@kybernesis/create 0.23.2 → 0.24.0

package/README.md

@@ -116,6 +116,12 @@ run and upgrade exits with status 2, prints that the gate can only run on the
 host, and gives the exact ssh command. It does not print "Do NOT deploy" because
 no eval exercised the code.
 
+`kyb upgrade --check` plans only: it prints what would change as one
+`KYB_UPGRADE_PLAN {"ok":true,"changes":[{"name","from","to"}],"resetsConversations":false}`
+line and installs, repairs and renews nothing. `@kybernesis/manage` reads it for
+the owner's Update card, and runs the real upgrade (with its eval gate, then a
+rebuild and a safe restart, or everything put back) from that card.
+
 Use `kyb upgrade --host` to run the gate over ssh after the upgrade. The target
 uses the same defaults as `kyb deploy`: `EVE_SSH_HOST`, then
 `$EXE_VM_NAME.exe.xyz`; `--host=<ssh-target>` overrides them. The remote project

package/dist/buzz.d.ts

@@ -15,7 +15,7 @@
  * Channels page (manage's `buzz.join`), which writes the relay, publishes the
  * agent's profile and starts the bridge.
  */
-export declare const BUZZ_PACKAGE = "@kybernesis/buzz@^0.10.2";
+export declare const BUZZ_PACKAGE = "@kybernesis/buzz@^0.11.0";
 export declare const BUZZ_EXTENSION_MOUNT: string;
 /** Where the agent's Buzz key lives: inside the agent, so the bridge and the agent read the same file. */
 export declare function buzzKeyPath(appDir: string): string;

package/dist/buzz.js

@@ -20,7 +20,7 @@ import { bold, capture, dim, green, red, run, yellow } from "./util.js";
  * Channels page (manage's `buzz.join`), which writes the relay, publishes the
  * agent's profile and starts the bridge.
  */
-export const BUZZ_PACKAGE = "@kybernesis/buzz@^0.10.2";
+export const BUZZ_PACKAGE = "@kybernesis/buzz@^0.11.0";
 export const BUZZ_EXTENSION_MOUNT = `// The agent's hands in Buzz: projects, issues, pull requests, patches, repos,\n` +
     `// long-form notes, channel canvases, workflows, the feed, media — everything the\n` +
     `// workspace has beyond talking, which the bridge alone does not provide.\n` +

package/dist/cli.js

@@ -84,7 +84,7 @@ const COMMANDS = {
     credential: "Write the agent credential onto a host (--local to stay here).",
     register: "Register this agent with the control plane (--name, --url).",
     deploy: "Deploy this agent to its host (--no-env to leave the env file alone).",
-    upgrade: "Bring @kybernesis packages and eve to certified versions (--host, --skip-eval, --allow-stale, --yes).",
+    upgrade: "Bring @kybernesis packages and eve to certified versions (--check, --host, --skip-eval, --allow-stale, --yes).",
     tui: "Talk to your agents in the terminal.",
     version: "Print the version of this tool.",
 };
@@ -116,6 +116,7 @@ function usage(command) {
       --host[=<target>]     ${dim("run the eval gate over ssh; defaults like kyb deploy")}
       --skip-eval           ${dim("skip the eval gate")}
       --allow-stale         ${dim("continue even when this kyb is behind the published version")}
+      --check               ${dim("print what would change (one KYB_UPGRADE_PLAN json line) and change nothing")}
       --yes, -y             ${dim("confirm an eve version change noninteractively")}
 `);
         }
@@ -179,6 +180,7 @@ switch (command) {
     case "upgrade":
         await upgrade({
             allowStale: rest.includes("--allow-stale"),
+            check: rest.includes("--check"),
             host: optionalValueFlag(rest, "host"),
             skipEval: rest.includes("--skip-eval"),
             yes: rest.includes("--yes") || rest.includes("-y"),

package/dist/upgrade.d.ts

@@ -29,6 +29,12 @@ export type GithubToolsMountRepair = {
 export declare function repairGithubToolsMount(cwd: string): GithubToolsMountRepair;
 export interface UpgradeOptions {
     allowStale?: boolean;
+    /**
+     * Plan only: print what an upgrade would change as one `KYB_UPGRADE_PLAN <json>`
+     * line and touch nothing (no install, no repair, no renewal of kyb itself).
+     * The owner's Update card reads it through @kybernesis/manage.
+     */
+    check?: boolean;
     host?: true | string;
     skipEval?: boolean;
     yes?: boolean;
@@ -40,5 +46,7 @@ type EvalGatePreflight = {
     reasons: string[];
 };
 export declare function preflightEvalGate(cwd: string): Promise<EvalGatePreflight>;
+/** The one line `kyb upgrade --check` prints for a program to read; everything else it prints is for people. */
+export declare const UPGRADE_PLAN_PREFIX = "KYB_UPGRADE_PLAN ";
 export declare function upgrade(options?: UpgradeOptions): Promise<void>;
 export {};

package/dist/upgrade.js

@@ -861,6 +861,11 @@ function startStoppedBridge(cwd, unit) {
         `  systemctl status ${unit}`);
     return false;
 }
+/** The one line `kyb upgrade --check` prints for a program to read; everything else it prints is for people. */
+export const UPGRADE_PLAN_PREFIX = "KYB_UPGRADE_PLAN ";
+function printPlan(plan) {
+    console.log(`${UPGRADE_PLAN_PREFIX}${JSON.stringify(plan)}`);
+}
 export async function upgrade(options = {}) {
     console.log(bold("\nkyb upgrade — checking @kybernesis/* and eve against npm\n"));
     const cwd = process.cwd();
@@ -871,7 +876,7 @@ export async function upgrade(options = {}) {
         ...(pkg.devDependencies ?? {}),
     };
     const selfVersion = checkSelfVersion();
-    if (selfVersion.kind === "stale" && !options.allowStale) {
+    if (selfVersion.kind === "stale" && !options.allowStale && !options.check) {
         /**
          * A stale kyb that is the PROJECT's own dependency renews itself.
          *
@@ -957,6 +962,8 @@ export async function upgrade(options = {}) {
         console.log(dim(`    note: eve@${eveLatest} exists upstream; ${EVE_VERSION} is the newest Kybernesis-certified version.`));
     }
     if (unresolved.size > 0) {
+        if (options.check)
+            printPlan({ ok: false, unresolved: [...unresolved].sort(), changes: [], resetsConversations: false });
         fail(`\nUpgrade planning failed for ${[...unresolved].sort().join(", ")}. ` +
             `No manifest, dependency tree, or service state was changed.`);
         return;
@@ -985,6 +992,17 @@ export async function upgrade(options = {}) {
     const changed = [...new Set(targets
             .filter((target) => target.installedVersion !== target.targetVersion && !(target.name === "eve" && versionLt(target.targetVersion, target.installedVersion)))
             .map((target) => `${target.name}@${target.targetVersion}`))];
+    if (options.check) {
+        printPlan({
+            ok: true,
+            eve: { installed: eveInstalled ?? null, certified: EVE_VERSION },
+            changes: [...new Map(targets
+                    .filter((target) => changed.includes(`${target.name}@${target.targetVersion}`))
+                    .map((target) => [target.name, { name: target.name, from: target.installedVersion, to: target.targetVersion }])).values()],
+            resetsConversations: eveChanged,
+        });
+        return;
+    }
     if (eveChanged && !(await approveEveChange(cwd, options.yes === true, Boolean(deps["@kybernesis/buzz"])))) {
         process.exitCode = 1;
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.23.2",
+  "version": "0.24.0",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent \u2014 plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",

package/skills/kybernesis-packages/SKILL.md

@@ -95,7 +95,7 @@ then `eve add @kybernesis/<item>`). Each covers one axis:
   `KYBERNESIS_VOICE_OPENAI_KEY`, the owner's key for voice calls, with a `voice`
   setup item shown when @kybernesis/voice is installed) and the actions
   `claude.login` (link, then the code on stdin), `linq.signup`/`linq.verify`, `linq.contacts`/`linq.contact.add`/`linq.contact.remove` (who can text a shared line, 0.15),
-  `link.login`/`link.logout`, `wallet.add` (0.16: adds the payments item to an agent with a computer, rebuilds, rolls back on a failed build, restarts only after a good one), `linq.add` (0.18: the same for the iMessage channel, offered while `agent/channels/linq.ts` is missing, so an agent built without iMessage can answer the line it signs up), `slack.add` (0.19: the control-plane Slack channel via `kyb add channel slack`, offered to a registered agent on its own host with no Slack channel; the client then asks the control plane to make the agent's Slack app), `buzz.add` (0.19: `kyb add buzz` plus a build, answered 202 at once because the Buzz CLI build takes minutes; the `buzz` item reports `busy`, then the Buzz card or why it failed) and `vnc.password`. Every change applies at one restart that
+  `link.login`/`link.logout`, `wallet.add` (0.16: adds the payments item to an agent with a computer, rebuilds, rolls back on a failed build, restarts only after a good one), `linq.add` (0.18: the same for the iMessage channel, offered while `agent/channels/linq.ts` is missing, so an agent built without iMessage can answer the line it signs up), `slack.add` (0.19: the control-plane Slack channel via `kyb add channel slack`, offered to a registered agent on its own host with no Slack channel; the client then asks the control plane to make the agent's Slack app), `buzz.add` (0.19: `kyb add buzz` plus a build, answered 202 at once because the Buzz CLI build takes minutes; the `buzz` item reports `busy`, then the Buzz card or why it failed), `buzz.profile` (0.22: sends the owner's name and picture to every Buzz community now; advertised only when the installed `@kybernesis/buzz` is 0.11+) and `vnc.password`. Every change applies at one restart that
   waits until no conversation is in flight (deploy.sh's count). A BYOK key only
   takes effect when `agent/agent.ts` uses that provider; status says so.
   Since 0.12 it also takes `KYB_MODEL_REACH` (`gateway`, `byok`,
@@ -120,7 +120,13 @@ then `eve add @kybernesis/<item>`). Each covers one axis:
   (kind 7). Wire gotchas: reactions and dm-open go over HTTP with NIP-98 auth,
   NOT the socket (a socket reaction is accepted and then never appears), and
   command acks come back as `response:{…}` — parse without stripping that prefix
-  and a working call reads as a failure.
+  and a working call reads as a failure. Its face (0.11): the bridge keeps each
+  community's profile in step with the name and picture the OWNER set (control
+  plane `GET /api/agent/profile`, agent credential), the `.agent` name filling
+  the gaps, every 15 min; the picture (a data URL) is uploaded to the community's
+  Blossom store once per change. `profile --sync` runs it now; manage 0.22
+  `buzz.profile` is the app's Sync profile button. Below 0.11 the name sync put
+  the `.agent` picture back over the owner's.
 
 - **evals** — QA. `kybernesisBaseline({ agentDisplayName, routing, engineer?,
   safety? })` = smoke + 5 memory + 1 safety (quoted content is data, on by