@m8t-stack/cli 0.2.72 → 0.2.74

package/dist/cli.js

@@ -81,6 +81,17 @@ var init_reasons = __esm({
   }
 });
 
+// ../../packages/api-contract/dist/esm/delegated-identity.js
+var SERVICE_APP_ROLE, END_USER_KEY_MAX_LENGTH, END_USER_KEY_PATTERN;
+var init_delegated_identity = __esm({
+  "../../packages/api-contract/dist/esm/delegated-identity.js"() {
+    "use strict";
+    SERVICE_APP_ROLE = "Agents.Invoke";
+    END_USER_KEY_MAX_LENGTH = 200;
+    END_USER_KEY_PATTERN = new RegExp(`^[A-Za-z0-9._-]{1,${String(END_USER_KEY_MAX_LENGTH)}}$`);
+  }
+});
+
 // ../../packages/api-contract/dist/esm/team.js
 var init_team = __esm({
   "../../packages/api-contract/dist/esm/team.js"() {
@@ -224,6 +235,7 @@ var init_esm = __esm({
     init_response();
     init_errors2();
     init_reasons();
+    init_delegated_identity();
     init_team();
     init_me();
     init_binding();
@@ -1370,7 +1382,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.72";
+var CLI_VERSION = "0.2.74";
 
 // src/lib/render-error.ts
 init_errors();
@@ -15663,10 +15675,16 @@ import * as fs9 from "fs";
 import * as path9 from "path";
 var SEED_MANIFEST_PATH = ".m8t/seed-manifest.json";
 var SEED_PATHS = ["skills", "references", "targets"];
+function isUpstream(v) {
+  if (v === void 0) return true;
+  if (!v || typeof v !== "object") return false;
+  const u = v;
+  return typeof u.repo === "string" && u.repo.length > 0 && typeof u.ref === "string" && u.ref.length > 0;
+}
 function isLineage(v) {
   if (!v || typeof v !== "object") return false;
   const l = v;
-  return typeof l.name === "string" && typeof l.refreshedToCommit === "string" && typeof l.refreshedToVersion === "string" && Array.isArray(l.ownedPaths) && l.ownedPaths.every((p) => typeof p === "string");
+  return typeof l.name === "string" && typeof l.refreshedToCommit === "string" && typeof l.refreshedToVersion === "string" && Array.isArray(l.ownedPaths) && l.ownedPaths.every((p) => typeof p === "string") && isUpstream(l.upstream);
 }
 function parseSeedManifest(text) {
   if (!text?.trim()) return null;
@@ -15684,6 +15702,11 @@ function parseSeedManifest(text) {
 function buildSeedManifest(seeds) {
   return { schemaVersion: 1, seeds };
 }
+function carryUpstream(prior, lineage) {
+  if (lineage.upstream) return lineage;
+  const before = prior?.seeds.find((s) => s.name === lineage.name)?.upstream;
+  return before ? { ...lineage, upstream: before } : lineage;
+}
 function upsertLineage(manifest, lineage) {
   const prior = manifest?.seeds ?? [];
   const others = prior.filter((s) => s.name !== lineage.name);
@@ -15960,6 +15983,15 @@ async function syncAgentContent(args) {
   await hydrateAgentsInto(args.root, pin.agents, args.deps);
   return Object.values(pin.agents).map((a) => ({ persona: a.persona, repo: a.repo, ref: a.ref }));
 }
+function upstreamForSeed(root, seedName) {
+  try {
+    const pin = parseReleasePin(fs12.readFileSync(path12.join(root, PIN_REL_PATH), "utf8"), PIN_REL_PATH);
+    const agent = Object.values(pin.agents).find((a) => a.persona === seedName);
+    return agent ? { repo: agent.repo, ref: agent.ref } : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function agentContentHint(root, persona) {
   try {
     const pin = parseReleasePin(fs12.readFileSync(path12.join(root, PIN_REL_PATH), "utf8"), PIN_REL_PATH);
@@ -16034,7 +16066,8 @@ function writeSeedMarker(args) {
     name: args.seedName,
     refreshedToCommit: args.refreshedToCommit,
     refreshedToVersion: args.version,
-    ownedPaths: deriveOwnedPaths(args.seedDir)
+    ownedPaths: deriveOwnedPaths(args.seedDir),
+    ...args.upstream ? { upstream: args.upstream } : {}
   }]);
   const dest = path13.join(args.destDir, SEED_MANIFEST_PATH);
   fs13.mkdirSync(path13.dirname(dest), { recursive: true });
@@ -16658,7 +16691,15 @@ var BrainCreateCommand = class extends M8tCommand {
         materializeBrainTree({ templateSrc, destDir: tmpDir, seedDir });
         if (seedName && seedDir) {
           const headSha = resolveScaffoldCommit(repoRoot, env);
-          writeSeedMarker({ destDir: tmpDir, seedName, seedDir, refreshedToCommit: headSha, version: "(scaffold)" });
+          const upstream = upstreamForSeed(repoRoot, seedName);
+          writeSeedMarker({
+            destDir: tmpDir,
+            seedName,
+            seedDir,
+            refreshedToCommit: headSha,
+            version: "(scaffold)",
+            ...upstream ? { upstream } : {}
+          });
         }
         this.context.stdout.write(
           seedName ? `${colors.dim("\u2192")} copied brain-template/ + overlaid seed ${colors.field(seedName)} to ${tmpDir}
@@ -21534,14 +21575,15 @@ async function refreshBrainRepo(args) {
   const ownedNow = new Set(args.trees.ownedAtTheirs);
   assertNoDanglingIndexRefs(finalPaths, (p) => ownedNow.has(p), indexBodies);
   const newOwned = deriveOwnedPaths(args.trees.theirsDir);
+  const priorManifest = args.priorManifest ?? (args.lineage ? { schemaVersion: 1, seeds: [args.lineage] } : null);
   const nextManifest = upsertLineage(
-    args.priorManifest ?? (args.lineage ? { schemaVersion: 1, seeds: [args.lineage] } : null),
-    {
+    priorManifest,
+    carryUpstream(priorManifest, {
       name: args.seedName,
       refreshedToCommit: args.targetCommit ?? "",
       refreshedToVersion: args.version,
       ownedPaths: newOwned
-    }
+    })
   );
   files.push({ path: SEED_MANIFEST_PATH, content: serializeSeedManifest(nextManifest) });
   for (const sb of args.supersedeBranches ?? []) {
@@ -23303,6 +23345,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
 import { Command as Command42, Option as Option39 } from "clipanion";
 
 // src/lib/app-reg.ts
+init_esm();
 init_errors();
 var APP_NAME = "m8t-webapp";
 var AZURE_CLI_FIRST_PARTY_APP_ID = "04b07795-8ddb-461a-bbee-02f9e1bf7b46";
@@ -23403,6 +23446,52 @@ async function ensureExposeAnApi(appId, appObjectId) {
     ]);
   }
 }
+async function ensureServiceAppRole(appId, appObjectId) {
+  const existingRoles = await azJson([
+    "ad",
+    "app",
+    "show",
+    "--id",
+    appId,
+    "--query",
+    "appRoles",
+    "--output",
+    "json"
+  ]);
+  if (!Array.isArray(existingRoles)) {
+    throw new LocalCliError({
+      code: "APP_REG_ROLES_UNREADABLE",
+      message: `Could not read the existing app roles on app registration ${appId}.`,
+      hint: "Re-run once you can read the app registration; writing the role now would risk replacing roles we cannot see."
+    });
+  }
+  const already = existingRoles.find((r) => r.value === SERVICE_APP_ROLE);
+  if (already && already.isEnabled !== false) return;
+  const appRoles = already ? existingRoles.map((r) => r.value === SERVICE_APP_ROLE ? { ...r, isEnabled: true } : r) : [
+    ...existingRoles,
+    {
+      id: globalThis.crypto.randomUUID(),
+      displayName: "Invoke agents",
+      description: "Allows a service principal to call the gateway agent API.",
+      value: SERVICE_APP_ROLE,
+      allowedMemberTypes: ["Application"],
+      isEnabled: true
+    }
+  ];
+  await runAz([
+    "rest",
+    "--method",
+    "PATCH",
+    // The OBJECT id, not the app id: Graph's /applications/{id} addresses the
+    // object id, and an appId here is a 404.
+    "--url",
+    `https://graph.microsoft.com/v1.0/applications/${appObjectId}`,
+    "--headers",
+    "Content-Type=application/json",
+    "--body",
+    JSON.stringify({ appRoles })
+  ]);
+}
 async function ensureAppReg(opts) {
   if (opts.clientId) {
     return { tenantId: opts.tenantId, clientId: opts.clientId, appObjectId: null };
@@ -23422,6 +23511,7 @@ async function ensureAppReg(opts) {
       });
     }
     await ensureExposeAnApi(app.appId, objId);
+    await ensureServiceAppRole(app.appId, objId);
     return { tenantId: opts.tenantId, clientId: app.appId, appObjectId: objId };
   }
   const me = await azJson(
@@ -23533,6 +23623,7 @@ async function ensureAppReg(opts) {
     })
   ]);
   await ensureExposeAnApi(created.appId, created.id);
+  await ensureServiceAppRole(created.appId, created.id);
   return { tenantId: opts.tenantId, clientId: created.appId, appObjectId: created.id };
 }
 async function ensureGatewayRedirectUri(gatewayClientId, fqdn) {
@@ -29925,7 +30016,7 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.58";
+var DEFAULT_INSTALLER_TAG = "v0.1.59";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -30892,19 +30983,22 @@ async function resolveSeedContext(opts) {
   if (!appCreds) return null;
   let endpoint = opts.endpointOverride;
   let subscriptionId = opts.subscriptionId;
-  if (!endpoint) {
+  let recorded = opts.brainsOverride;
+  if (!endpoint || !opts.brainOverride && recorded === void 0) {
     const state = await readBootstrapState();
     if (!state) {
       throw new LocalCliError({ code: "BOOTSTRAP_NO_STATE", message: "No bootstrap state found.", hint: "Run 'm8t bootstrap launch' first, or pass --endpoint." });
     }
     subscriptionId ??= state.subscriptionId;
     const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
-    endpoint = doc.result?.foundryEndpoint;
+    endpoint ??= doc.result?.foundryEndpoint;
+    recorded ??= doc.result?.brains;
     if (!endpoint) {
       throw new LocalCliError({ code: "SEED_NO_ENDPOINT", message: "Could not resolve the Foundry endpoint from the install status.", hint: "Pass --endpoint <foundryEndpoint>." });
     }
   }
-  const brainRepos = opts.brainOverride ? [opts.brainOverride] : [`${appCreds.org}/stacey-brain`, `${appCreds.org}/ezra-brain`];
+  const brainRepos = opts.brainOverride ? [opts.brainOverride] : recorded ?? [];
+  if (brainRepos.length === 0) return null;
   return { endpoint, brainRepos, appCreds, subscriptionId };
 }
 var MEMORY_INDEX_PATH = "memory/MEMORY.md";
@@ -31051,7 +31145,12 @@ function spawnDetachedSeedWatch() {
   }
 }
 async function reactiveSeedOnInstallComplete(args) {
-  const ctx = await resolveSeedContext({ endpointOverride: args.endpoint, appCredsOverride: args.appCredsOverride, subscriptionId: args.subscriptionId });
+  const ctx = await resolveSeedContext({
+    endpointOverride: args.endpoint,
+    appCredsOverride: args.appCredsOverride,
+    subscriptionId: args.subscriptionId,
+    brainsOverride: args.brains
+  });
   if (!ctx) return;
   const token = await (args.getFoundryTokenImpl ?? getFoundryToken)();
   const { hadIntake, block } = await findOnboardingProfile({ endpoint: ctx.endpoint, token, fetchImpl: args.fetchImpl });
@@ -31081,8 +31180,7 @@ async function reactiveSeedOnInstallComplete(args) {
 
 // src/lib/install-summary.ts
 var DEFAULT_WORKERS = [
-  { name: "stacey", label: "Stacey - Startup Advisor", brain: "stacey-brain", executor: "stacey-coder" },
-  { name: "ezra", label: "Ezra   - Azure Expert", brain: "ezra-brain", executor: "ezra-executor" }
+  { name: "ezra", label: "Ezra - Azure Expert", brain: "ezra-brain" }
 ];
 function renderInstallSummary(args) {
   const open3 = args.webappUrl ? `${args.webappUrl}        (or run: m8t open)` : "run: m8t open";
@@ -31094,11 +31192,11 @@ function renderInstallSummary(args) {
   if (args.brainOrg) {
     lines.push("   Your team:");
     for (const w of DEFAULT_WORKERS) {
-      lines.push(`     \u2022 ${w.label}   \xB7 brain: ${args.brainOrg}/${w.brain}   \xB7 executor: ${w.executor}`);
+      lines.push(`     \u2022 ${w.label}   \xB7 brain: ${args.brainOrg}/${w.brain}`);
     }
     lines.push(
       "",
-      "   Reach them:  @stacey / @ezra (or /stacey) in your coding agent",
+      "   Reach them:  @ezra (or /ezra) in your coding agent",
       "                \xB7 the webapp  \xB7 or connect Telegram in the webapp (Channels)"
     );
   } else {
@@ -32192,7 +32290,7 @@ async function runCompanionInstallCommand(stdout, install) {
     return 1;
   }
   stdout.write(
-    `Desktop companions installed: Stacey and Ezra are ready.
+    `Desktop companions installed - they are at the edge of your screen.
 Version: ${state.version}
 `
   );
@@ -32352,7 +32450,7 @@ async function finalizeInstall(args, deps = defaultDeps2) {
   args.stdout(renderInstallSummary({ webappUrl, brainOrg }) + "\n");
   args.stdout(
     `${colors.field("Optional local tooling for your coding agent:")}
-  \u2022 Talk to your deployed workers from agent sessions (e.g. /stacey) \u2014 install the m8t plugin: guides/install/m8t-plugin.md.
+  \u2022 Talk to your deployed workers from agent sessions (e.g. /ezra) \u2014 install the m8t plugin: guides/install/m8t-plugin.md.
   \u2022 Azure-capable MCP servers (microsoft/azure-skills, Microsoft Learn) \u2014 see the optional steps in guides/install.md.
   \u2022 Deploy workers conversationally with the opt-in persona skills \u2014 see guides/workers.md.
   \u2022 Make sure your m8t CLI is current: npm i -g @m8t-stack/cli@latest
@@ -32363,6 +32461,9 @@ ${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP se
   try {
     await deps.reactiveSeed({
       endpoint: args.doc.result?.foundryEndpoint,
+      // What the install RECORDED creating. Seeding a fixed roster instead used to
+      // fail every default install against a brain that was never created.
+      brains: args.doc.result?.brains,
       subscriptionId: args.subscriptionId,
       stdout: args.stdout
     });
@@ -32384,14 +32485,14 @@ ${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP se
     const alreadyHasCompanion = await deps.companionStatus().then((s) => s.state !== "not-installed").catch(() => true);
     const pinned = alreadyHasCompanion ? void 0 : args.doc.result?.platformVersion;
     args.stdout(
-      (pinned === void 0 ? "Putting Stacey and Ezra on your desktop \u2014 fetching the latest released build\n" : `Putting Stacey and Ezra on your desktop \u2014 fetching the build ${pinned} pins
+      (pinned === void 0 ? "Putting your mates on your desktop \u2014 fetching the latest released build\n" : `Putting your mates on your desktop \u2014 fetching the build ${pinned} pins
 `) + `  ${colors.hint("(about 120 MB; on a slow link this takes a few minutes)")}
 `
     );
     try {
       const companion = await deps.convergeCompanion(pinned);
       if (companion.state === "installed") {
-        args.stdout("Desktop companions installed: Stacey and Ezra are ready.\n\n");
+        args.stdout("Desktop companions installed - they are at the edge of your screen.\n\n");
       } else if (companion.state === "not-released") {
         args.stdout(
           `${pinned === void 0 ? "The latest platform release carries no desktop companions." : `The release this platform is pinned to (${pinned}) carries no desktop companions.`}
@@ -34230,11 +34331,11 @@ function parseEvent(value) {
     };
   }
   if (value.type === "roster") {
-    if (!hasExactKeys(value, ["type", "origin", "mates"]) || !isGatewayOrigin(value.origin) || !Array.isArray(value.mates) || value.mates.length !== 2) {
+    if (!hasExactKeys(value, ["type", "origin", "mates"]) || !isGatewayOrigin(value.origin) || !Array.isArray(value.mates) || value.mates.length === 0) {
       return eventError();
     }
     const mates = value.mates.map(parseMate);
-    if (new Set(mates.map(({ personaKey }) => personaKey)).size !== 2 || new Set(mates.map(({ agentName }) => agentName)).size !== 2) {
+    if (new Set(mates.map(({ personaKey }) => personaKey)).size !== mates.length || new Set(mates.map(({ agentName }) => agentName)).size !== mates.length) {
       return eventError();
     }
     return { type: "roster", origin: value.origin, mates };
@@ -34425,7 +34526,8 @@ function resolveAgentName(agents, personaKey) {
   const matches = agents.filter(
     (agent) => agent.personaKey === personaKey && isAgentName(agent.name)
   );
-  if (matches.length !== 1) {
+  if (matches.length === 0) return null;
+  if (matches.length > 1) {
     throw new PredispatchFailure("mate-unavailable");
   }
   const match = matches[0];
@@ -34434,6 +34536,11 @@ function resolveAgentName(agents, personaKey) {
   }
   return match.name;
 }
+function requireAgentName(agents, personaKey) {
+  const name = resolveAgentName(agents, personaKey);
+  if (name === null) throw new PredispatchFailure("mate-unavailable");
+  return name;
+}
 function decodeConversationId(data) {
   if (!isRecord3(data) || typeof data.id !== "string" || !OPAQUE_ID.test(data.id)) {
     throw new PredispatchFailure("not-connected");
@@ -34598,22 +34705,15 @@ async function rosterCompanions(sink, deps = {}) {
     const activeSince = new Date(
       installed === null || installed > now ? now : installed
     ).toISOString();
-    const mates = [
-      {
-        personaKey: "startup-advisor",
-        agentName: resolveAgentName(agents, "startup-advisor"),
-        displayName: "Stacey",
-        portraitKey: "stacey",
-        activeSince
-      },
-      {
-        personaKey: "ezra",
-        agentName: resolveAgentName(agents, "ezra"),
-        displayName: "Ezra",
-        portraitKey: "ezra",
-        activeSince
-      }
+    const PRESENTABLE = [
+      { personaKey: "startup-advisor", displayName: "Stacey", portraitKey: "stacey" },
+      { personaKey: "ezra", displayName: "Ezra", portraitKey: "ezra" }
     ];
+    const mates = PRESENTABLE.flatMap((mate) => {
+      const agentName = resolveAgentName(agents, mate.personaKey);
+      return agentName === null ? [] : [{ ...mate, agentName, activeSince }];
+    });
+    if (mates.length === 0) throw new PredispatchFailure("mate-unavailable");
     const event = parseEvent({ type: "roster", origin, mates });
     sink(event);
     return event;
@@ -34745,7 +34845,7 @@ async function dispatchConversation(request, sink, deps, consume, readDesktopMar
       token,
       controller.signal
     );
-    const agentName = resolveAgentName(agents, request.personaKey);
+    const agentName = requireAgentName(agents, request.personaKey);
     const conversationId = await (deps.resolveConversationId ?? resolveConversationId)(
       fetchImpl,
       origin,
@@ -34856,7 +34956,7 @@ async function historyCompanionMessages(request, sink, deps = {}) {
       token,
       controller.signal
     );
-    const agentName = resolveAgentName(agents, request.personaKey);
+    const agentName = requireAgentName(agents, request.personaKey);
     const conversationId = await (deps.resolveConversationId ?? resolveConversationId)(
       fetchImpl,
       origin,