@lamalibre/create-lamaste 4.3.1 → 4.4.0

package/vendor/docs/identity-directory-design.md

@@ -1,7 +1,7 @@
 # Lamaste Identity Directory — Design Document
 
 > **Status:** design, 2026-10-13. Nothing here is implemented yet.
-> **Package:** `@lamalibre/lamaste-identity@4.3.1` (completes the existing SDK).
+> **Package:** `@lamalibre/lamaste-identity@4.4.0` (completes the existing SDK).
 > **Companions:** `gatekeeper-design.md` (authorization),
 > `plugin-development/design/agent-hosted-app-plugins.md` (app plugins).
 
@@ -178,7 +178,7 @@ and compares it with the local projection (by `userId` and `version`). It
 applies differences and logs how many it found — a non-zero count on a
 healthy system is a bug in the change feed and is reported to the panel.
 
-## SDK (`@lamalibre/lamaste-identity@4.3.1`)
+## SDK (`@lamalibre/lamaste-identity@4.4.0`)
 
 Today's surface stays; three pieces are added.
 

package/vendor/docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-docs",
-  "version": "4.3.1",
+  "version": "4.4.0",
   "private": true,
   "description": "Lamaste documentation — markdown files served by the panel and published to GitHub Pages",
   "type": "module",

package/vendor/docs/todo/lib-cli-desktop-refactor.md

@@ -29,7 +29,7 @@ feria                        dev registry — OUT OF SCOPE, do not touch
 
 ### Naming Rules
 
-- **`lamaste`** is the core lib. You `import { ... } from '@lamalibre/lamaste@4.3.1'`. No `-lib` suffix.
+- **`lamaste`** is the core lib. You `import { ... } from '@lamalibre/lamaste@4.4.0'`. No `-lib` suffix.
 - **`-d` suffix** for daemons — Unix convention (`httpd`, `sshd`, `mongod`). Instantly signals "long-running process".
 - **`-ui`** for React component libraries — universal term, avoids "serverd serves the panel" tautology.
 - **`create-*`** for all npx one-shot tools — the one npm convention everyone knows.
@@ -74,24 +74,24 @@ lamaste                              core library (types, constants, schemas, pl
 
 | #   | Package (npm name)                  | Type        | Depends on | Purpose                                                                                                             |
 | --- | ----------------------------------- | ----------- | ---------- | ------------------------------------------------------------------------------------------------------------------- |
-| 1   | `@lamalibre/lamaste@4.3.1`                | core lib    | nothing    | Types, constants, Zod schemas, plugin host Fastify plugin, atomic file helpers, client interfaces                   |
-|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.3.1/agent` — agent domain logic                                                            |
-|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.3.1/server` — server domain logic                                                          |
-| 2   | `@lamalibre/lamaste-agent@4.3.1`          | CLI         | `lamaste`  | Thin agent CLI. No Fastify, no HTTP                                                                                 |
-| 3   | `@lamalibre/lamaste-agentd@4.3.1`         | daemon      | `lamaste`  | Agent REST API on :9393. No CLI argument parsing                                                                    |
-| 4   | `@lamalibre/lamaste-agent-ui@4.3.1`       | UI lib      | `lamaste`  | Agent React components + browser SPA build. Used by desktop and agentd                                              |
-| 5   | `@lamalibre/lamaste-server@4.3.1`         | CLI         | `lamaste`  | **NEW.** Thin server CLI. No Fastify, no HTTP                                                                       |
-| 6   | `@lamalibre/lamaste-serverd@4.3.1`        | daemon      | `lamaste`  | Server REST API on :3100. No CLI argument parsing. Renamed from `serverd`                                           |
-| 7   | `@lamalibre/lamaste-server-ui@4.3.1`      | UI lib      | `lamaste`  | Server/admin React components + browser SPA build. Replaces both `panel-client` and `lamaste-admin-panel`           |
-| 8   | `@lamalibre/lamaste@4.3.1-desktop`        | desktop     | `lamaste`  | Unified Tauri app. Multi-target: full, agent-only, server-only. Credentials, tray, deep links                       |
-| 9   | `@lamalibre/lamaste-cloud@4.3.1`          | lib + CLI   | —          | Cloud provider abstraction (already correct pattern)                                                                |
-| 10  | `@lamalibre/lamaste-tickets@4.3.1`        | SDK         | —          | Agent-to-agent authorization                                                                                        |
-| 11  | `@lamalibre/lamaste-identity@4.3.1`       | SDK         | —          | Authelia identity parsing and query                                                                                 |
-| 12  | `@lamalibre/create-lamaste@4.3.1`         | provisioner | `lamaste`  | Server provisioner: OS hardening, nginx, Authelia, certs. `npx create-lamaste`                                      |
-| 13  | `@lamalibre/create-lamaste-agent@4.3.1`   | provisioner | `lamaste`  | Agent provisioner: cert enrollment, service setup. `npx create-lamaste-agent`. Renamed from `install-lamaste-agent` |
-| 14  | `@lamalibre/create-lamaste-desktop@4.3.1` | installer   | —          | Desktop app installer. `npx create-lamaste-desktop`. Renamed from `install-lamaste-desktop`                         |
-| 15  | `@lamalibre/create-lamaste-admin@4.3.1`   | provisioner | `lamaste`  | Admin cert upgrade to hardware-bound. `npx create-lamaste-admin`. Renamed from `install-lamaste-admin`              |
-| 16  | `@lamalibre/create-lamaste-e2e@4.3.1`     | test infra  | —          | E2E test MCP server. `npx create-lamaste-e2e`. Renamed from `install-lamaste-e2e-mcp`                               |
+| 1   | `@lamalibre/lamaste@4.4.0`                | core lib    | nothing    | Types, constants, Zod schemas, plugin host Fastify plugin, atomic file helpers, client interfaces                   |
+|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.4.0/agent` — agent domain logic                                                            |
+|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.4.0/server` — server domain logic                                                          |
+| 2   | `@lamalibre/lamaste-agent@4.4.0`          | CLI         | `lamaste`  | Thin agent CLI. No Fastify, no HTTP                                                                                 |
+| 3   | `@lamalibre/lamaste-agentd@4.4.0`         | daemon      | `lamaste`  | Agent REST API on :9393. No CLI argument parsing                                                                    |
+| 4   | `@lamalibre/lamaste-agent-ui@4.4.0`       | UI lib      | `lamaste`  | Agent React components + browser SPA build. Used by desktop and agentd                                              |
+| 5   | `@lamalibre/lamaste-server@4.4.0`         | CLI         | `lamaste`  | **NEW.** Thin server CLI. No Fastify, no HTTP                                                                       |
+| 6   | `@lamalibre/lamaste-serverd@4.4.0`        | daemon      | `lamaste`  | Server REST API on :3100. No CLI argument parsing. Renamed from `serverd`                                           |
+| 7   | `@lamalibre/lamaste-server-ui@4.4.0`      | UI lib      | `lamaste`  | Server/admin React components + browser SPA build. Replaces both `panel-client` and `lamaste-admin-panel`           |
+| 8   | `@lamalibre/lamaste@4.4.0-desktop`        | desktop     | `lamaste`  | Unified Tauri app. Multi-target: full, agent-only, server-only. Credentials, tray, deep links                       |
+| 9   | `@lamalibre/lamaste-cloud@4.4.0`          | lib + CLI   | —          | Cloud provider abstraction (already correct pattern)                                                                |
+| 10  | `@lamalibre/lamaste-tickets@4.4.0`        | SDK         | —          | Agent-to-agent authorization                                                                                        |
+| 11  | `@lamalibre/lamaste-identity@4.4.0`       | SDK         | —          | Authelia identity parsing and query                                                                                 |
+| 12  | `@lamalibre/create-lamaste@4.4.0`         | provisioner | `lamaste`  | Server provisioner: OS hardening, nginx, Authelia, certs. `npx create-lamaste`                                      |
+| 13  | `@lamalibre/create-lamaste-agent@4.4.0`   | provisioner | `lamaste`  | Agent provisioner: cert enrollment, service setup. `npx create-lamaste-agent`. Renamed from `install-lamaste-agent` |
+| 14  | `@lamalibre/create-lamaste-desktop@4.4.0` | installer   | —          | Desktop app installer. `npx create-lamaste-desktop`. Renamed from `install-lamaste-desktop`                         |
+| 15  | `@lamalibre/create-lamaste-admin@4.4.0`   | provisioner | `lamaste`  | Admin cert upgrade to hardware-bound. `npx create-lamaste-admin`. Renamed from `install-lamaste-admin`              |
+| 16  | `@lamalibre/create-lamaste-e2e@4.4.0`     | test infra  | —          | E2E test MCP server. `npx create-lamaste-e2e`. Renamed from `install-lamaste-e2e-mcp`                               |
 | 17  | `@lamalibre/feria`                  | dev tool    | —          | Dev registry + release runner. **Out of scope — do not touch in this refactor**                                     |
 
 ### Rename Map (1.x → 2.0.0)
@@ -116,7 +116,7 @@ The core library uses **subpath exports** to provide domain-specific entry point
 
 ```json
 {
-  "name": "@lamalibre/lamaste@4.3.1",
+  "name": "@lamalibre/lamaste@4.4.0",
   "exports": {
     ".": "./dist/index.js",
     "./agent": "./dist/agent/index.js",
@@ -126,9 +126,9 @@ The core library uses **subpath exports** to provide domain-specific entry point
 ```
 
 ```typescript
-import { RESERVED_API_PREFIXES, pluginManifestSchema } from '@lamalibre/lamaste@4.3.1';
-import { loadRegistry, loadAgent, isAgentLoaded } from '@lamalibre/lamaste@4.3.1/agent';
-import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.3.1/server';
+import { RESERVED_API_PREFIXES, pluginManifestSchema } from '@lamalibre/lamaste@4.4.0';
+import { loadRegistry, loadAgent, isAgentLoaded } from '@lamalibre/lamaste@4.4.0/agent';
+import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.4.0/server';
 ```
 
 **Why subpath exports instead of three packages (`lamaste-lib`, `lamaste-lib-agent`, `lamaste-lib-server`):**
@@ -149,7 +149,7 @@ import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.3.1/server';
 
 | Layer                    | Agent side                                      | Server side                                    |
 | ------------------------ | ----------------------------------------------- | ---------------------------------------------- |
-| **Domain logic**         | `@lamalibre/lamaste@4.3.1/agent`                      | `@lamalibre/lamaste@4.3.1/server`                    |
+| **Domain logic**         | `@lamalibre/lamaste@4.4.0/agent`                      | `@lamalibre/lamaste@4.4.0/server`                    |
 | **Operational CLI**      | `lamaste-agent`                                 | `lamaste-server` (new)                         |
 | **Long-running daemon**  | `lamalibre-lamaste-agentd` on :9393 (extracted) | `lamalibre-lamaste-serverd` on :3100 (renamed) |
 | **UI components**        | `lamaste-agent-ui` (renamed)                    | `lamaste-server-ui` (merged)                   |
@@ -471,7 +471,7 @@ The Rust backend has both `commands.rs` (legacy) and `agents.rs` (multi-agent).
 
 Create `packages/lamaste/` (TypeScript) with subpath exports:
 
-**Root (`@lamalibre/lamaste@4.3.1`):**
+**Root (`@lamalibre/lamaste@4.4.0`):**
 
 - Types: `AdminClient`, `AgentClient` TypeScript interfaces, plugin manifest types, capability types
 - Constants: Reserved API prefixes, curated plugin list, capability names
@@ -479,7 +479,7 @@ Create `packages/lamaste/` (TypeScript) with subpath exports:
 - Plugin Host: Fastify plugin for plugin route mounting, bundle serving, disabled handler (unified from three routers)
 - File Helpers: Atomic write (temp → fsync → rename), promise-chain mutex
 
-**Agent subpath (`@lamalibre/lamaste@4.3.1/agent`):**
+**Agent subpath (`@lamalibre/lamaste@4.4.0/agent`):**
 
 - Platform: Path helpers, platform detection (from `platform.js`)
 - Registry: Agent registry CRUD, label validation, legacy migration (from `registry.js`)
@@ -491,7 +491,7 @@ Create `packages/lamaste/` (TypeScript) with subpath exports:
 - Server Registry: servers.json and storage-servers.json CRUD (new — from Rust `cloud.rs`)
 - Mode: Server mode and admin cert file operations (new — from Rust `mode.rs`)
 
-**Server subpath (`@lamalibre/lamaste@4.3.1/server`):**
+**Server subpath (`@lamalibre/lamaste@4.4.0/server`):**
 
 - Plugins: Server-side plugin lifecycle (uses shared schema from root)
 - Tunnels: Tunnel creation workflow with rollback (from `routes/tunnels.js`)

package/vendor/gatekeeper/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-gatekeeper",
-  "version": "4.3.1",
+  "version": "4.4.0",
   "description": "Authorization layer for Lamaste — groups, grants, and tunnel access control",
   "type": "module",
   "exports": {
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@fastify/rate-limit": "^10.3.0",
-    "@lamalibre/lamaste": "^4.3.1",
+    "@lamalibre/lamaste": "^4.4.0",
     "fastify": "^5.3.3",
     "undici": "^7.8.0",
     "zod": "^3.24.4"

package/vendor/server/bin/lamaste-server.js

@@ -60,7 +60,7 @@ ${b('COMMANDS')}
   ${c('status')}          Server health, uptime, services, certificate status
   ${c('logs')}            View server log output (journalctl wrapper)
   ${c('restart')}         Restart panel server and optionally gatekeeper
-  ${c('plugins')}         Manage plugins (list, install, enable, disable, uninstall, update, hosting, hooks, operations, …)
+  ${c('plugins')}         Manage plugins (list, install, enable, disable, uninstall, update, hosting, hooks, settings, …)
   ${c('push-install')}    Push install: on/off, default policy, open/close an agent's window
   ${c('audit')}           The panel's audit log (approvals, hostings, updates, hook events)
   ${c('tunnels')}         Manage tunnels (list, create, delete, toggle)
@@ -99,6 +99,9 @@ ${b('EXAMPLES')}
   ${d('# Install a plugin')}
   ${c('lamaste-server plugins install @lamalibre/herd-server')}
 
+  ${d("# Change an agent-hosted plugin's settings; secrets come on stdin, never as arguments")}
+  ${c('lamaste-server plugins configure myplugin --set retries=5 --secrets-stdin < secrets.json')}
+
   ${d("# Let the panel install an app plugin's agent half on agent vm1 for the next hour")}
   ${c('lamaste-server push-install on')}
   ${c('lamaste-server push-install open vm1 --minutes 60')}

package/vendor/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-server",
-  "version": "4.3.1",
+  "version": "4.4.0",
   "description": "Server operations CLI for Lamaste",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -17,7 +17,8 @@
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@lamalibre/lamaste": "^4.3.1",
+    "@clack/prompts": "^1.8.1",
+    "@lamalibre/lamaste": "^4.4.0",
     "chalk": "^5.3.0",
     "execa": "^9.0.0"
   },
@@ -27,6 +28,6 @@
     "directory": "packages/server/cli"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=20.12.0"
   }
 }