@kybernesis/create 0.8.0 → 0.8.1

package/dist/credential.js

@@ -1,5 +1,6 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
+import { hostname } from "node:os";
 import { join } from "node:path";
 import { upsertEnv } from "./envfile.js";
 import { signIn } from "./register.js";
@@ -34,6 +35,19 @@ function envOf(dir) {
     }
     return out;
 }
+/**
+ * Is this machine the SSH target we were about to dial?
+ *
+ * Compared on the short name as well as the full one, because a host that
+ * answers to `box.example.xyz` usually reports itself as `box` — and the env
+ * file names whichever the person happened to type.
+ */
+function isThisHost(target) {
+    const self = hostname().toLowerCase();
+    const short = self.split(".")[0] ?? self;
+    const wanted = target.toLowerCase();
+    return wanted === self || wanted === short || wanted.split(".")[0] === short;
+}
 export async function credential(options) {
     const dir = options.dir ?? process.cwd();
     const env = envOf(dir);
@@ -85,9 +99,19 @@ export async function credential(options) {
     // leaves discovery silent, because `kyb deploy` deliberately never overwrites
     // a host .env.local that already exists.
     const target = options.host ?? env.EVE_SSH_HOST ?? (env.EXE_VM_NAME ? `${env.EXE_VM_NAME}.exe.xyz` : null);
-    if (options.local || !target) {
+    // Already ON the host it would otherwise SSH to.
+    //
+    // Naming a host is how a laptop installs the credential where the agent will
+    // read it. Run the same command on that host — the natural thing to do while
+    // setting one up over SSH — and it dialled itself, needed a key the host does
+    // not hold for itself, and failed at the last step of an otherwise complete
+    // sign-in. The file it wanted to write was already under the cursor.
+    const onTargetHost = target !== null && isThisHost(target);
+    if (options.local || !target || onTargetHost) {
         upsertEnv(dir, { KYBERNESIS_AGENT_CREDENTIAL: value });
         console.log(green("\n  ✓ credential written to ./.env.local"));
+        if (onTargetHost)
+            console.log(dim(`  This IS ${target}, so there was nothing to copy.`));
         if (!target)
             console.log(dim("  No host known — deploy it, or re-run with --host=<ssh target>."));
         return;

package/dist/upgrade.js

@@ -20,11 +20,37 @@ function versionLt(a, b) {
     }
     return false;
 }
+/**
+ * Warn when this CLI is itself out of date.
+ *
+ * @remarks
+ * The certified eve version is a constant compiled INTO this tool, so an old
+ * kyb reports an old pin as though it were current — and does it with total
+ * confidence, in the one command whose entire job is telling you what current
+ * means. That failure runs the wrong way round: it tells a healthy agent it is
+ * ahead of certified and in "unsupported territory", which invites someone to
+ * downgrade a fleet that was fine.
+ *
+ * Checked here rather than at install because this is the command where being
+ * stale changes the answer.
+ */
+function warnIfStale() {
+    const installed = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+    const latest = capture("npm", ["view", "@kybernesis/create", "version"])?.trim();
+    if (!latest || latest === installed)
+        return;
+    if (!versionLt(installed, latest))
+        return;
+    console.log(`  ${yellow("!")} kyb ${installed} is behind ${latest}. The certified eve version is ` +
+        `compiled into this tool, so an old kyb reports an old pin as current.`);
+    console.log(`    ${dim("npm install -g @kybernesis/create@latest")}\n`);
+}
 export async function upgrade(skipEval) {
     const cwd = process.cwd();
     const pkg = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
     const deps = { ...pkg.dependencies, ...pkg.devDependencies };
     console.log(bold("\nkyb upgrade — checking @kybernesis/* and eve against npm\n"));
+    warnIfStale();
     const toUpgrade = [];
     for (const name of PACKAGES) {
         if (!deps[name])

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent — plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",
@@ -31,7 +31,7 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "prepare": "tsc -p tsconfig.build.json",
+    "prepack": "tsc -p tsconfig.build.json",
     "typecheck": "tsc --noEmit",
     "prepublishOnly": "node ../../scripts/prepublish.mjs"
   },

package/skills/kybernesis-packages/SKILL.md

@@ -82,9 +82,10 @@ then `eve add @kybernesis/<item>`). Each covers one axis:
   same shape as eve's `experimental_chatgpt()`), `hostPreflight()`, Photon
   iMessage credentials, and a `/preview` tool. Subpaths: `/slack`, `/photon`,
   `/sandbox`, `/preview`. See the `self-hosting` skill.
-- **evals** — QA. `kybernesisBaseline({ agentDisplayName, routing,
-  engineer? })` = smoke + 5 memory + routing per dept + optional vision-loop
-  eval. Judge model ≠ model under test. Hermetic runs force all workspaces to
+- **evals** — QA. `kybernesisBaseline({ agentDisplayName, routing, engineer?,
+  safety? })` = smoke + 5 memory + 1 safety (quoted content is data, on by
+  default) + routing per dept + optional engineer pair (vision loop, push-to-main
+  refusal). Judge model ≠ model under test. Hermetic runs force all workspaces to
   `<name>-eval` via the npm script.
 - **create** — the `kyb` CLI, and the whole lifecycle of an agent:
   `init` (scaffold; `--host=exe` also installs the hardened restart script),