@kybernesis/create 0.3.1 → 0.4.0

package/dist/cli.js

@@ -14,10 +14,24 @@ import { init } from "./init.js";
 import { doctor } from "./doctor.js";
 import { upgrade } from "./upgrade.js";
 import { installSkills } from "./skills.js";
+function flag(rest, key) {
+    const hit = rest.find((a) => a.startsWith(`--${key}=`));
+    return hit ? hit.slice(key.length + 3) : undefined;
+}
+function initOptions(rest) {
+    const subs = flag(rest, 'subagents');
+    return {
+        engineer: rest.includes('--engineer'),
+        channel: flag(rest, "channel"),
+        host: flag(rest, "host"),
+        subagents: subs === undefined ? undefined : subs.split(',').map((s) => s.trim()).filter(Boolean),
+        yes: rest.includes('--yes') || rest.includes('-y'),
+    };
+}
 const [, , command, ...rest] = process.argv;
 switch (command) {
     case "init":
-        await init(rest.find((a) => !a.startsWith("-")), { engineer: rest.includes("--engineer") });
+        await init(rest.find((a) => !a.startsWith("-")), initOptions(rest));
         break;
     case "doctor":
         await doctor();
@@ -29,19 +43,23 @@ switch (command) {
         await upgrade(rest.includes("--skip-eval"));
         break;
     case undefined:
-        await init(undefined, { engineer: false });
+        await init(undefined, initOptions(rest));
         break;
     default:
         if (!command.startsWith("-")) {
             // `npm create @kybernesis acme-agent` → argv[2] is the name.
-            await init(command, { engineer: rest.includes("--engineer") });
+            await init(command, initOptions(rest));
             break;
         }
         console.log(`
 ${bold("kyb")} — Kybernesis agent scaffolder & FDE toolkit
 
-  ${bold("kyb init [name]")}     scaffold a full Kybernesis eve agent
+  ${bold("kyb init [name]")}     scaffold a Kybernesis eve agent (core: enterprise + arcana + evals)
+      --channel=<kind>  ${dim("none|slack|imessage|telegram|discord|web  (default: none)")}
+      --host=<kind>     ${dim("vercel|exe                                (default: vercel)")}
+      --subagents=a,b   ${dim("department subagents                      (default: none)")}
       --engineer        ${dim("add the engineer layer: workshop sandbox + vision dev loop")}
+      --yes             ${dim("no prompts; take flags and defaults")}
   ${bold("kyb doctor")}          preflight checks (keys, issuer, envs, discovery)
   ${bold("kyb skills")}          install/refresh the FDE skill suite for Claude Code
       --global          ${dim("install to ~/.claude/skills instead of this repo")}

package/dist/init.d.ts

@@ -1,3 +1,13 @@
-export declare function init(rawName: string | undefined, options?: {
+import { type ChannelKind, type HostKind } from "./templates.js";
+export interface InitOptions {
     engineer?: boolean;
-}): Promise<void>;
+    /** Chat surface. Default "none" — add later with `kyb add channel`. */
+    channel?: ChannelKind;
+    /** Where the agent runs. Default "vercel". */
+    host?: HostKind;
+    /** Department subagents. Default NONE. */
+    subagents?: string[];
+    /** Skip prompts and take the flags/defaults as given. */
+    yes?: boolean;
+}
+export declare function init(rawName: string | undefined, options?: InitOptions): Promise<void>;

package/dist/init.js

@@ -1,86 +1,128 @@
 import { cpSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { DEFAULT_ISSUER, EVE_VERSION, REGISTRY_URL, ask, bold, closePrompts, green, run, slug, yellow, } from "./util.js";
-import { envExample, evalFileTs, evalScript, identityMd, rootArcanaTs, subagentAgentTs, subagentArcanaTs, subagentInstructionsMd, } from "./templates.js";
+import { DEFAULT_ISSUER, EVE_VERSION, REGISTRY_URL, ask, bold, closePrompts, dim, green, run, slug, yellow, } from "./util.js";
+import { CHANNEL_KINDS, channelPlan, envExample, evalFileTs, evalScript, hostAgentTs, hostSteps, identityMd, rootArcanaTs, subagentAgentTs, subagentArcanaTs, subagentInstructionsMd, } from "./templates.js";
 import { suiteDir } from "./skills.js";
-const ITEMS = ["enterprise", "arcana", "multiplayer", "evals"];
-// Official eve-registry limbs installed alongside the engineer layer.
-const ENGINEER_OFFICIAL_ITEMS = ["extension/agent-browser", "extension/github-tools", "connection/vercel"];
-export async function init(rawName, options) {
-    const engineer = options?.engineer === true;
+/**
+ * The always-installed core. Everything else — channels, subagents, engineer,
+ * host bindings — is opt-in, because assuming them means the FDE deletes files
+ * AND undoes real setup work (an Arcana workspace + scoped key per subagent).
+ */
+const CORE_ITEMS = ["enterprise", "arcana", "evals"];
+const ENGINEER_OFFICIAL_ITEMS = [
+    "extension/agent-browser",
+    "extension/github-tools",
+    "connection/vercel",
+];
+const DEFAULT_MODEL = "anthropic/claude-sonnet-5";
+export async function init(rawName, options = {}) {
+    const engineer = options.engineer === true;
+    const nonInteractive = options.yes === true;
     const name = slug(rawName ?? (await ask("Agent name (kebab-case)?", "acme-agent")));
     if (!name) {
         console.error("An agent name is required.");
         process.exit(1);
     }
-    const displayName = await ask("Display name (what employees call it)?", name);
-    const deptsRaw = await ask("Department subagents (comma-separated, empty for none)?", "finance,marketing,engineering");
-    const depts = deptsRaw
-        .split(",")
-        .map((d) => slug(d))
-        .filter(Boolean);
-    const issuer = await ask("Control-plane issuer?", DEFAULT_ISSUER);
+    const displayName = nonInteractive
+        ? name
+        : await ask("Display name (what employees call it)?", name);
+    // Channel: default NONE. A client on iMessage should never be handed Slack.
+    let channel = options.channel ?? "none";
+    if (!options.channel && !nonInteractive) {
+        const answer = await ask(`Chat surface? (${CHANNEL_KINDS.join(" | ")})`, "none");
+        const picked = answer.trim().toLowerCase();
+        channel = CHANNEL_KINDS.includes(picked) ? picked : "none";
+    }
+    // Host: where it runs. Vercel unless told otherwise.
+    let host = options.host ?? "vercel";
+    if (!options.host && !nonInteractive) {
+        const answer = await ask("Host? (vercel | exe)", "vercel");
+        host = answer.trim().toLowerCase() === "exe" ? "exe" : "vercel";
+    }
+    // Subagents: default NONE. Each one costs a workspace + scoped key.
+    let depts = options.subagents ?? [];
+    if (!options.subagents && !nonInteractive) {
+        const raw = await ask("Department subagents (comma-separated, empty for none)?", "");
+        depts = raw.split(",").map((d) => slug(d)).filter(Boolean);
+    }
+    const issuer = nonInteractive
+        ? DEFAULT_ISSUER
+        : await ask("Control-plane issuer?", DEFAULT_ISSUER);
     closePrompts();
     const dir = resolve(process.cwd(), name);
     if (existsSync(dir)) {
         console.error(`Directory ${name}/ already exists.`);
         process.exit(1);
     }
+    const plan = channelPlan(channel, name, host);
     console.log(bold(`\n1/6  Scaffolding eve agent (eve@${EVE_VERSION}) …`));
     run("npx", [`eve@${EVE_VERSION}`, "init", name]);
-    console.log(bold("\n2/6  Adding the Kybernesis registry + packages …"));
+    console.log(bold("\n2/6  Adding the Kybernesis registry + core packages …"));
     run("npx", ["eve", "registry", "add", `@kybernesis=${REGISTRY_URL}`], { cwd: dir });
-    for (const item of ITEMS) {
+    for (const item of CORE_ITEMS) {
         run("npx", ["eve", "add", `@kybernesis/${item}`, "--overwrite"], { cwd: dir });
     }
+    const extraDeps = [...plan.deps, ...(host === "exe" ? ["@kybernesis/exe", "@ai-sdk/openai"] : [])];
+    if (extraDeps.length) {
+        console.log(bold(`\n2b   Installing for ${channel}/${host}: ${extraDeps.join(", ")} …`));
+        run("npm", ["install", ...extraDeps, "--no-audit", "--no-fund"], { cwd: dir, allowFail: true });
+    }
+    for (const item of plan.registryItems) {
+        run("npx", ["eve", "add", item, "--overwrite"], { cwd: dir, allowFail: true });
+    }
     if (engineer) {
-        console.log(bold("\n2b   Engineer layer: workshop sandbox + vision dev loop …"));
+        console.log(bold("\n2c   Engineer layer: workshop sandbox + vision dev loop …"));
         run("npx", ["eve", "add", "@kybernesis/engineer", "--overwrite"], { cwd: dir });
         for (const item of ENGINEER_OFFICIAL_ITEMS) {
-            // Official items may carry their own interactive setup; a failure here
-            // shouldn't kill the scaffold — the FDE can re-run `eve add <item>`.
             const ok = run("npx", ["eve", "add", item, "--overwrite"], { cwd: dir, allowFail: true });
             if (!ok)
                 console.log(yellow(`  ! ${item} did not install cleanly — re-run: npx eve add ${item}`));
         }
     }
-    console.log(bold("\n2c   Seeding the FDE Claude Code skill suite (.claude/skills) …"));
+    console.log(bold("\n2d   Seeding the FDE Claude Code skill suite (.claude/skills) …"));
     try {
         cpSync(suiteDir(), join(dir, ".claude/skills"), { recursive: true });
     }
     catch {
         console.log(yellow("  ! skill suite not found — run kyb skills inside the repo later"));
     }
-    console.log(bold("\n3/6  Writing agent identity, memory mount, and eval wiring …"));
+    console.log(bold("\n3/6  Writing identity, model config, memory mount, and evals …"));
     mkdirSync(join(dir, "agent/instructions"), { recursive: true });
     writeFileSync(join(dir, "agent/instructions/identity.md"), identityMd(displayName, depts));
-    // The scaffold ships a flat agent/instructions.md; the directory form wins,
-    // so remove the flat file to avoid ambiguity.
     try {
         unlinkSync(join(dir, "agent/instructions.md"));
     }
     catch { }
+    writeFileSync(join(dir, "agent/agent.ts"), hostAgentTs(host, DEFAULT_MODEL));
     writeFileSync(join(dir, "agent/extensions/arcana.ts"), rootArcanaTs());
     writeFileSync(join(dir, "evals/kybernesis.eval.ts"), evalFileTs(displayName, depts));
-    console.log(bold(`\n4/6  Generating ${depts.length} department subagent(s) …`));
-    const skillsSource = join(dir, "node_modules/@kybernesis/arcana/dist/extension/skills");
-    for (const dept of depts) {
-        const base = join(dir, "agent/subagents", dept);
-        mkdirSync(join(base, "connections"), { recursive: true });
-        writeFileSync(join(base, "agent.ts"), subagentAgentTs(dept));
-        writeFileSync(join(base, "instructions.md"), subagentInstructionsMd(dept));
-        writeFileSync(join(base, "connections/arcana.ts"), subagentArcanaTs(dept));
-        // Subagents inherit nothing: copy the memory skills from the installed
-        // arcana package so each specialist carries the playbooks.
-        if (existsSync(skillsSource)) {
-            cpSync(skillsSource, join(base, "skills"), { recursive: true });
-        }
-        else {
-            console.log(yellow(`  ! arcana skills not found at ${skillsSource} — copy them manually`));
+    if (plan.file) {
+        console.log(bold(`\n4/6  Channel: ${channel} …`));
+        mkdirSync(join(dir, "agent/channels"), { recursive: true });
+        writeFileSync(join(dir, "agent/channels", plan.file), plan.content);
+    }
+    else {
+        console.log(bold(`\n4/6  Channel: ${channel} (no channel file) …`));
+    }
+    if (depts.length) {
+        console.log(bold(`\n4b   Generating ${depts.length} department subagent(s) …`));
+        const skillsSource = join(dir, "node_modules/@kybernesis/arcana/dist/extension/skills");
+        for (const dept of depts) {
+            const base = join(dir, "agent/subagents", dept);
+            mkdirSync(join(base, "connections"), { recursive: true });
+            writeFileSync(join(base, "agent.ts"), subagentAgentTs(dept));
+            writeFileSync(join(base, "instructions.md"), subagentInstructionsMd(dept));
+            writeFileSync(join(base, "connections/arcana.ts"), subagentArcanaTs(dept));
+            if (existsSync(skillsSource)) {
+                cpSync(skillsSource, join(base, "skills"), { recursive: true });
+            }
+            else {
+                console.log(yellow(`  ! arcana skills not found at ${skillsSource} — copy them manually`));
+            }
         }
     }
     console.log(bold("\n5/6  Env template + hermetic eval script …"));
-    writeFileSync(join(dir, ".env.example"), envExample(name, depts, issuer));
+    writeFileSync(join(dir, ".env.example"), envExample(name, depts, issuer, plan.env));
     const pkgPath = join(dir, "package.json");
     const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
     pkg.scripts = { ...pkg.scripts, eval: evalScript(name, depts) };
@@ -88,34 +130,32 @@ export async function init(rawName, options) {
     console.log(bold("\n6/6  Verifying (typecheck + eve discovery) …"));
     const tsOk = run("npm", ["run", "typecheck"], { cwd: dir, allowFail: true });
     const infoOk = run("npx", ["eve", "info"], { cwd: dir, allowFail: true, quiet: true });
-    console.log(tsOk && infoOk ? green("  ✓ typecheck + discovery clean") : yellow("  ! verify manually: npm run typecheck && npx eve info"));
+    console.log(tsOk && infoOk
+        ? green("  ✓ typecheck + discovery clean")
+        : yellow("  ! verify manually: npm run typecheck && npx eve info"));
+    const parts = [
+        "governed (enterprise)",
+        "remembering (arcana)",
+        "self-testing (evals)",
+        channel === "none" ? null : `${channel} channel`,
+        host === "exe" ? "exe.dev host" : null,
+        engineer ? "engineer (workshop + vision loop)" : null,
+        depts.length ? `${depts.length} dept subagent(s)` : null,
+    ].filter(Boolean);
+    const steps = [
+        `Arcana: create workspaces (${name}-company, ${name}-eval${depts.map((d) => `, ${name}-${d}`).join("")}) + scoped kb_ keys; fill .env.local from .env.example`,
+        ...hostSteps(host, name),
+        ...plan.steps,
+        `Control plane: register agent "${name}" at ${issuer}/agents + grant the pilot cohort`,
+        `npm run eval → green → deploy → live smoke + the revoke demo`,
+    ];
     console.log(`
-${green("✓")} ${bold(name)} scaffolded: governed (enterprise) · remembering (arcana) · multiplayer (slack) · self-testing (evals)${engineer ? " · engineer (workshop + vision loop)" : ""}${depts.length ? ` · ${depts.length} dept subagent(s)` : ""}${engineer ? `
-
-${bold("Engineer notes:")}
-  · The workshop sandbox (agent/sandbox/sandbox.ts) bakes Playwright into the
-    template at DEPLOY time — a broken bootstrap fails the Vercel build loudly.
-    Deployed sessions run under a domain allowlist; extend it deliberately in
-    that file when a project needs another host.
-  · Vercel connection (preview deploys + link-back), after \`vercel link\`:
-      vercel connect create mcp.vercel.com --name vercel
-      vercel connect attach mcp.vercel.com/vercel --yes
-    then set connect("mcp.vercel.com/vercel") — the UID, not the short name —
-    in agent/connections/vercel.ts. First tool use posts an OAuth link in the
-    thread (user-scoped); grant "All projects" so the agent can create new ones,
-    then narrow the grant in the dashboard once the project exists.
-  · File delivery (the deliver tool needs it):
-      vercel blob create-store ${name}-deliverables --access public --yes
-    links the store and injects BLOB_READ_WRITE_TOKEN automatically.
-  · agent-browser / github-tools may need their Connect setup flows — run
-    their printed setup commands if tools 401.` : ""}
+${green("✓")} ${bold(name)} scaffolded: ${parts.join(" · ")}
 
 ${bold("Human steps (in order) — the FDE playbook covers each in detail:")}
-  1. Arcana: create workspaces (${name}-company, ${name}-eval${depts.map((d) => `, ${name}-${d}`).join("")}) + scoped kb_ keys; fill .env.local from .env.example
-  2. Vercel: \`vercel link\` in ${name}/ (client's team), add envs (prod/preview Sensitive)
-  3. Slack: \`vercel connect create slack --triggers --name ${name}\` → detach → re-attach with --trigger-path /eve/v1/slack
-  4. Control plane: register agent "${name}" (runtime: ▲ eve) at ${issuer}/agents + grant the pilot cohort
-  5. \`npm run eval\` → green → \`npx eve deploy\` → live Slack smoke + the revoke demo
+${steps.map((s, i) => `  ${i + 1}. ${s}`).join("\n")}
+
   Run ${bold("kyb doctor")} inside ${name}/ any time to check the wiring.
+${dim("  Add more later: kyb add channel <kind> · kyb add subagent <name>")}
 `);
 }

package/dist/templates.d.ts

@@ -7,5 +7,24 @@ export declare function subagentInstructionsMd(dept: string): string;
 export declare function subagentArcanaTs(dept: string): string;
 export declare function rootArcanaTs(): string;
 export declare function evalFileTs(displayName: string, depts: string[]): string;
-export declare function envExample(name: string, depts: string[], issuer: string): string;
+export declare function envExample(name: string, depts: string[], issuer: string, channelEnv?: string[]): string;
 export declare function evalScript(name: string, depts: string[]): string;
+export type ChannelKind = "none" | "slack" | "imessage" | "telegram" | "discord" | "web";
+export declare const CHANNEL_KINDS: ChannelKind[];
+export interface ChannelPlan {
+    /** File written under agent/channels/, or null for `none`. */
+    file: string | null;
+    content: string;
+    /** npm deps this channel needs beyond eve. */
+    deps: string[];
+    /** Registry items to `eve add` (interactive setup flows live there). */
+    registryItems: string[];
+    /** Env lines appended to .env.example. */
+    env: string[];
+    /** Human setup steps printed after scaffolding. */
+    steps: string[];
+}
+export declare function channelPlan(kind: ChannelKind, name: string, host: HostKind): ChannelPlan;
+export type HostKind = "vercel" | "exe";
+export declare function hostAgentTs(host: HostKind, model: string): string;
+export declare function hostSteps(host: HostKind, name: string): string[];

package/dist/templates.js

@@ -120,7 +120,7 @@ export default kybernesisBaseline({
 ${depts.length ? `  routing: [\n${routing}\n  ],\n` : ""}});
 `;
 }
-export function envExample(name, depts, issuer) {
+export function envExample(name, depts, issuer, channelEnv = []) {
     const deptVars = depts
         .map((d) => {
         const upper = d.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
@@ -135,10 +135,7 @@ export function envExample(name, depts, issuer) {
 KYBERNESIS_ISSUER="${issuer}"
 KYBERNESIS_AGENT="${name}"
 
-# Slack (@kybernesis/multiplayer) — Vercel Connect connector UID
-# SLACK_CONNECTOR_UID="slack/${name}"
-
-# Arcana memory (@kybernesis/arcana) — one workspace + scoped kb_ key per brain
+${channelEnv.length ? `# Channel\n${channelEnv.join("\n")}\n\n` : ""}# Arcana memory (@kybernesis/arcana) — one workspace + scoped kb_ key per brain
 # ARCANA_API_KEY="kb_..."
 # ARCANA_COMPANY_WORKSPACE="${name}-company"
 # ARCANA_DM_WORKSPACE="${name}-company"
@@ -154,3 +151,186 @@ export function evalScript(name, depts) {
     ];
     return `${overrides.join(" ")} eve eval`;
 }
+export const CHANNEL_KINDS = [
+    "none",
+    "slack",
+    "imessage",
+    "telegram",
+    "discord",
+    "web",
+];
+export function channelPlan(kind, name, host) {
+    const onExe = host === "exe";
+    switch (kind) {
+        case "slack":
+            return {
+                file: "slack.ts",
+                content: onExe
+                    ? `import { multiplayerSlackChannel } from "@kybernesis/multiplayer/slack";
+import { forwardedSocketVerifier } from "@kybernesis/exe/slack";
+
+// Slack on a self-hosted (exe.dev) host.
+// Inbound: a forwarder holds the exe-brokered Socket Mode connection and POSTs
+// events here; the verifier authenticates them on SLACK_SOCKET_FORWARDING_SECRET.
+// Outbound: SLACK_BOT_TOKEN must be on the host — eve's SlackChannelCredentials
+// has no apiUrl, so calls can't route through the exe integration yet.
+export default multiplayerSlackChannel({
+  credentials: {
+    botToken: process.env.SLACK_BOT_TOKEN!,
+    webhookVerifier: forwardedSocketVerifier(),
+  },
+});
+`
+                    : `import { connectSlackCredentials } from "@vercel/connect/eve";
+import { multiplayerSlackChannel } from "@kybernesis/multiplayer/slack";
+
+// Shared threads with per-speaker verified identity, attributed context, and
+// dual surface (channel vs DM). Credentials are brokered by Vercel Connect.
+export default multiplayerSlackChannel({
+  credentials: connectSlackCredentials(process.env.SLACK_CONNECTOR_UID!),
+});
+`,
+                deps: ["@kybernesis/multiplayer", ...(onExe ? ["@kybernesis/exe"] : ["@vercel/connect"])],
+                registryItems: [],
+                env: onExe
+                    ? [
+                        `SLACK_BOT_TOKEN="xoxb-..."   # outbound; from Slack OAuth & Permissions`,
+                        `SLACK_SOCKET_FORWARDING_SECRET="$(openssl rand -hex 24)"`,
+                    ]
+                    : [`SLACK_CONNECTOR_UID="slack/${name}"`],
+                steps: onExe
+                    ? [
+                        `Create a Slack app (Socket Mode on; scopes: app_mentions:read, chat:write, channels:history, groups:history, im:history, users:read)`,
+                        `Hold its tokens off-host: ssh exe.dev integrations add slack --name ${name} --bot-token=- --app-token=-`,
+                        `Run the forwarder (scripts/slack-forwarder.py in @kybernesis/exe) with EXE_SLACK_GW set`,
+                        `After ANY scope change, reinstall the app — a stale token silently stops receiving events`,
+                    ]
+                    : [
+                        `vercel connect create slack --triggers --name ${name}`,
+                        `vercel connect detach <uid> --yes && vercel connect attach <uid> --triggers --trigger-path /eve/v1/slack --yes`,
+                    ],
+            };
+        case "imessage":
+            return {
+                file: "photon.ts",
+                content: `import { photonIMessageChannel } from "eve/channels/photon";
+${onExe ? `import { photonEnvCredentials } from "@kybernesis/exe/photon";\n` : ""}
+// iMessage via Photon. Inbound is a plain webhook at /eve/v1/photon; the Photon
+// signing secret takes precedence over the default Vercel-OIDC verifier, so this
+// works on any host with a public HTTPS URL.
+export default photonIMessageChannel({
+${onExe
+                    ? `  credentials: photonEnvCredentials(),`
+                    : `  async credentials() {
+    const projectId = process.env.IMESSAGE_PROJECT_ID;
+    const projectSecret = process.env.IMESSAGE_PROJECT_SECRET;
+    if (!projectId || !projectSecret) throw new Error("Photon project credentials are required.");
+    return { projectId, projectSecret };
+  },`}
+  webhookSecret: process.env.IMESSAGE_WEBHOOK_SECRET,
+});
+`,
+                deps: onExe ? ["@kybernesis/exe"] : [],
+                registryItems: [],
+                env: [
+                    `IMESSAGE_PROJECT_ID="..."`,
+                    `IMESSAGE_PROJECT_SECRET="..."`,
+                    `IMESSAGE_WEBHOOK_SECRET="..."   # Photon webhook signing secret`,
+                ],
+                steps: [
+                    `Create a Photon project and register the phone number (npx eve add channel/photon-imessage walks it)`,
+                    onExe
+                        ? `Make the host public FIRST — webhooks need anonymous access:\n       ssh exe.dev share port <vm> 8000 && ssh exe.dev share set-public <vm>`
+                        : `Deploy so the public URL exists`,
+                    `Register a Photon webhook for https://<your-host>/eve/v1/photon and copy its signing secret to IMESSAGE_WEBHOOK_SECRET`,
+                ],
+            };
+        case "telegram":
+            return {
+                file: "telegram.ts",
+                content: `import { telegramChannel } from "eve/channels/telegram";
+
+// Telegram. Register the webhook against your public URL after deploying.
+export default telegramChannel({ botToken: process.env.TELEGRAM_BOT_TOKEN! });
+`,
+                deps: [],
+                registryItems: [],
+                env: [`TELEGRAM_BOT_TOKEN="..."   # from @BotFather`],
+                steps: [
+                    `Create a bot with @BotFather and copy its token`,
+                    `After deploy: curl -X POST "https://api.telegram.org/bot<TOKEN>/setWebhook" -d "url=https://<host>/eve/v1/telegram"`,
+                ],
+            };
+        case "discord":
+            return {
+                file: "discord.ts",
+                content: `import { discordChannel } from "eve/channels/discord";
+
+export default discordChannel({ botToken: process.env.DISCORD_BOT_TOKEN! });
+`,
+                deps: [],
+                registryItems: [],
+                env: [`DISCORD_BOT_TOKEN="..."`],
+                steps: [`Create a Discord application + bot, invite it, set DISCORD_BOT_TOKEN`],
+            };
+        case "web":
+            return {
+                file: null,
+                content: "",
+                deps: [],
+                registryItems: [],
+                env: [],
+                steps: [
+                    `The eve channel (agent/channels/eve.ts) already serves HTTP; build a frontend with useEveAgent`,
+                ],
+            };
+        case "none":
+        default:
+            return {
+                file: null,
+                content: "",
+                deps: [],
+                registryItems: [],
+                env: [],
+                steps: [`No chat surface yet — add one later with: kyb add channel <slack|imessage|telegram|discord|web>`],
+            };
+    }
+}
+export function hostAgentTs(host, model) {
+    if (host === "exe") {
+        return `import { defineAgent } from "eve";
+import { createOpenAI } from "@ai-sdk/openai";
+import { exeModel } from "@kybernesis/exe";
+
+// Model served by the exe.dev LLM integration — no provider key on the host.
+// exe injects the credential (managed gateway, your API key, or a connected
+// ChatGPT subscription) server-side.
+export default defineAgent({
+  model: exeModel({ model: process.env.EXE_MODEL ?? ${JSON.stringify(model)}, createOpenAI }),
+  modelContextWindowTokens: 200_000,
+});
+`;
+    }
+    return `import { defineAgent } from "eve";
+
+export default defineAgent({
+  model: ${JSON.stringify(model)},
+});
+`;
+}
+export function hostSteps(host, name) {
+    if (host === "exe") {
+        return [
+            `Create the VM:  ssh exe.dev new --name ${name}`,
+            `Attach an LLM integration (ChatGPT subscription, your API key, or exe's gateway):`,
+            `    ssh exe.dev integrations setup chatgpt --name work   # once, device-code`,
+            `    ssh exe.dev integrations edit llm --openai=chatgpt --openai-account=work`,
+            `Install Node 24 + deps on the VM, then: npx eve build && bash scripts/eve-server.sh start`,
+            `\`eve start\` does NOT read .env.local — scripts/eve-server.sh loads it for you`,
+        ];
+    }
+    return [
+        `vercel link  (the client's team), then set envs (prod/preview Sensitive)`,
+        `npx eve deploy`,
+    ];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent — plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",

package/skills/connect-agents/SKILL.md

@@ -90,3 +90,30 @@ the peer by hand to BOTH the `vercelOidc({ subjects })` list and the
 - **Works locally, 401 in production** → caller's OIDC not accepted: the
   receiver's `trustedPeers` names the wrong environment (default is
   production-only) or wrong project.
+
+## Governed mode (control-plane edges — preferred when the client runs the admin)
+
+Instead of hand-enumerated peers, edges are GRANTED in the Kybernesis control
+plane and enforced with 300s A2A tokens. Full lifecycle proven live 2026-08-07
+(grant → dispatch → revoke → refused ≤5 min → re-grant → restored, no deploys).
+
+Setup, per agent (admin UI /agents):
+1. Register both agents as eve deployments — URL must be the OPEN production
+   alias (health 200; forms sanitize pasted punctuation as of this writing).
+2. Grant the edge on the CALLEE's panel ("Agent-to-agent edges" → allow calls
+   from <caller> + purpose; expiry optional — self-destructing edge).
+3. Mint each agent's credential (shown ONCE) → set as Sensitive env
+   `KYBERNESIS_AGENT_CREDENTIAL` on that agent's Vercel project.
+
+Then in code (dispatch ≥0.2.1 + enterprise ≥0.2.0 both installed):
+- caller: `remotePeer({ callee: "<EXACT registered name>", governed: { issuer },
+  envVar, fallbackUrl, description })` — envVar/fallbackUrl kept as overrides;
+  registry supplies the URL when the credential is present.
+- receiver: `dispatchChannel({ governed: { issuer, agent: "<own name>" } })`.
+
+Gotchas: names are case-sensitive ("Kyber" ≠ "kyber" — copy from the admin);
+credentials are one JWS line ~3 segments, an ES256 signature is 86 base64url
+chars — a truncated paste fails verification silently, so length-check it;
+scheduled/cron turns still forward no human (service identity at the peer);
+the deployed agent's model spend shares the project's AI Gateway budget with
+local eval runs — size the budget for BOTH or production goes model-dead.

package/skills/fde-engagement/references/playbook.md

@@ -904,6 +904,21 @@ Client-conversation rules of thumb:
   product conversation — purpose-scoped grants, §2.5 disclosures. Don't wire
   one as if it were internal.
 
+**Governed mode (dispatch ≥0.2.1 + enterprise ≥0.2.0 + the client's control
+plane) — the preferred form.** Edges become GRANTS in the admin instead of
+code: register both agents (/agents, OPEN production alias, health 200), grant
+the edge on the CALLEE's panel (caller + purpose + optional expiry), mint each
+agent's credential (shown once) into KYBERNESIS_AGENT_CREDENTIAL on its
+deployment. Code shrinks to remotePeer({ callee: "<EXACT registered name —
+case-sensitive>", governed: { issuer }, envVar, fallbackUrl }) and
+dispatchChannel({ governed: { issuer, agent } }). Outbound auth is a 300 s A2A
+token minted per edge; the callee URL comes from the registry (discovery), env
+var still wins. THE DEMO: revoke the edge in the admin → the caller is refused
+(edge_not_granted) within 5 minutes, no redeploy; re-grant → restored. Run it
+for the client — it's the whole governance story in one minute. Full lifecycle
+proven live 2026-08-07 (kyber ↔ eve-gtm). Budget note: the deployed agent and
+local eval runs share the project's AI Gateway budget — size it for both.
+
 ### 4.4 Author the agent's identity and instructions
 
 How instructions work in eve (30 seconds of mechanics): a flat

package/skills/kybernesis-packages/SKILL.md

@@ -49,6 +49,17 @@ then `eve add @kybernesis/<item>`). Each covers one axis:
   versions (old receivers silently drop forwarding → service identity).
   Composes with enterprise via `extraAuth: [kybernesisAuth(...)]`. See the
   `connect-agents` skill for the end-to-end wiring flow.
+  **GOVERNED mode (≥0.2.1, proven live 2026-08-07):** `remotePeer({ callee:
+  "<registered-name>", governed: { issuer } })` + `dispatchChannel({ governed:
+  { issuer, agent } })` — edges granted in the control plane, outbound auth =
+  a 300s A2A token minted from POST /api/agent/session with the deployment's
+  `KYBERNESIS_AGENT_CREDENTIAL`, callee URL from the registry (envVar
+  overrides). Revoke in the admin → refused within the token TTL, no
+  redeploy. Names match EXACTLY (case-sensitive: "Kyber" ≠ "kyber").
+  Requires @kybernesis/enterprise ≥0.2.0 installed (optional peer, lazy).
+  0.2.1 lesson: eve resolves remote URLs at BOOT — url() must degrade
+  (env → discovery-if-credentialed → fallbackUrl), never throw on a missing
+  credential, or the whole agent (and its evals) fails to boot.
 - **evals** — QA. `kybernesisBaseline({ agentDisplayName, routing,
   engineer? })` = smoke + 5 memory + routing per dept + optional vision-loop
   eval. Judge model ≠ model under test. Hermetic runs force all workspaces to