@kybernesis/create 0.7.13 → 0.8.0

package/dist/cli.js

@@ -23,6 +23,7 @@ import { installSkills } from "./skills.js";
 import { deploy } from "./deploy.js";
 import { register } from "./register.js";
 import { agentName, configureArcana } from "./arcana.js";
+import { credential } from "./credential.js";
 /** This build's version, so a skew can name itself instead of being guessed at. */
 const VERSION = (() => {
     try {
@@ -79,6 +80,9 @@ switch (command) {
             suggest: flag(rest, "name") ?? agentName(process.cwd(), basename(process.cwd())),
         });
         break;
+    case "credential":
+        await credential({ name: flag(rest, "name"), host: flag(rest, "host"), local: rest.includes("--local") });
+        break;
     case "register":
         await register({ name: flag(rest, "name"), url: flag(rest, "url") });
         break;
@@ -137,6 +141,8 @@ ${dim("  npm i -g @kybernesis/create@latest")}
   ${bold("kyb skills")}          install/refresh the FDE skill suite for Claude Code
       --global          ${dim("install to ~/.claude/skills instead of this repo")}
   ${bold("kyb arcana")}          set memory workspaces + keys, and verify each pair
+  ${bold("kyb credential")}      mint this agent's control-plane credential and install it
+      --local           ${dim("write ./.env.local instead of the host")}
   ${bold("kyb register")}        register this agent with the control plane
       --name=<name>     ${dim("defaults to KYBERNESIS_AGENT in .env.local")}
       --url=<url>       ${dim("defaults to https://$EXE_VM_NAME.exe.xyz")}

package/dist/credential.d.ts

@@ -0,0 +1,6 @@
+export declare function credential(options: {
+    dir?: string;
+    name?: string;
+    host?: string;
+    local?: boolean;
+}): Promise<void>;

package/dist/credential.js

@@ -0,0 +1,125 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { upsertEnv } from "./envfile.js";
+import { signIn } from "./register.js";
+import { bold, dim, green, red, yellow } from "./util.js";
+/**
+ * `kyb credential` — mint this agent's control-plane credential and install it
+ * on its host.
+ *
+ * The credential is what an agent uses to prove it is itself: it is required to
+ * discover granted peers and to mint the short-lived tokens that reach them.
+ * Without one, `governedPeers()` finds nothing and says nothing — no tools, no
+ * error, an agent that simply never mentions the colleague you granted it.
+ *
+ * Until now the only way to install one was KYBER Studio's "Work on this
+ * computer" toggle. That is a good path and stays the default, but it is a
+ * desktop app doing something the CLI can do: sign in as the owner, mint, and
+ * write it where the agent reads it. Making a headless setup depend on a GUI
+ * toggle is the kind of gap that turns a ten-minute deployment into an evening.
+ *
+ * The value is never printed and never passed through a shell argument — it
+ * goes to the host over stdin and lands in a 0600 file.
+ */
+function envOf(dir) {
+    const out = {};
+    const p = join(dir, ".env.local");
+    if (!existsSync(p))
+        return out;
+    for (const line of readFileSync(p, "utf8").split("\n")) {
+        const m = /^\s*([A-Z0-9_]+)\s*=\s*(.*)$/.exec(line);
+        if (m?.[1] && out[m[1]] === undefined)
+            out[m[1]] = (m[2] ?? "").trim().replace(/^["']|["']$/g, "");
+    }
+    return out;
+}
+export async function credential(options) {
+    const dir = options.dir ?? process.cwd();
+    const env = envOf(dir);
+    const issuer = (env.KYBERNESIS_ISSUER || "https://agent.kybernesis.ai").replace(/\/$/, "");
+    const agent = options.name ?? env.KYBERNESIS_AGENT;
+    console.log(bold("kyb credential"));
+    if (!agent) {
+        console.log(red("  No agent name. Set KYBERNESIS_AGENT in .env.local, or pass --name=<name>."));
+        process.exitCode = 1;
+        return;
+    }
+    console.log(dim(`  agent: ${agent}   issuer: ${issuer}`));
+    const token = await signIn(issuer);
+    if (!token) {
+        process.exitCode = 1;
+        return;
+    }
+    const res = await fetch(`${issuer}/api/agents/credential`, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+        body: JSON.stringify({ agent }),
+    }).catch(() => null);
+    if (!res?.ok) {
+        const detail = ((await res?.json().catch(() => ({}))) ?? {});
+        console.log(red(`\n  Could not mint a credential (${res?.status ?? "no response"}).`));
+        if (detail.error === 'unknown agent') {
+            console.log(dim(`  No agent named "${agent}" in your org — register it first with \`kyb register\`.`));
+        }
+        else if (res?.status === 403) {
+            // Deliberately not the same as "may talk to it": holding the credential
+            // means BEING the agent, so only an owner or manage grant qualifies.
+            console.log(dim("  You need to own this agent, or hold a manage grant on it."));
+        }
+        else if (detail.error) {
+            console.log(dim(`  ${detail.error}`));
+        }
+        process.exitCode = 1;
+        return;
+    }
+    const minted = (await res.json());
+    const value = minted.credential ?? minted.token;
+    if (!value) {
+        console.log(red("  The control plane returned no credential."));
+        process.exitCode = 1;
+        return;
+    }
+    // Where the agent will read it from. A deployed agent reads the HOST's copy;
+    // writing only the laptop's is the mistake that makes this look done and
+    // leaves discovery silent, because `kyb deploy` deliberately never overwrites
+    // a host .env.local that already exists.
+    const target = options.host ?? env.EVE_SSH_HOST ?? (env.EXE_VM_NAME ? `${env.EXE_VM_NAME}.exe.xyz` : null);
+    if (options.local || !target) {
+        upsertEnv(dir, { KYBERNESIS_AGENT_CREDENTIAL: value });
+        console.log(green("\n  ✓ credential written to ./.env.local"));
+        if (!target)
+            console.log(dim("  No host known — deploy it, or re-run with --host=<ssh target>."));
+        return;
+    }
+    const name = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")).name ?? "agent";
+    const remote = `~/${name}/.env.local`;
+    // stdin, never argv: a credential in a command line is visible in the host's
+    // process list and lands in shell history on both machines.
+    const script = `set -e; f="${remote}"; f="\${f/#\\~/$HOME}"; v=$(cat); touch "$f"; chmod 600 "$f"; ` +
+        `tmp=$(mktemp); grep -v '^KYBERNESIS_AGENT_CREDENTIAL=' "$f" > "$tmp" || true; ` +
+        `printf 'KYBERNESIS_AGENT_CREDENTIAL="%s"\\n' "$v" >> "$tmp"; mv "$tmp" "$f"; chmod 600 "$f"; ` +
+        `grep -c '^KYBERNESIS_AGENT_CREDENTIAL=' "$f"`;
+    try {
+        const wrote = execFileSync("ssh", [target, script], { input: value, encoding: "utf8" });
+        console.log(green(`\n  ✓ installed on ${target} (${wrote.trim()} line)`));
+    }
+    catch {
+        console.log(red(`\n  Could not write it on ${target}.`));
+        console.log(dim("  Re-run with --local to write ./.env.local instead."));
+        process.exitCode = 1;
+        return;
+    }
+    console.log(dim("  Restarting so the agent reads it …"));
+    try {
+        execFileSync("ssh", [target, `cd ~/${name} && bash scripts/eve-server.sh restart >/dev/null 2>&1 &`], {
+            encoding: "utf8",
+        });
+        console.log(green("  ✓ restart triggered"));
+    }
+    catch {
+        console.log(yellow(`  ! could not restart — run: ssh ${target} 'cd ~/${name} && bash scripts/eve-server.sh restart'`));
+    }
+    console.log(dim(`\n  Check what it can now reach:\n` +
+        `    ssh ${target} 'cd ~/${name} && CRED=$(grep -m1 "^KYBERNESIS_AGENT_CREDENTIAL=" .env.local | cut -d= -f2- | tr -d "\\"") && curl -s -H "authorization: Bearer $CRED" ${issuer}/api/agent/peers'\n`));
+}

package/dist/register.d.ts

@@ -1,3 +1,5 @@
+/** Sign in with the device flow and return an identity token. */
+export declare function signIn(issuer: string): Promise<string | null>;
 export declare function register(options: {
     name?: string;
     url?: string;

package/dist/register.js

@@ -16,7 +16,7 @@ function envOf(dir) {
     return out;
 }
 /** Sign in with the device flow and return an identity token. */
-async function signIn(issuer) {
+export async function signIn(issuer) {
     const started = await fetch(`${issuer}/api/oauth/device`, {
         method: "POST",
         headers: { "content-type": "application/json" },

package/dist/util.d.ts

@@ -1,4 +1,4 @@
-export declare const EVE_VERSION = "0.30.8";
+export declare const EVE_VERSION = "0.38.3";
 export declare const REGISTRY_URL = "https://registry.kybernesis.ai/r/{name}.json";
 export declare const DEFAULT_ISSUER = "https://agent.kybernesis.ai";
 export declare const green: (s: string) => string;

package/dist/util.js

@@ -1,6 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { createInterface } from "node:readline/promises";
-export const EVE_VERSION = "0.30.8";
+export const EVE_VERSION = "0.38.3";
 export const REGISTRY_URL = "https://registry.kybernesis.ai/r/{name}.json";
 export const DEFAULT_ISSUER = "https://agent.kybernesis.ai";
 const TTY = process.stdout.isTTY === true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.7.13",
+  "version": "0.8.0",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent — plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",

package/skills/fde-engagement/references/playbook.md

@@ -185,7 +185,7 @@ something. Chase them a week out — an unprovisioned Vercel team on Day 1 costs
       `@kybernesis/arcana@0.1.1`, `@kybernesis/enterprise@0.1.2`,
       `@kybernesis/multiplayer@0.1.0`, `@kybernesis/evals@0.2.1`,
       `@kybernesis/create@0.1.4`, `@kybernesis/engineer@0.2.0`, and
-      `eve@0.30.8` (the Kybernesis-certified version). All public on npm;
+      `eve@0.38.3` (the Kybernesis-certified version). All public on npm;
       `kyb doctor` checks the wiring.
 
 ---
@@ -349,8 +349,8 @@ npx eve registry view @kybernesis/arcana
 ### 3.4 Pin your versions
 
 Before you install anything else, decide and record the versions this engagement pins.
-Put them in the repo README. Pin `eve@0.30.8` — the **Kybernesis-certified** version
-(certification run 2026-08-06: full suite green, zero code changes). Never pin blind
+Put them in the repo README. Pin `eve@0.38.3` — the **Kybernesis-certified** version
+(certification run 2026-08-17: full suite green; one schedule API change, see HANDOFF). Never pin blind
 npm-latest; `kyb upgrade` carries a client to the certified pin behind their own eval
 gate, and that upgrade is a **deliberate, eval-gated step**, never something that
 happens by accident mid-pilot.

package/skills/kybernesis-packages/SKILL.md

@@ -110,7 +110,7 @@ then `eve add @kybernesis/<item>`). Each covers one axis:
   asterisks onto the URL in Slack and breaks it. Coach agents in prose, not
   shell (WAFs eat shell-syntax Slack messages).
 - **ESM packaging**: relative imports need `.js` extensions (tsc doesn't
-  rewrite); eve is a peer dep with an explicit range (`>=0.30.0 <0.31.0`),
+  rewrite); eve is a peer dep with an explicit range (`>=0.38.0 <0.39.0`),
   pinned exactly in devDeps.
 - **Eval fixtures are hardened on purpose** — in-test nonces (eve caches
   compiled eval modules), per-run unique keys (workspaces accumulate),