@kybernesis/create 0.7.14 → 0.8.1

package/dist/credential.js

@@ -1,5 +1,6 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
+import { hostname } from "node:os";
 import { join } from "node:path";
 import { upsertEnv } from "./envfile.js";
 import { signIn } from "./register.js";
@@ -34,6 +35,19 @@ function envOf(dir) {
     }
     return out;
 }
+/**
+ * Is this machine the SSH target we were about to dial?
+ *
+ * Compared on the short name as well as the full one, because a host that
+ * answers to `box.example.xyz` usually reports itself as `box` — and the env
+ * file names whichever the person happened to type.
+ */
+function isThisHost(target) {
+    const self = hostname().toLowerCase();
+    const short = self.split(".")[0] ?? self;
+    const wanted = target.toLowerCase();
+    return wanted === self || wanted === short || wanted.split(".")[0] === short;
+}
 export async function credential(options) {
     const dir = options.dir ?? process.cwd();
     const env = envOf(dir);
@@ -85,9 +99,19 @@ export async function credential(options) {
     // leaves discovery silent, because `kyb deploy` deliberately never overwrites
     // a host .env.local that already exists.
     const target = options.host ?? env.EVE_SSH_HOST ?? (env.EXE_VM_NAME ? `${env.EXE_VM_NAME}.exe.xyz` : null);
-    if (options.local || !target) {
+    // Already ON the host it would otherwise SSH to.
+    //
+    // Naming a host is how a laptop installs the credential where the agent will
+    // read it. Run the same command on that host — the natural thing to do while
+    // setting one up over SSH — and it dialled itself, needed a key the host does
+    // not hold for itself, and failed at the last step of an otherwise complete
+    // sign-in. The file it wanted to write was already under the cursor.
+    const onTargetHost = target !== null && isThisHost(target);
+    if (options.local || !target || onTargetHost) {
         upsertEnv(dir, { KYBERNESIS_AGENT_CREDENTIAL: value });
         console.log(green("\n  ✓ credential written to ./.env.local"));
+        if (onTargetHost)
+            console.log(dim(`  This IS ${target}, so there was nothing to copy.`));
         if (!target)
             console.log(dim("  No host known — deploy it, or re-run with --host=<ssh target>."));
         return;

package/dist/upgrade.js

@@ -20,11 +20,37 @@ function versionLt(a, b) {
     }
     return false;
 }
+/**
+ * Warn when this CLI is itself out of date.
+ *
+ * @remarks
+ * The certified eve version is a constant compiled INTO this tool, so an old
+ * kyb reports an old pin as though it were current — and does it with total
+ * confidence, in the one command whose entire job is telling you what current
+ * means. That failure runs the wrong way round: it tells a healthy agent it is
+ * ahead of certified and in "unsupported territory", which invites someone to
+ * downgrade a fleet that was fine.
+ *
+ * Checked here rather than at install because this is the command where being
+ * stale changes the answer.
+ */
+function warnIfStale() {
+    const installed = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+    const latest = capture("npm", ["view", "@kybernesis/create", "version"])?.trim();
+    if (!latest || latest === installed)
+        return;
+    if (!versionLt(installed, latest))
+        return;
+    console.log(`  ${yellow("!")} kyb ${installed} is behind ${latest}. The certified eve version is ` +
+        `compiled into this tool, so an old kyb reports an old pin as current.`);
+    console.log(`    ${dim("npm install -g @kybernesis/create@latest")}\n`);
+}
 export async function upgrade(skipEval) {
     const cwd = process.cwd();
     const pkg = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
     const deps = { ...pkg.dependencies, ...pkg.devDependencies };
     console.log(bold("\nkyb upgrade — checking @kybernesis/* and eve against npm\n"));
+    warnIfStale();
     const toUpgrade = [];
     for (const name of PACKAGES) {
         if (!deps[name])

package/dist/util.d.ts

@@ -1,4 +1,4 @@
-export declare const EVE_VERSION = "0.30.8";
+export declare const EVE_VERSION = "0.38.3";
 export declare const REGISTRY_URL = "https://registry.kybernesis.ai/r/{name}.json";
 export declare const DEFAULT_ISSUER = "https://agent.kybernesis.ai";
 export declare const green: (s: string) => string;

package/dist/util.js

@@ -1,6 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { createInterface } from "node:readline/promises";
-export const EVE_VERSION = "0.30.8";
+export const EVE_VERSION = "0.38.3";
 export const REGISTRY_URL = "https://registry.kybernesis.ai/r/{name}.json";
 export const DEFAULT_ISSUER = "https://agent.kybernesis.ai";
 const TTY = process.stdout.isTTY === true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.7.14",
+  "version": "0.8.1",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent — plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",
@@ -31,7 +31,7 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "prepare": "tsc -p tsconfig.build.json",
+    "prepack": "tsc -p tsconfig.build.json",
     "typecheck": "tsc --noEmit",
     "prepublishOnly": "node ../../scripts/prepublish.mjs"
   },

package/skills/fde-engagement/references/playbook.md

@@ -185,7 +185,7 @@ something. Chase them a week out — an unprovisioned Vercel team on Day 1 costs
       `@kybernesis/arcana@0.1.1`, `@kybernesis/enterprise@0.1.2`,
       `@kybernesis/multiplayer@0.1.0`, `@kybernesis/evals@0.2.1`,
       `@kybernesis/create@0.1.4`, `@kybernesis/engineer@0.2.0`, and
-      `eve@0.30.8` (the Kybernesis-certified version). All public on npm;
+      `eve@0.38.3` (the Kybernesis-certified version). All public on npm;
       `kyb doctor` checks the wiring.
 
 ---
@@ -349,8 +349,8 @@ npx eve registry view @kybernesis/arcana
 ### 3.4 Pin your versions
 
 Before you install anything else, decide and record the versions this engagement pins.
-Put them in the repo README. Pin `eve@0.30.8` — the **Kybernesis-certified** version
-(certification run 2026-08-06: full suite green, zero code changes). Never pin blind
+Put them in the repo README. Pin `eve@0.38.3` — the **Kybernesis-certified** version
+(certification run 2026-08-17: full suite green; one schedule API change, see HANDOFF). Never pin blind
 npm-latest; `kyb upgrade` carries a client to the certified pin behind their own eval
 gate, and that upgrade is a **deliberate, eval-gated step**, never something that
 happens by accident mid-pilot.

package/skills/kybernesis-packages/SKILL.md

@@ -82,9 +82,10 @@ then `eve add @kybernesis/<item>`). Each covers one axis:
   same shape as eve's `experimental_chatgpt()`), `hostPreflight()`, Photon
   iMessage credentials, and a `/preview` tool. Subpaths: `/slack`, `/photon`,
   `/sandbox`, `/preview`. See the `self-hosting` skill.
-- **evals** — QA. `kybernesisBaseline({ agentDisplayName, routing,
-  engineer? })` = smoke + 5 memory + routing per dept + optional vision-loop
-  eval. Judge model ≠ model under test. Hermetic runs force all workspaces to
+- **evals** — QA. `kybernesisBaseline({ agentDisplayName, routing, engineer?,
+  safety? })` = smoke + 5 memory + 1 safety (quoted content is data, on by
+  default) + routing per dept + optional engineer pair (vision loop, push-to-main
+  refusal). Judge model ≠ model under test. Hermetic runs force all workspaces to
   `<name>-eval` via the npm script.
 - **create** — the `kyb` CLI, and the whole lifecycle of an agent:
   `init` (scaffold; `--host=exe` also installs the hardened restart script),
@@ -110,7 +111,7 @@ then `eve add @kybernesis/<item>`). Each covers one axis:
   asterisks onto the URL in Slack and breaks it. Coach agents in prose, not
   shell (WAFs eat shell-syntax Slack messages).
 - **ESM packaging**: relative imports need `.js` extensions (tsc doesn't
-  rewrite); eve is a peer dep with an explicit range (`>=0.30.0 <0.31.0`),
+  rewrite); eve is a peer dep with an explicit range (`>=0.38.0 <0.39.0`),
   pinned exactly in devDeps.
 - **Eval fixtures are hardened on purpose** — in-test nonces (eve caches
   compiled eval modules), per-run unique keys (workspaces accumulate),