@native-engagement/cli 0.9.1 → 0.11.0

package/dist/skills/native-engagement-node-installation/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: native-engagement-node-installation
+description: Prepare or repair an Engagement execution environment from a CLI or MCP Agent, reusing installed dependencies and authorized system Chrome before requesting missing components.
+---
+
+# Execution environment preparation
+
+The Bot Runtime belongs to its host. This skill explains Engagement's execution prerequisites; it does not install another Agent Runtime or grant machine, account or send authority.
+
+Read current capabilities with MCP `contracts.list` / `schema.get`, or CLI `native-engagement contracts list` / `native-engagement schema get <name>`. CLI business calls use `native-engagement query <name> --input @file.json` or `native-engagement command <name> --input @file.json`; MCP can load typed tools by task/group. Use `execution.device.list` and `execution.device.inspect` before requesting an environment. A usable existing authorized device should be reused; a Bot using MCP or the CLI is not automatically an execution node.
+
+When no suitable device exists, use `execution.environment.request` to retain the exact non-secret installation intent, target host and resource plan. Present its Human approval through the host's interaction UI. Follow `execution.environment.get` and the original installation authority's authenticated handoff. Do not invent an installer URL, enrollment credential, heartbeat or device registration. Missing trusted artifacts or a host launcher remain explicit prerequisites. Lost acknowledgements retain the same request and idempotency key.
+
+## Inspect before preparing
+
+- On an installed local MCP broker, load the `local-setup` task for onboarding/modules. When dependency checks are needed, use `tools.catalog` with `names: ["local.dependencies.inspect", "local.dependencies.manage"]`, then inspect dependencies before repair. These local ports are not remote center query names. `moduleDependencies` distinguishes missing, invalid, unsupported and available components. Inspection does not start a browser, download models or prove execution readiness.
+- Inventory the target host's existing Node version, package manager/store, Java/Android SDK when needed, official browser, media programs and pinned model files. Match the selected module's real version, digest, permissions and platform requirements. Reuse compatible installed programs, caches and protected configuration; do not download or install a duplicate merely because it lives outside a task directory.
+- Use `local.dependencies.manage` only through its inspected revision and original configuration CAS. `prepare` adopts a uniquely located trusted media program inside the retained roots. Ambiguous programs, missing credentials and model/license decisions need an explicit protected repair or Human input. Do not widen sandbox roots, substitute unverified models or run arbitrary commands through this interface.
+- Install only missing authorized components, using the original trusted OS/installation path and existing package-manager cache. Reinspect afterwards. No broad system upgrade or per-account model copy is implied.
+
+## Existing official Chrome
+
+Social browser modules use the target environment's installed, Human-authorized official Google Chrome and their supported existing-session/native-control connection. Reuse the exact approved page/profile and permission lifetime. Do not install or launch Playwright, its managed Chromium, a headless substitute, stealth/fingerprint patches or a replacement login profile for social account operation. If official Chrome or the required supported control path is absent, report the prerequisite and request its approved preparation; do not silently change browser engines. This installation rule does not redefine isolated repository test fixtures.
+
+Chrome selection is not evidence that a platform accepts automation. Respect account activity budgets, Human takeover, risk pauses and observed challenges. Never disable security features or bypass platform controls. A send with an unknown result must follow original VERIFY; changing environments does not authorize resending.
+
+## Shared media and LAN services
+
+Speech/OCR/media processing belongs to the Tenant's shared authorized media capability pool. Reuse qualified local executables or an approved configured LAN API; do not install a model for each Bot, mailbox or social account. LAN endpoints and credentials belong to protected host configuration, never chat messages, argv, tool schemas or public receipts. Discovery cannot fabricate supported languages, audio formats, quality or streaming capability.
+
+Set CPU, memory, concurrency and time limits before starting a new owned worker. Registration, online presence, dependency availability, model qualification and actual channel success are separate facts. Stop only task-owned temporary processes and children when their work ends; preserve other hosts, user Chrome, original journals and UNKNOWN receipts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@native-engagement/cli",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "type": "module",
   "engines": {
     "node": ">=24.22.1 <25"
@@ -8,6 +8,7 @@
   "license": "Apache-2.0",
   "files": [
     "dist",
+    "README.md",
     "LICENSE",
     "release.json",
     "THIRD_PARTY_LICENSES.txt"

package/release.json

@@ -1,8 +1,28 @@
 {
   "schemaVersion": 1,
-  "sourceCommit": "bc4ff2a04ed51d004904430cabe24b6a739f88e8",
+  "version": "0.11.0",
   "channel": "beta",
   "bundledComponents": [
+    {
+      "name": "ajv",
+      "version": "8.20.0",
+      "license": "MIT"
+    },
+    {
+      "name": "fast-deep-equal",
+      "version": "3.1.3",
+      "license": "MIT"
+    },
+    {
+      "name": "json-schema-traverse",
+      "version": "1.0.0",
+      "license": "MIT"
+    },
+    {
+      "name": "fast-uri",
+      "version": "3.1.9",
+      "license": "BSD-3-Clause"
+    },
     {
       "name": "oauth4webapi",
       "version": "3.8.8",
@@ -13,6 +33,5 @@
       "version": "6.8.7",
       "license": "MIT"
     }
-  ],
-  "lockSha256": "00164f8922c82350ad7cbe357f976d03b46faec9ebe48c634cb8ba2a922c3e3c"
+  ]
 }