEMNED.test(line))
+                condemned += 1;
+            if (JUDGE_FAILURE.test(line))
+                judgeFailures += 1;
+        }
+    };
+    child.stdout.on("data", (chunk) => scan(chunk, process.stdout));
+    child.stderr.on("data", (chunk) => scan(chunk, process.stderr));
+    child.on("error", (error) => {
+        console.error(`kyb-eval: could not start eve eval: ${error.message}`);
+        process.exit(2);
+    });
+    child.on("close", (code) => {
+        if (condemned > 0) {
+            console.error(`\nkyb-eval: ${condemned} condemned durable-state diagnostic(s) seen (CORRUPTED_EVENT_LOG / REPLAY_DIVERGENCE). ` +
+                "Those conversations are terminal; treating this run as red.");
+            process.exit(1);
+        }
+        if (code !== 0 && judgeFailures > 0) {
+            console.error(`\nkyb-eval: ${judgeFailures} judge failure(s) seen — the evaluation model was unreachable or refused, ` +
+                "which is a judge-reachability problem, not evidence that the agent under test failed. Fix the judge, then rerun.");
+        }
+        process.exit(code ?? 1);
+    });
+}
+main();

package/dist/removed-default-tools.d.ts

@@ -27,3 +27,15 @@ export interface RemovedDefaultToolsRepair {
     optedIn: string[];
 }
 export declare function repairRemovedDefaultTools(cwd: string): RemovedDefaultToolsRepair;
+/**
+ * eve 0.65 took `ask_question` out of the default tool set and made it an
+ * opt-in workflow tool (`eve add tool/ask_question`). An agent certified on an
+ * earlier line had it everywhere, and the notify hooks, the Buzz approval
+ * bridge and the Studio question cards all key on that tool name — so every
+ * scope that could ask keeps the tool, and a stale `disableTool()` file (a
+ * build error from 0.65) is removed.
+ */
+export declare const OPT_IN_TOOLS_SINCE: {
+    readonly ask_question: "0.65.0";
+};
+export declare function repairOptInTools(cwd: string, eveVersion: string): RemovedDefaultToolsRepair;

package/dist/removed-default-tools.js

@@ -84,3 +84,52 @@ export function repairRemovedDefaultTools(cwd) {
     }
     return { removed, optedIn };
 }
+/**
+ * eve 0.65 took `ask_question` out of the default tool set and made it an
+ * opt-in workflow tool (`eve add tool/ask_question`). An agent certified on an
+ * earlier line had it everywhere, and the notify hooks, the Buzz approval
+ * bridge and the Studio question cards all key on that tool name — so every
+ * scope that could ask keeps the tool, and a stale `disableTool()` file (a
+ * build error from 0.65) is removed.
+ */
+export const OPT_IN_TOOLS_SINCE = { ask_question: "0.65.0" };
+function askQuestionSource() {
+    return [
+        "// eve 0.65 made ask_question an opt-in tool. This agent asked people questions",
+        "// on the certified earlier line, so it keeps the tool (kyb upgrade wrote this).",
+        'import { askQuestion } from "eve/tools/ask_question";',
+        "",
+        "export default askQuestion();",
+        "",
+    ].join("\n");
+}
+export function repairOptInTools(cwd, eveVersion) {
+    const removed = [];
+    const optedIn = [];
+    if (versionAtLeast(eveVersion, OPT_IN_TOOLS_SINCE.ask_question)) {
+        for (const scope of agentScopes(cwd)) {
+            const tools = join(scope, "tools");
+            const file = join(tools, "ask_question.ts");
+            if (existsSync(file)) {
+                if (isDisableToolFile(file)) {
+                    unlinkSync(file);
+                    removed.push(relative(cwd, file));
+                }
+                continue;
+            }
+            mkdirSync(tools, { recursive: true });
+            writeFileSync(file, askQuestionSource());
+            optedIn.push(relative(cwd, file));
+        }
+    }
+    return { removed, optedIn };
+}
+function versionAtLeast(version, floor) {
+    const parse = (v) => v.replace(/^[^\d]*/, "").split("-")[0].split(".").map((n) => Number(n) || 0);
+    const a = parse(version), b = parse(floor);
+    for (let i = 0; i < 3; i++) {
+        if ((a[i] ?? 0) !== (b[i] ?? 0))
+            return (a[i] ?? 0) > (b[i] ?? 0);
+    }
+    return true;
+}

package/dist/templates.js

@@ -456,28 +456,26 @@ export function hostSteps(host, name, model) {
 function workshopSandbox(host) {
     if (host === "exe") {
         return `import { defineSandbox } from "eve/sandbox";
-import { docker } from "eve/sandbox/docker";
+import { DockerSandbox } from "eve/sandbox/docker";
 
 /**
  * The engineer workshop, self-hosted: pnpm + Playwright + Chromium baked into
- * the TEMPLATE so warm sessions run render→screenshot→vision in seconds.
+ * the ENVIRONMENT (prepared once at build, inherited by every session) so warm
+ * sessions run render→screenshot→vision in seconds.
  *
- * Docker rather than vercel(): the hosted backend needs Vercel OIDC, which does
- * not exist off-Vercel.
+ * Docker rather than Vercel Sandbox: the hosted provider needs Vercel OIDC,
+ * which does not exist off-Vercel.
  *
  * HOST PREREQUISITE: some images ship Docker disabled (exe.dev's exeuntu runs
  * \`systemctl disable docker.service\`). Run \`sudo systemctl enable --now docker\`
  * or every build fails with SandboxTemplateNotProvisionedError.
  *
  * NOTE: Docker sessions do not enforce a domain allowlist the way the hosted
- * backend does. Egress control is the HOST's responsibility here — a deliberate
+ * provider does. Egress control is the HOST's responsibility here — a deliberate
  * difference from the Vercel deployment, not an oversight.
  */
-export default defineSandbox({
-  backend: docker(),
-  revalidationKey: () => "kybernesis-workshop-v5-docker",
-  async bootstrap({ use }) {
-    const sandbox = await use();
+export const environment = DockerSandbox.environment({
+  prepare: async (sandbox) => {
     // Base image is Debian-family; refresh indexes before installing browser deps.
     await sandbox.run({ command: "apt-get update" });
     await sandbox.run({ command: "npm install -g pnpm" });
@@ -492,28 +490,49 @@ export default defineSandbox({
     });
   },
 });
+
+export default defineSandbox(() => environment.open());
 `;
     }
     return `import { defineSandbox } from "eve/sandbox";
-import { vercel } from "eve/sandbox/vercel";
+import { VercelSandbox } from "eve/sandbox/vercel";
 
 /**
  * The engineer workshop: a warm, safe cloud dev machine.
  *
- * TEMPLATE bootstrap (once, inherited by every session): pnpm + Playwright +
- * Chromium. Prewarm runs at deploy time, so a broken bootstrap fails the build
- * loudly and warm sessions run the full render→screenshot→vision loop in
- * seconds. Backend PINNED to Vercel Sandbox — hosted sandboxes even from local
- * dev (run \`vercel link\` + \`vercel env pull\` first), so evals exercise the
- * exact production backend. No Docker anywhere.
+ * ENVIRONMENT preparation (once at build, inherited by every session): pnpm +
+ * Playwright + Chromium. Preparation runs at deploy time, so a broken recipe
+ * fails the build loudly and warm sessions run the full render→screenshot→
+ * vision loop in seconds. Provider PINNED to Vercel Sandbox — hosted sandboxes
+ * even from local dev (run \`vercel link\` + \`vercel env pull\` first), so evals
+ * exercise the exact production provider. No Docker anywhere.
  *
  * All sessions run under a domain ALLOWLIST: an agent that installs arbitrary
  * npm packages must not have open egress. A blocked domain fails loudly;
  * treat every addition as a security decision.
  */
-export default defineSandbox({
-  backend: vercel({
-    resources: { vcpus: 4 },
+export const environment = VercelSandbox.environment({
+  resources: { vcpus: 4 },
+  prepare: async (sandbox) => {
+    // The egress proxy carries HTTPS only; apt defaults to http:// mirrors, so
+    // every index fetch silently fails. Rewrite to https first.
+    await sandbox.run({
+      command:
+        "find /etc/apt -type f \\\\( -name '*.list' -o -name '*.sources' \\\\) -exec sed -i 's|http://|https://|g' {} + && apt-get update",
+    });
+    await sandbox.run({ command: "npm install -g pnpm" });
+    await sandbox.run({
+      command:
+        "mkdir -p /workspace/.shot && cd /workspace/.shot && echo '{\\"name\\":\\"kyb-shot\\",\\"private\\":true}' > package.json && npm install playwright",
+    });
+    await sandbox.run({
+      command: "cd /workspace/.shot && npx playwright install --with-deps chromium",
+    });
+  },
+});
+
+export default defineSandbox(() =>
+  environment.open({
     networkPolicy: {
       allow: [
         "registry.npmjs.org",
@@ -541,25 +560,7 @@ export default defineSandbox({
       ],
     },
   }),
-  revalidationKey: () => "kybernesis-workshop-v5",
-  async bootstrap({ use }) {
-    const sandbox = await use();
-    // The egress proxy carries HTTPS only; apt defaults to http:// mirrors, so
-    // every index fetch silently fails. Rewrite to https first.
-    await sandbox.run({
-      command:
-        "find /etc/apt -type f \\\\( -name '*.list' -o -name '*.sources' \\\\) -exec sed -i 's|http://|https://|g' {} + && apt-get update",
-    });
-    await sandbox.run({ command: "npm install -g pnpm" });
-    await sandbox.run({
-      command:
-        "mkdir -p /workspace/.shot && cd /workspace/.shot && echo '{\\"name\\":\\"kyb-shot\\",\\"private\\":true}' > package.json && npm install playwright",
-    });
-    await sandbox.run({
-      command: "cd /workspace/.shot && npx playwright install --with-deps chromium",
-    });
-  },
-});
+);
 `;
 }
 export function engineerPlan(host, model) {
@@ -671,7 +672,8 @@ export default defineEvalConfig({
   // Verified against the exe integration rather than assumed: it validates model
   // names and refuses one it does not carry, so a stale default here fails the
   // whole suite at the judge rather than at anything the agent did.
-  judge: { model: exe(process.env.EXE_JUDGE_MODEL ?? "claude-sonnet-5") },
+  // eve ≥0.62 grades with an EVALUATION model, not a language model instance.
+  judge: { model: exe.evaluationModel(process.env.EXE_JUDGE_MODEL ?? "claude-sonnet-5") },
   // Real model and real memory on every turn: generous timeout, gentle concurrency.
   timeoutMs: 300_000,
   maxConcurrency: 1,
@@ -748,13 +750,15 @@ export { default } from "@kybernesis/notify/extension";
  */
 export function reasoningSandboxLibTs() {
     return `import { defineSandbox } from "eve/sandbox";
-import { justbash } from "eve/sandbox/just-bash";
+import { JustBashSandbox } from "eve/sandbox/just-bash";
 
 // The sandbox for a reasoning-only specialist: an instant virtual filesystem,
 // no Docker container. See agent/subagents/<id>/sandbox.ts, which re-export
-// this. Only subagents that do real build/git/network work keep a docker()
+// this. Only subagents that do real build/git/network work keep a Docker
 // sandbox of their own.
-export default defineSandbox({ backend: justbash() });
+export const environment = JustBashSandbox.environment();
+
+export default defineSandbox(() => environment.open());
 `;
 }
 /** What each reasoning-only subagent's `sandbox.ts` re-exports. */

package/dist/upgrade.js

@@ -10,7 +10,7 @@ import { dockerPruneCronArtifact } from "./docker-prune-cron.js";
 import { newestOnLine } from "./on-line-version.js";
 import { findMatchingAgentServiceUnit, repairManageRestart } from "./systemd.js";
 import { repairTerminalSandboxCleanupHooks } from "./sandbox-cleanup.js";
-import { repairRemovedDefaultTools as repairRemovedDefaultTools_ } from "./removed-default-tools.js";
+import { repairOptInTools, repairRemovedDefaultTools as repairRemovedDefaultTools_ } from "./removed-default-tools.js";
 import { EVE_VERSION, bold, capture, dim, green, parseEnv, red, run, yellow } from "./util.js";
 import { inspectEveAgent } from "./agent-limits.js";
 import { remoteProjectPath, sshTarget } from "./deploy.js";
@@ -332,7 +332,14 @@ function repairRemovedDefaultTools(cwd) {
     for (const file of optedIn) {
         console.log(`  ${green("+")} wrote ${file} ${dim("(keeps the tool this scope had on eve 0.38)")}`);
     }
-    if (removed.length || optedIn.length)
+    const optIn = repairOptInTools(cwd, EVE_VERSION);
+    for (const file of optIn.removed) {
+        console.log(`  ${green("-")} removed ${file} ${dim("(disabled a tool eve no longer provides by default; a compile error from eve 0.65)")}`);
+    }
+    for (const file of optIn.optedIn) {
+        console.log(`  ${green("+")} wrote ${file} ${dim("(ask_question is opt-in from eve 0.65; this scope keeps it)")}`);
+    }
+    if (removed.length || optedIn.length || optIn.removed.length || optIn.optedIn.length)
         console.log();
 }
 function repairSandboxCleanupHooks(cwd, deps) {
@@ -578,7 +585,7 @@ function exeJudgeUrl(cwd, env) {
     if (!path)
         return null;
     const source = readFileSync(path, "utf8");
-    const judgeProvider = /judge\s*:\s*\{[\s\S]*?model\s*:\s*([A-Za-z_$][\w$]*)\s*\(/.exec(source)?.[1];
+    const judgeProvider = /judge\s*:\s*\{[\s\S]*?model\s*:\s*([A-Za-z_$][\w$]*)\s*(?:\.evaluationModel\s*)?\(/.exec(source)?.[1];
     if (!judgeProvider)
         return null;
     const escaped = judgeProvider.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");

package/dist/util.d.ts

@@ -1,4 +1,4 @@
-export declare const EVE_VERSION = "0.51.1";
+export declare const EVE_VERSION = "0.68.0";
 export declare const REGISTRY_URL = "https://registry.kybernesis.ai/r/{name}.json";
 export declare const DEFAULT_ISSUER = "https://agent.kybernesis.ai";
 export declare const green: (s: string) => string;

package/dist/util.js

@@ -1,6 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { createInterface } from "node:readline/promises";
-export const EVE_VERSION = "0.51.1";
+export const EVE_VERSION = "0.68.0";
 export const REGISTRY_URL = "https://registry.kybernesis.ai/r/{name}.json";
 export const DEFAULT_ISSUER = "https://agent.kybernesis.ai";
 const TTY = process.stdout.isTTY === true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent \u2014 plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",
@@ -24,7 +24,8 @@
     "NOTICE"
   ],
   "bin": {
-    "kyb": "./dist/cli.js"
+    "kyb": "./dist/cli.js",
+    "kyb-eval": "./dist/eval-cli.js"
   },
   "exports": {
     "./package.json": "./package.json"
@@ -38,7 +39,7 @@
   },
   "devDependencies": {
     "@types/node": "24.x",
-    "eve": "^0.51.1",
+    "eve": "0.68.0",
     "typescript": "7.0.2"
   },
   "engines": {

package/skills/fde-engagement/references/playbook.md

@@ -1989,7 +1989,7 @@ export default defineAgent({
 });
 ```
 
-Four things to know before you promise it:
+Five things to know before you promise it:
 
 - **The exe LLM integration also serves `anthropic/*` ids, and that is NOT this.**
   It reaches Anthropic through a gateway, which bills metered usage. Same model,
@@ -2000,9 +2000,18 @@ Four things to know before you promise it:
   provider-defined tools, which Anthropic validates by name, and the failure
   (`tools.N.web_search_20250305.name: Input should be 'web_search'`) reads like
   a bug in the agent's own tool definitions.
-- **The sign-in is per host and interactive** — a browser step, once, in the
-  container. It survives restarts because it lives in a named volume, but a new
-  VM needs its own.
+- **The sign-in is per host and interactive** — a browser step in the container.
+  It survives restarts because it lives in a named volume, but a new VM needs
+  its own.
+- **And it is not a one-off: the sign-in expires about every 28 days.** The
+  access token refreshes hourly and does so happily the whole time, which tells
+  you nothing — the refresh token underneath carries a fixed expiry that using
+  it does not extend. On expiry the proxy blanks the credential to empty strings
+  and every turn 401s; only `login` recovers it, never `reload` or a restart.
+  **Say this to the client before you promise the arrangement, and put the
+  re-login in someone's calendar** — it is the operational debt you take on in
+  exchange for not billing metered usage. Run `scripts/claude-subscription.sh
+  status` on a schedule: it now reports days remaining and escalates at 7 and 3.
 - **It is a process to keep alive.** If the container stops, every turn fails
   with a connection error from inside the model SDK, which reads like the model
   being down. `hostPreflight({ claudeProxyUrl })` asks about it at boot; the