@kybernesis/create 0.17.0 → 0.17.2

package/dist/cli.js

@@ -64,6 +64,7 @@ function initOptions(rest) {
     const subs = flag(rest, 'subagents');
     return {
         engineer: rest.includes('--engineer'),
+        computer: rest.includes('--no-computer') ? false : rest.includes('--computer') ? true : undefined,
         studio: rest.includes('--studio'),
         channel: flag(rest, "channel"),
         host: flag(rest, "host"),
@@ -104,6 +105,7 @@ function usage(command) {
       --model-reach=<reach> ${dim("claude-sub (exe only; default: host route)")}
       --subagents=a,b       ${dim("department subagents")}
       --engineer            ${dim("add the engineer layer")}
+      --no-computer         ${dim("skip the agent's own desktop + Chrome (on by default on exe)")}
       --studio              ${dim("wire KYBER Studio local/manage routes")}
       --yes, -y             ${dim("no prompts")}
 
@@ -228,6 +230,7 @@ ${dim("  npm i -g @kybernesis/create@latest")}
       --model=<id>      ${dim("provider/model-id; bare claude-opus-5 for claude-sub")}
       --model-reach=<r> ${dim("claude-sub (exe only); env: KYB_MODEL_REACH")}
       --engineer        ${dim("add the engineer layer: workshop sandbox + vision dev loop")}
+      --no-computer     ${dim("skip the agent's own computer (desktop + Chrome you can watch; on by default on exe hosts)")}
       --studio          ${dim("wire for KYBER Studio: local execution + management routes")}
       --yes             ${dim("no prompts; take flags and defaults")}
   ${bold("kyb add channel <kind>")}

package/dist/doctor.d.ts

@@ -32,4 +32,21 @@ export declare function diskUsageDoctorCheck(percent: number, dockerSummary: str
  */
 export declare function inspectDockerTemplatesViaExe(cwd: string): Promise<DockerTemplateInspection | null>;
 export declare function doctor(): Promise<void>;
+export interface ComputerInspection {
+    /** agent/sandbox.ts imports @kybernesis/computer. */
+    configured: boolean;
+    /** COMPUTER_NAME from .env.local, or the default the sandbox file falls back to. */
+    name: string;
+    containerState: "running" | "stopped" | "missing" | "unknown";
+    /** The noVNC port is bound on loopback. */
+    screenBound: boolean | null;
+    vncPasswordSet: boolean;
+}
+/**
+ * A computer that is configured but not running is the quiet failure here:
+ * every session would try to start it and the first turn pays the whole boot,
+ * or fails if Docker is off. Missing before the first build is normal.
+ */
+export declare function computerDoctorChecks(c: ComputerInspection): Check[];
+export declare function inspectComputer(cwd: string): ComputerInspection | null;
 export {};

package/dist/doctor.js

@@ -508,6 +508,10 @@ export async function doctor() {
             ]);
             const diskCheck = diskUsageDoctorCheck(percent, dockerSummary);
             add(diskCheck.verdict, diskCheck.label, diskCheck.detail);
+            const computer = inspectComputer(cwd);
+            if (computer)
+                for (const check of computerDoctorChecks(computer))
+                    checks.push(check);
         }
         /**
          * Instructions that name a tool the agent does not have.
@@ -679,3 +683,69 @@ export async function doctor() {
     console.log(`\n  ${fails ? red(`${fails} failing`) : green("0 failing")}, ${warns ? yellow(`${warns} warnings`) : "0 warnings"}\n`);
     process.exit(fails ? 1 : 0);
 }
+/**
+ * A computer that is configured but not running is the quiet failure here:
+ * every session would try to start it and the first turn pays the whole boot,
+ * or fails if Docker is off. Missing before the first build is normal.
+ */
+export function computerDoctorChecks(c) {
+    if (!c.configured)
+        return [];
+    const checks = [];
+    switch (c.containerState) {
+        case "running":
+            checks.push({ verdict: "pass", label: `the agent's computer "${c.name}" is running` });
+            break;
+        case "stopped":
+            checks.push({
+                verdict: "warn",
+                label: `the agent's computer "${c.name}" exists but is stopped`,
+                detail: "the next session restarts it and pays the boot; `docker start " + c.name + "` brings it back now",
+            });
+            break;
+        case "missing":
+            checks.push({
+                verdict: "warn",
+                label: `the agent's computer "${c.name}" has not been built yet`,
+                detail: "`eve build` creates and prepares it (eve's desktop stack + Chrome, ~5 minutes)",
+            });
+            break;
+        default:
+            checks.push({ verdict: "warn", label: "could not inspect the agent's computer", detail: "is Docker running on this host?" });
+    }
+    if (c.containerState === "running" && c.screenBound === false) {
+        checks.push({
+            verdict: "fail",
+            label: "the computer is running but its screen is not published on :6080",
+            detail: "the container was created without the noVNC port mapping; `docker rm -f " + c.name + "` and `eve build` to recreate it (volumes keep the home and /workspace)",
+        });
+    }
+    if (!c.vncPasswordSet) {
+        checks.push({
+            verdict: "warn",
+            label: "the computer's screen has no VNC password",
+            detail: "exe's port-proxy sign-in is the only gate; set COMPUTER_VNC_PASSWORD in .env.local and `docker rm -f " + c.name + "` + `eve build` to apply",
+        });
+    }
+    return checks;
+}
+export function inspectComputer(cwd) {
+    const sandboxPath = join(cwd, "agent/sandbox.ts");
+    if (!existsSync(sandboxPath) || !readFileSync(sandboxPath, "utf8").includes("@kybernesis/computer"))
+        return null;
+    const envPath = join(cwd, ".env.local");
+    const env = existsSync(envPath) ? parseEnv(readFileSync(envPath, "utf8")) : {};
+    const sandboxSource = readFileSync(sandboxPath, "utf8");
+    const fallback = /COMPUTER_NAME \?\? "([^"]+)"/.exec(sandboxSource)?.[1] ?? "agent-computer";
+    const name = env.COMPUTER_NAME?.trim() || fallback;
+    const state = capture("docker", ["inspect", "-f", "{{.State.Running}}", name]);
+    const containerState = state === null ? "unknown" : state.trim() === "true" ? "running" : state.trim() === "false" ? "stopped" : "missing";
+    const ports = containerState === "running" ? capture("docker", ["port", name, "6080"]) : null;
+    return {
+        configured: true,
+        name,
+        containerState,
+        screenBound: containerState === "running" ? Boolean(ports && ports.trim().length > 0) : null,
+        vncPasswordSet: Boolean(env.COMPUTER_VNC_PASSWORD?.trim()),
+    };
+}

package/dist/init.d.ts

@@ -6,6 +6,12 @@ import { type ChannelKind, type HostKind } from "./templates.js";
 export declare function finalizeGithubToolsRegistryMount(cwd: string, registryAddSucceeded: boolean): boolean;
 export interface InitOptions {
     engineer?: boolean;
+    /**
+     * The agent's own computer: a persistent Docker desktop with Chrome a person
+     * can watch and take over. Part of the core install on exe hosts (a Vercel
+     * function cannot keep a desktop alive); `false` opts out.
+     */
+    computer?: boolean;
     /**
      * Wire this agent for KYBER Studio: local execution on the user's own machine,
      * and management routes so Studio can install capabilities and write routines.

package/dist/init.js

@@ -1,7 +1,7 @@
-import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { appendFileSync, chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { DEFAULT_ISSUER, EVE_VERSION, REGISTRY_URL, ask, bold, closePrompts, dim, green, run, slug, red, yellow, } from "./util.js";
-import { CHANNEL_KINDS, channelPlan, engineerPlan, envExample, evalFileTs, exeEvalConfigTs, evalScript, hostAgentTs, hostSteps, githubToolsMountTs, identityMd, rootArcanaTs, subagentAgentTs, subagentArcanaTs, subagentInstructionsMd, } from "./templates.js";
+import { CHANNEL_KINDS, channelPlan, computerPlan, engineerPlan, envExample, evalFileTs, exeEvalConfigTs, evalScript, hostAgentTs, hostSteps, githubToolsMountTs, identityMd, rootArcanaTs, subagentAgentTs, subagentArcanaTs, subagentInstructionsMd, } from "./templates.js";
 import { suiteDir } from "./skills.js";
 import { configureArcana } from "./arcana.js";
 import { upsertEnv } from "./envfile.js";
@@ -36,6 +36,7 @@ export function finalizeGithubToolsRegistryMount(cwd, registryAddSucceeded) {
 }
 export async function init(rawName, options = {}) {
     const engineer = options.engineer === true;
+    const computer = options.computer !== false;
     const studio = options.studio === true;
     const nonInteractive = options.yes === true;
     const name = slug(rawName ?? (await ask("Agent name (kebab-case)?", "acme-agent")));
@@ -187,6 +188,14 @@ export async function init(rawName, options = {}) {
                 console.log(yellow(`  ! ${item} did not install cleanly — re-run: npx eve add ${item}`));
         }
     }
+    const compPlan = computer && host === "exe" ? computerPlan(name) : null;
+    if (options.computer === true && host !== "exe") {
+        console.log(yellow("\n  ! --computer needs a Docker host (exe.dev); a Vercel function cannot keep a desktop alive. Skipped."));
+    }
+    if (compPlan) {
+        console.log(bold("\n2e   The agent's computer: persistent desktop + Chrome, sighted computer tool, browser guard …"));
+        run("npm", ["install", ...compPlan.deps, "--no-audit", "--no-fund"], { cwd: dir, allowFail: true });
+    }
     console.log(bold("\n2d   Seeding the FDE Claude Code skill suite (.claude/skills) …"));
     try {
         cpSync(suiteDir(), join(dir, ".claude/skills"), { recursive: true });
@@ -373,8 +382,17 @@ export async function init(rawName, options = {}) {
             writeFileSync(full, file.content);
         }
     }
+    if (compPlan) {
+        for (const file of compPlan.files) {
+            const full = join(dir, file.path);
+            mkdirSync(join(full, ".."), { recursive: true });
+            writeFileSync(full, file.content);
+        }
+    }
     console.log(bold("\n5/6  Env template + hermetic eval script …"));
     writeFileSync(join(dir, ".env.example"), envExample(name, depts, issuer, plan.env, host, model));
+    if (compPlan)
+        appendFileSync(join(dir, ".env.example"), compPlan.env);
     const pkgPath = join(dir, "package.json");
     const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
     pkg.scripts = { ...pkg.scripts, eval: evalScript(name, depts) };
@@ -394,6 +412,7 @@ export async function init(rawName, options = {}) {
         model.reach === "claude-sub" ? "Claude subscription reach" : null,
         studio ? "KYBER Studio (local execution + management routes)" : null,
         engineer ? "engineer subagent (workshop + vision loop)" : null,
+        compPlan ? "its own computer (desktop + Chrome, watch and take over)" : null,
         depts.length ? `${depts.length} dept subagent(s)` : null,
     ].filter(Boolean);
     const steps = [
@@ -401,6 +420,7 @@ export async function init(rawName, options = {}) {
         ...hostSteps(host, name, model),
         ...plan.steps,
         ...(engPlan?.steps ?? []),
+        ...(compPlan?.steps ?? []),
         `Control plane: register agent "${name}" at ${issuer}/agents + grant the pilot cohort`,
         `npm run eval → green → deploy → live smoke + the revoke demo`,
     ];

package/dist/templates.d.ts

@@ -96,3 +96,21 @@ export declare function notifyMountTs(): string;
 export declare function reasoningSandboxLibTs(): string;
 /** What each reasoning-only subagent's `sandbox.ts` re-exports. */
 export declare function reasoningSandboxReexportTs(): string;
+export interface ComputerPlan {
+    files: Array<{
+        path: string;
+        content: string;
+    }>;
+    deps: string[];
+    steps: string[];
+    /** Lines appended to .env.example. */
+    env: string;
+}
+/**
+ * A persistent Docker desktop with Chrome that the person can watch and take
+ * over, as the agent's ROOT sandbox, plus the sighted computer tool, the
+ * guarded open_browser, and the surface ladder in instructions. The engineer
+ * workshop (a subagent sandbox) is untouched. Needs Docker, so it is an exe
+ * host feature: a Vercel function has no daemon to keep a container alive.
+ */
+export declare function computerPlan(name: string): ComputerPlan;

package/dist/templates.js

@@ -765,6 +765,105 @@ export default defineSandbox(() => environment.open());
 export function reasoningSandboxReexportTs() {
     return `// Reasoning-only specialist: no real filesystem, so no Docker container.
 // See agent/lib/reasoning-sandbox for why this exists and what it replaces.
-export { default } from "../../lib/reasoning-sandbox";
+export { default, environment } from "../../lib/reasoning-sandbox";
 `;
 }
+/**
+ * A persistent Docker desktop with Chrome that the person can watch and take
+ * over, as the agent's ROOT sandbox, plus the sighted computer tool, the
+ * guarded open_browser, and the surface ladder in instructions. The engineer
+ * workshop (a subagent sandbox) is untouched. Needs Docker, so it is an exe
+ * host feature: a Vercel function has no daemon to keep a container alive.
+ */
+export function computerPlan(name) {
+    const files = [
+        {
+            path: "agent/sandbox.ts",
+            content: `import { defineSandbox } from "eve/sandbox";
+import { DockerComputer, prepareComputer, startComputer } from "@kybernesis/computer";
+
+// The agent's own computer: ONE persistent container (home and /workspace are
+// volumes, so Chrome's logins survive sessions) with its screen shared over
+// VNC/noVNC on this host's loopback :6080 — reachable only through exe.dev's
+// signed-in port proxy or an SSH tunnel. A person watching can take over.
+// This is the ROOT sandbox; the builder subagent keeps its own workshop.
+export const environment = DockerComputer.environment({
+  name: process.env.COMPUTER_NAME ?? "${name}-computer",
+  vncPassword: process.env.COMPUTER_VNC_PASSWORD,
+  prepare: prepareComputer, // eve's desktop stack + Chrome + the launcher bar, once at \`eve build\`
+});
+
+export default defineSandbox(async () => {
+  const sandbox = await environment.open();
+  await startComputer(sandbox);
+  return sandbox;
+});
+`,
+        },
+        {
+            path: "agent/tools/computer.ts",
+            content: `import { computerTool } from "@kybernesis/computer";
+
+// eve's computer_use with eyes: every action returns the screenshot as an
+// image the model can see, not just a path.
+export default computerTool();
+`,
+        },
+        {
+            path: "agent/tools/open_browser.ts",
+            content: `import { openBrowserTool } from "@kybernesis/computer";
+
+// Open a site in the computer's Chrome. Guarded: a site that has a connector
+// parks for the person's approval unless the call states a legitimate
+// override — connector first, browser only when there isn't one.
+export default openBrowserTool();
+`,
+        },
+        {
+            path: "agent/tools/close_tabs.ts",
+            content: `import { closeTabsTool } from "@kybernesis/computer";
+
+// The computer shares memory with the agent host; stale tabs are the spender.
+export default closeTabsTool();
+`,
+        },
+        {
+            path: "agent/instructions/computer.ts",
+            content: `import { defineInstructions } from "eve/instructions";
+import { COMPUTER_INSTRUCTIONS } from "@kybernesis/computer";
+
+// The "which surface" rule: connected app, then a tool, then the agent's
+// browser, then the person's machine. One source for every agent.
+export default defineInstructions({ content: COMPUTER_INSTRUCTIONS });
+`,
+        },
+        {
+            path: "evals/computer.eval.ts",
+            content: `import { computerSuite } from "@kybernesis/evals";
+
+// Screen reading, file and cookie persistence across sessions, and the guard:
+// a Gmail question is not answered by browsing mail.google.com. Add
+// \`connected\` / \`disconnected\` once this agent has connectors to prove the
+// order on — see the computerSuite docs.
+export default computerSuite();
+`,
+        },
+    ];
+    return {
+        files,
+        deps: ["@kybernesis/computer"],
+        steps: [
+            "Enable Docker on the host (some images ship it disabled): sudo systemctl enable --now docker",
+            "Set COMPUTER_VNC_PASSWORD in .env.local (the second gate on the shared screen; exe's port-proxy sign-in is the first)",
+            "Watch the screen: https://<vm>.exe.xyz:6080/vnc.html (account-gated), or ssh -N -L 6080:localhost:6080 <vm> and open http://localhost:6080/vnc.html",
+            "First `eve build` prepares the computer (eve's desktop stack + Chrome): allow ~5 minutes and ~2 GB of memory for the container",
+        ],
+        env: `
+# The agent's own computer (@kybernesis/computer): a persistent Docker desktop
+# with Chrome whose screen is shared on this host's loopback :6080 (noVNC),
+# behind exe.dev's port-proxy sign-in. The VNC password is the second gate.
+COMPUTER_NAME="${name}-computer"
+COMPUTER_VNC_PASSWORD="..."
+`,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.17.0",
+  "version": "0.17.2",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent \u2014 plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",