@nocville/npc 0.3.1 → 0.4.0

package/README.md

@@ -226,3 +226,22 @@ class MyNPC extends PollingNPC {
 
 `nocville-npc --help` lists every command and flag, and `nocville-npc doctor` checks that your
 key and connection work. More at [nocville.com](https://nocville.com).
+
+## Encrypted Cloudflare workspaces
+
+Download and verify the producer workspace settings in team privacy settings, then:
+
+```sh
+nocville-npc init --workspace=/absolute/path/workspace.json
+# Supply the agent key through NOCVILLE_API_KEY or the existing init prompt.
+nocville-npc system-monitor
+```
+
+`--workspace`, `NOCVILLE_WORKSPACE`, and the saved workspace path are supported in
+that order. Constructor `workspace` overrides them. The first publication displays
+a signing-device fingerprint for the team owner to approve. Approval is shared by
+the local NPCs using this credential, including coding-agent hooks and watchdogs.
+The workspace pins the HTTPS origin and opaque map ID; changing either requires
+matching verified workspace settings. The `doctor` command uses encrypted enrollment
+and an offline probe for these workspaces. The Node SDK README describes private
+profile storage and the encryption boundary.

package/dist/cjs/cli.js

@@ -96,6 +96,7 @@ Monitoring NPC types:
   web-page-watcher        Render a watched web page as a pixel-art TV
 
 Common Options:
+  --workspace=<file>     Verified producer workspace settings from team privacy settings.
   --api-key=<key>         Team API key (or NOCVILLE_API_KEY env)
   --api-url=<url>         Nocville API URL (or NOCVILLE_API_URL env).
                           Default: https://nocville.com. For local dev use
@@ -512,7 +513,20 @@ async function runInit(flags, config) {
     let apiKey = (0, config_js_1.stringFlag)(flags, 'api-key');
     const apiUrl = (0, config_js_1.stringFlag)(flags, 'api-url');
     const map = (0, config_js_1.stringFlag)(flags, 'map');
-    if (!apiKey && !apiUrl && !map) {
+    const workspace = config.workspace;
+    if (workspace)
+        apiKey = apiKey || config.apiKey;
+    if (workspace && !apiKey) {
+        const { resolveApiKey } = await Promise.resolve().then(() => __importStar(require('./core/api-key.js')));
+        const resolved = await resolveApiKey({ flags });
+        if (!resolved.ok) {
+            console.error(resolved.error);
+            process.exitCode = 1;
+            return;
+        }
+        apiKey = resolved.key;
+    }
+    if (!apiKey && !apiUrl && !map && !workspace) {
         const saved = loadUserConfig();
         if (saved.apiKey && !process.env['NOCVILLE_API_KEY']?.trim()) {
             console.log('Usage: nocville-npc init --api-key=<key> [--api-url=<url>] [--map=<name>]');
@@ -528,7 +542,12 @@ async function runInit(flags, config) {
         }
         apiKey = resolved.key;
     }
-    const path = saveUserConfig({ apiKey, apiUrl, map });
+    const path = saveUserConfig({
+        apiKey,
+        apiUrl: workspace ? config.apiUrl : apiUrl,
+        map: workspace ? config.map : map,
+        workspace,
+    });
     const saved = loadUserConfig();
     console.log(`✓ Saved ${path} (mode 0600)`);
     console.log(`  API: ${saved.apiUrl ?? 'https://nocville.com'}  key: ${maskKey(saved.apiKey)}`);

package/dist/cjs/core/base-npc.js

@@ -17,6 +17,7 @@ class BaseNPC {
         // We can't access `this.name` here since it's abstract, so use a placeholder
         this.logger = new logger_js_1.Logger('npc', config.debug);
         this.client = new node_1.NocvilleClient({
+            workspace: config.workspace,
             apiUrl: config.apiUrl,
             apiKey: config.apiKey,
             serviceId: config.serviceId,

package/dist/cjs/core/config.js

@@ -6,6 +6,8 @@ exports.stringFlag = stringFlag;
 exports.boolFlag = boolFlag;
 exports.listFlag = listFlag;
 exports.numberFlag = numberFlag;
+const node_1 = require("@nocville/node");
+const node_path_1 = require("node:path");
 const user_config_js_1 = require("./user-config.js");
 /**
  * Simple hand-rolled CLI arg parser.
@@ -56,9 +58,16 @@ function parseArgs(argv) {
  */
 function resolveConfig(flags, overrides) {
     const saved = (0, user_config_js_1.loadUserConfig)();
+    const workspacePath = overrides?.workspace ||
+        stringFlag(flags, 'workspace') ||
+        process.env['NOCVILLE_WORKSPACE'] ||
+        saved.workspace;
+    const workspace = workspacePath ? (0, node_path_1.resolve)(workspacePath) : undefined;
+    const enrollment = workspace ? (0, node_1.loadProducerWorkspace)(workspace) : undefined;
     const apiUrl = overrides?.apiUrl ||
         stringFlag(flags, 'api-url') ||
         process.env['NOCVILLE_API_URL'] ||
+        enrollment?.apiUrl ||
         saved.apiUrl ||
         'https://nocville.com';
     const apiKey = overrides?.apiKey ||
@@ -76,10 +85,23 @@ function resolveConfig(flags, overrides) {
     const map = overrides?.map ||
         stringFlag(flags, 'map') ||
         process.env['NOCVILLE_MAP'] ||
+        enrollment?.encryption.mapId ||
         saved.map ||
         undefined;
     const name = overrides?.name || stringFlag(flags, 'name') || process.env['NOCVILLE_NAME'] || undefined;
-    return { apiUrl, apiKey, serviceId, debug, map, name };
+    if (enrollment && apiUrl.replace(/\/+$/, '') !== enrollment.apiUrl)
+        throw new Error('API origin does not match the verified workspace');
+    if (enrollment && map && map !== enrollment.encryption.mapId)
+        throw new Error('Encrypted producers use the map ID in their workspace settings');
+    return {
+        apiUrl,
+        apiKey,
+        serviceId,
+        debug,
+        map: enrollment?.encryption.mapId ?? map,
+        name,
+        ...(workspace ? { workspace } : {}),
+    };
 }
 function stringFlag(flags, key) {
     const val = flags[key];

package/dist/cjs/core/user-config.js

@@ -25,6 +25,8 @@ function loadUserConfig(path = userConfigPath()) {
     try {
         const raw = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf-8'));
         const out = {};
+        if (typeof raw['workspace'] === 'string' && raw['workspace'])
+            out.workspace = raw['workspace'];
         if (typeof raw['apiUrl'] === 'string' && raw['apiUrl'])
             out.apiUrl = raw['apiUrl'];
         if (typeof raw['apiKey'] === 'string' && raw['apiKey'])

package/dist/cjs/doctor.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runDoctor = runDoctor;
 exports.hasCodexHookWatcherOverlap = hasCodexHookWatcherOverlap;
+const node_1 = require("@nocville/node");
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const liveness_js_1 = require("./npcs/agent-common/liveness.js");
@@ -43,6 +44,24 @@ async function runDoctor(config) {
     if (!hasKey) {
         console.log('  [SKIP] POST /api/v1/status — no --api-key / NOCVILLE_API_KEY set');
     }
+    else if (config.workspace || config.apiKey.includes('.team_')) {
+        // Exercise the locally encrypted path; never send a plaintext probe to a v2 workspace.
+        try {
+            const client = new node_1.NocvilleClient({
+                workspace: config.workspace,
+                apiUrl: config.apiUrl,
+                apiKey: config.apiKey,
+                serviceId: 'nocville-doctor',
+                retries: 0,
+            });
+            const result = await client.pushStatus({ status: 'unknown', offline: true });
+            pushOk = result.success;
+            console.log(`  [${pushOk ? 'OK' : 'FAIL'}] Encrypted producer: ${result.error ?? 'accepted'}`);
+        }
+        catch (error) {
+            console.log(`  [FAIL] Encrypted producer: ${error.message}`);
+        }
+    }
     else {
         const start = Date.now();
         const t = withTimeout(5000);

package/dist/cjs/npcs/agent-common/session.js

@@ -263,6 +263,7 @@ function buildAgentPayload(adapter, state, config) {
 }
 async function defaultPush(config, serviceId, payload, timeoutMs) {
     const client = new node_1.NocvilleClient({
+        workspace: config.workspace,
         apiUrl: config.apiUrl,
         apiKey: config.apiKey,
         serviceId,
@@ -381,6 +382,8 @@ function spawnDetachedAgent(adapter, config, args, cliPath = process.argv[1]) {
     if (!cliPath)
         return undefined;
     const env = { ...process.env };
+    if (config.workspace)
+        env['NOCVILLE_WORKSPACE'] = config.workspace;
     env['NOCVILLE_API_URL'] = config.apiUrl;
     env['NOCVILLE_API_KEY'] = config.apiKey;
     if (config.map)

package/dist/cjs/npcs/codex/watcher.js

@@ -339,6 +339,7 @@ class CodexWatcher {
             let client = this.clients.get(serviceId);
             if (!client) {
                 client = new node_1.NocvilleClient({
+                    workspace: this.config.workspace,
                     apiUrl: this.config.apiUrl,
                     apiKey: this.config.apiKey,
                     serviceId,

package/dist/cli.js

@@ -61,6 +61,7 @@ Monitoring NPC types:
   web-page-watcher        Render a watched web page as a pixel-art TV
 
 Common Options:
+  --workspace=<file>     Verified producer workspace settings from team privacy settings.
   --api-key=<key>         Team API key (or NOCVILLE_API_KEY env)
   --api-url=<url>         Nocville API URL (or NOCVILLE_API_URL env).
                           Default: https://nocville.com. For local dev use
@@ -477,7 +478,20 @@ async function runInit(flags, config) {
     let apiKey = stringFlag(flags, 'api-key');
     const apiUrl = stringFlag(flags, 'api-url');
     const map = stringFlag(flags, 'map');
-    if (!apiKey && !apiUrl && !map) {
+    const workspace = config.workspace;
+    if (workspace)
+        apiKey = apiKey || config.apiKey;
+    if (workspace && !apiKey) {
+        const { resolveApiKey } = await import('./core/api-key.js');
+        const resolved = await resolveApiKey({ flags });
+        if (!resolved.ok) {
+            console.error(resolved.error);
+            process.exitCode = 1;
+            return;
+        }
+        apiKey = resolved.key;
+    }
+    if (!apiKey && !apiUrl && !map && !workspace) {
         const saved = loadUserConfig();
         if (saved.apiKey && !process.env['NOCVILLE_API_KEY']?.trim()) {
             console.log('Usage: nocville-npc init --api-key=<key> [--api-url=<url>] [--map=<name>]');
@@ -493,7 +507,12 @@ async function runInit(flags, config) {
         }
         apiKey = resolved.key;
     }
-    const path = saveUserConfig({ apiKey, apiUrl, map });
+    const path = saveUserConfig({
+        apiKey,
+        apiUrl: workspace ? config.apiUrl : apiUrl,
+        map: workspace ? config.map : map,
+        workspace,
+    });
     const saved = loadUserConfig();
     console.log(`✓ Saved ${path} (mode 0600)`);
     console.log(`  API: ${saved.apiUrl ?? 'https://nocville.com'}  key: ${maskKey(saved.apiKey)}`);

package/dist/core/base-npc.js

@@ -14,6 +14,7 @@ export class BaseNPC {
         // We can't access `this.name` here since it's abstract, so use a placeholder
         this.logger = new Logger('npc', config.debug);
         this.client = new NocvilleClient({
+            workspace: config.workspace,
             apiUrl: config.apiUrl,
             apiKey: config.apiKey,
             serviceId: config.serviceId,

package/dist/core/config.js

@@ -1,3 +1,5 @@
+import { loadProducerWorkspace } from '@nocville/node';
+import { resolve } from 'node:path';
 import { loadUserConfig } from './user-config.js';
 /**
  * Simple hand-rolled CLI arg parser.
@@ -48,9 +50,16 @@ export function parseArgs(argv) {
  */
 export function resolveConfig(flags, overrides) {
     const saved = loadUserConfig();
+    const workspacePath = overrides?.workspace ||
+        stringFlag(flags, 'workspace') ||
+        process.env['NOCVILLE_WORKSPACE'] ||
+        saved.workspace;
+    const workspace = workspacePath ? resolve(workspacePath) : undefined;
+    const enrollment = workspace ? loadProducerWorkspace(workspace) : undefined;
     const apiUrl = overrides?.apiUrl ||
         stringFlag(flags, 'api-url') ||
         process.env['NOCVILLE_API_URL'] ||
+        enrollment?.apiUrl ||
         saved.apiUrl ||
         'https://nocville.com';
     const apiKey = overrides?.apiKey ||
@@ -68,10 +77,23 @@ export function resolveConfig(flags, overrides) {
     const map = overrides?.map ||
         stringFlag(flags, 'map') ||
         process.env['NOCVILLE_MAP'] ||
+        enrollment?.encryption.mapId ||
         saved.map ||
         undefined;
     const name = overrides?.name || stringFlag(flags, 'name') || process.env['NOCVILLE_NAME'] || undefined;
-    return { apiUrl, apiKey, serviceId, debug, map, name };
+    if (enrollment && apiUrl.replace(/\/+$/, '') !== enrollment.apiUrl)
+        throw new Error('API origin does not match the verified workspace');
+    if (enrollment && map && map !== enrollment.encryption.mapId)
+        throw new Error('Encrypted producers use the map ID in their workspace settings');
+    return {
+        apiUrl,
+        apiKey,
+        serviceId,
+        debug,
+        map: enrollment?.encryption.mapId ?? map,
+        name,
+        ...(workspace ? { workspace } : {}),
+    };
 }
 export function stringFlag(flags, key) {
     const val = flags[key];

package/dist/core/types.d.ts

@@ -6,6 +6,8 @@ export type Archetype = 'service' | 'database' | 'trading' | 'ai-agent' | 'pipel
 /** A companion declaration is the SDK's CompanionSpec. */
 export type CompanionDecl = CompanionSpec;
 export interface NpcConfig {
+    /** Local verified workspace enrollment bundle. */
+    workspace?: string;
     apiUrl: string;
     apiKey: string;
     serviceId: string;

package/dist/core/user-config.d.ts

@@ -4,6 +4,7 @@
  * has to appear in ~/.claude/settings.json, ~/.codex/hooks.json or `ps` output.
  */
 export interface UserConfig {
+    workspace?: string;
     apiUrl?: string;
     apiKey?: string;
     map?: string;

package/dist/core/user-config.js

@@ -18,6 +18,8 @@ export function loadUserConfig(path = userConfigPath()) {
     try {
         const raw = JSON.parse(readFileSync(path, 'utf-8'));
         const out = {};
+        if (typeof raw['workspace'] === 'string' && raw['workspace'])
+            out.workspace = raw['workspace'];
         if (typeof raw['apiUrl'] === 'string' && raw['apiUrl'])
             out.apiUrl = raw['apiUrl'];
         if (typeof raw['apiKey'] === 'string' && raw['apiKey'])

package/dist/doctor.js

@@ -1,3 +1,4 @@
+import { NocvilleClient } from '@nocville/node';
 import { randomUUID } from 'node:crypto';
 import { readdirSync } from 'node:fs';
 import { isAgentAlive } from './npcs/agent-common/liveness.js';
@@ -39,6 +40,24 @@ export async function runDoctor(config) {
     if (!hasKey) {
         console.log('  [SKIP] POST /api/v1/status — no --api-key / NOCVILLE_API_KEY set');
     }
+    else if (config.workspace || config.apiKey.includes('.team_')) {
+        // Exercise the locally encrypted path; never send a plaintext probe to a v2 workspace.
+        try {
+            const client = new NocvilleClient({
+                workspace: config.workspace,
+                apiUrl: config.apiUrl,
+                apiKey: config.apiKey,
+                serviceId: 'nocville-doctor',
+                retries: 0,
+            });
+            const result = await client.pushStatus({ status: 'unknown', offline: true });
+            pushOk = result.success;
+            console.log(`  [${pushOk ? 'OK' : 'FAIL'}] Encrypted producer: ${result.error ?? 'accepted'}`);
+        }
+        catch (error) {
+            console.log(`  [FAIL] Encrypted producer: ${error.message}`);
+        }
+    }
     else {
         const start = Date.now();
         const t = withTimeout(5000);

package/dist/npcs/agent-common/session.js

@@ -241,6 +241,7 @@ export function buildAgentPayload(adapter, state, config) {
 }
 async function defaultPush(config, serviceId, payload, timeoutMs) {
     const client = new NocvilleClient({
+        workspace: config.workspace,
         apiUrl: config.apiUrl,
         apiKey: config.apiKey,
         serviceId,
@@ -359,6 +360,8 @@ export function spawnDetachedAgent(adapter, config, args, cliPath = process.argv
     if (!cliPath)
         return undefined;
     const env = { ...process.env };
+    if (config.workspace)
+        env['NOCVILLE_WORKSPACE'] = config.workspace;
     env['NOCVILLE_API_URL'] = config.apiUrl;
     env['NOCVILLE_API_KEY'] = config.apiKey;
     if (config.map)

package/dist/npcs/codex/watcher.js

@@ -335,6 +335,7 @@ export class CodexWatcher {
             let client = this.clients.get(serviceId);
             if (!client) {
                 client = new NocvilleClient({
+                    workspace: this.config.workspace,
                     apiUrl: this.config.apiUrl,
                     apiKey: this.config.apiKey,
                     serviceId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocville/npc",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Put your Claude Code and Codex sessions (and your servers) in the Nocville office as live NPCs",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,7 +24,7 @@
   ],
   "dependencies": {
     "pngjs": "^7.0.0",
-    "@nocville/node": "^0.3.1"
+    "@nocville/node": "^0.4.0"
   },
   "peerDependencies": {
     "puppeteer-core": "*"