@nocville/npc 0.4.0 → 0.4.1

package/README.md

@@ -7,18 +7,22 @@ a hand when it needs you, dozes when idle, and shows what it's doing on its spee
 desk sign: `Editing src/GameScene.ts`, `Running pnpm test`, `Searching for 'reconnect'`,
 `Needs your approval`, `Thinking…`. It leaves the office when the session ends.
 
-Requires Node.js 20+. Get an agent key in your Nocville office under **Connect AI coworkers**.
+Requires Node.js 20.12 or newer and a Nocville account.
 
 ## Quick start: AI coworkers
 
 ```bash
-npx @nocville/npc setup
+npx @nocville/npc@latest setup
 ```
 
-Paste your key at the prompt (input is hidden, so the key never lands in your shell history).
-For scripts, pass `--api-key=<your key>` or set `NOCVILLE_API_KEY` instead. That's it. The
-command saves your key to `~/.config/nocville/config.json` (readable only by you), then hooks
-up whichever agents you have installed:
+Setup opens Nocville in your browser. Sign in, choose your team and office, and click
+**Connect this computer**. If the browser asks for local network access, allow it so
+it can return the connection to the setup command on this computer. Keep an existing
+team member's office open during the first connection so encrypted publishing can
+be enabled automatically.
+
+Setup saves the publishing key and verified workspace settings in private files under
+`~/.config/nocville/`, then hooks up whichever agents you have installed:
 
 - **Claude Code**: adds hooks to `~/.claude/settings.json`. New sessions show up right away;
   restart sessions that are already running.
@@ -31,10 +35,10 @@ up whichever agents you have installed:
 Your existing hooks are left alone, and Nocville's hooks never answer permission prompts or
 change what your agent does; they only report activity.
 
-Running your own Nocville server? Add `--api-url=https://your-server`. To send sessions to a
-map other than your team's default, add `--map="Trading Floor"`.
+Using your team’s own Cloudflare hosting? Add `--api-url=https://your-office-host`.
+Use `setup --reconnect` to choose a different office or renew the connection.
 
-Prefer a global install? Run `npm i -g @nocville/npc`, then `nocville-npc setup --api-key=…`.
+Prefer a global install? Run `npm i -g @nocville/npc`, then `nocville-npc setup`.
 When setup runs through `npx`, it copies itself to `~/.config/nocville/runtime/` so the hooks
 keep working after npm clears its cache.
 
@@ -75,8 +79,11 @@ checks the current folder (`--project=<dir>`, `--name=<session name>` to test ot
 Gemini CLI and Cursor on their own. For Cursor, start a new chat after setup.
 
 `nocville-npc uninstall` removes every Nocville hook. `nocville-npc init` only saves
-credentials. Every setup command takes the key from `--api-key`, then `NOCVILLE_API_KEY`, then
-the saved config, and otherwise prompts for it (in a terminal) or exits with an error. `nocville-npc doctor` checks connectivity and sends a test push.
+credentials. Cloudflare setup connects through your browser unless a complete encrypted
+workspace is already configured. For automated installations, supply a trusted
+`--workspace=/absolute/path/workspace.json` and `NOCVILLE_API_KEY`. Legacy self-hosted
+servers still accept the hidden key prompt. `nocville-npc doctor` checks connectivity
+and sends a test push.
 
 ### What you'll see
 
@@ -229,19 +236,14 @@ key and connection work. More at [nocville.com](https://nocville.com).
 
 ## Encrypted Cloudflare workspaces
 
-Download and verify the producer workspace settings in team privacy settings, then:
-
-```sh
-nocville-npc init --workspace=/absolute/path/workspace.json
-# Supply the agent key through NOCVILLE_API_KEY or the existing init prompt.
-nocville-npc system-monitor
-```
-
-`--workspace`, `NOCVILLE_WORKSPACE`, and the saved workspace path are supported in
-that order. Constructor `workspace` overrides them. The first publication displays
-a signing-device fingerprint for the team owner to approve. Approval is shared by
-the local NPCs using this credential, including coding-agent hooks and watchdogs.
-The workspace pins the HTTPS origin and opaque map ID; changing either requires
-matching verified workspace settings. The `doctor` command uses encrypted enrollment
-and an offline probe for these workspaces. The Node SDK README describes private
-profile storage and the encryption boundary.
+Run `npx @nocville/npc@latest setup` to configure encrypted publishing automatically.
+Old keys from the former server deployment cannot publish to encrypted workspaces;
+setup replaces that connection without removing other agents' hooks.
+
+For managed automation, `--workspace`, `NOCVILLE_WORKSPACE`, and the saved workspace
+path are supported in that order. Constructor `workspace` overrides them. The
+workspace pins the HTTPS origin, deployment, team root and map ID. Reconnecting to
+the same team cannot silently replace its pinned encryption identity. Local NPCs,
+agent hooks and watchdogs share an enrolled producer profile for the credential.
+The `doctor` command uses encrypted enrollment and an offline probe. The Node SDK
+README describes private profile storage and the encryption boundary.

package/dist/cjs/cli.js

@@ -47,9 +47,9 @@ const USAGE = `
 nocville-npc <command> [options]
 
 Quick start (AI coworkers):
-  nocville-npc setup                        Paste your agent key (hidden prompt),
+  nocville-npc setup                        Connect your office in the browser,
                                             then hook up installed coding agents
-                                            (whichever are installed)
+  nocville-npc setup --reconnect            Choose an office and renew this connection
   nocville-npc setup --api-key=<agent key>   Same, non-interactive
   nocville-npc uninstall                    Remove all Nocville hooks
 
@@ -186,22 +186,27 @@ async function main() {
         console.log(USAGE);
         process.exit(1);
     }
-    const config = (0, config_js_1.resolveConfig)(parsed.flags);
+    let config = (0, config_js_1.resolveConfig)(parsed.flags);
     const logger = new logger_js_1.Logger('cli', config.debug);
     // Setup-style commands resolve the key: --api-key > env > saved > hidden prompt.
     const isAgentSetup = ['claude-code', 'codex', 'gemini', 'cursor'].includes(parsed.command) &&
         parsed.subcommand === 'setup' &&
         !parsed.flags['uninstall'];
     if (isAgentSetup || parsed.command === 'setup') {
-        if (parsed.command === 'setup') {
-            const { codexHome } = await Promise.resolve().then(() => __importStar(require('./npcs/codex/defaults.js')));
-            if (!(0, node_fs_1.existsSync)((0, node_path_1.join)((0, node_os_1.homedir)(), '.claude')) &&
-                !(0, node_fs_1.existsSync)(codexHome()) &&
-                !(0, node_fs_1.existsSync)((0, node_path_1.join)((0, node_os_1.homedir)(), '.gemini')) &&
-                !(0, node_fs_1.existsSync)((0, node_path_1.join)((0, node_os_1.homedir)(), '.cursor'))) {
-                console.error('Nothing to set up: install Claude Code, Codex, Gemini CLI or Cursor first.');
-                process.exitCode = 1;
-                return;
+        if (!config.workspace || !config.apiKey.includes('.team_') || parsed.flags['reconnect']) {
+            const { connectCloudflareOffice } = await Promise.resolve().then(() => __importStar(require('./core/browser-connect.js')));
+            if (await connectCloudflareOffice(config.apiUrl)) {
+                const { loadUserConfig } = await Promise.resolve().then(() => __importStar(require('./core/user-config.js')));
+                const saved = loadUserConfig();
+                for (const [flag, value] of Object.entries({
+                    'api-key': saved.apiKey,
+                    'api-url': saved.apiUrl,
+                    map: saved.map,
+                    workspace: saved.workspace,
+                }))
+                    if (value)
+                        parsed.flags[flag] = value;
+                config = (0, config_js_1.resolveConfig)(parsed.flags);
             }
         }
         const key = await resolveSetupKey(parsed.flags);
@@ -209,6 +214,16 @@ async function main() {
             return;
         if (key !== undefined)
             parsed.flags['api-key'] = key;
+        config = (0, config_js_1.resolveConfig)(parsed.flags);
+        if (config.workspace) {
+            const { saveUserConfig } = await Promise.resolve().then(() => __importStar(require('./core/user-config.js')));
+            saveUserConfig({
+                workspace: config.workspace,
+                apiUrl: config.apiUrl,
+                apiKey: config.apiKey,
+                map: config.map,
+            });
+        }
     }
     // AI-agent integrations have their own config handling (hooks read the saved config).
     if (parsed.command === 'claude-code') {
@@ -291,6 +306,10 @@ async function main() {
         return;
     }
     // All other NPC types require api-url and token
+    if (!config.workspace &&
+        (config.apiKey.includes('.team_') ||
+            config.apiUrl.replace(/\/+$/, '') === 'https://nocville.com'))
+        throw new Error('Connect this computer to your office first: run npx @nocville/npc@latest setup. Existing legacy keys cannot publish encrypted NPC updates.');
     if (!config.apiKey) {
         console.error('Error: no API key — run `nocville-npc init --api-key=<key>`, or pass --api-key / NOCVILLE_API_KEY');
         process.exit(1);
@@ -639,8 +658,7 @@ async function runSetupAll(flags) {
         console.log('· Cursor not found (~/.cursor missing) — skipped');
     }
     if (!any) {
-        console.error('Nothing to set up: install Claude Code, Codex, Gemini CLI or Cursor first.');
-        process.exitCode = 1;
+        console.log('No supported coding agents found. You can still run NPC commands on this computer.');
     }
 }
 main().catch((err) => {

package/dist/cjs/core/browser-connect.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateConnection = validateConnection;
+exports.browserConnection = browserConnection;
+exports.saveBrowserConnection = saveBrowserConnection;
+exports.openConnectionBrowser = openConnectionBrowser;
+exports.connectCloudflareOffice = connectCloudflareOffice;
+const node_http_1 = require("node:http");
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_1 = require("@nocville/node");
+const user_config_js_1 = require("./user-config.js");
+function validateConnection(input, origin, deploymentId) {
+    const value = input;
+    const e = value?.workspace?.encryption;
+    if (typeof value?.apiKey !== 'string' ||
+        !/^nvk_[a-f0-9]{64}\.team_[A-Za-z0-9_-]{1,64}$/.test(value.apiKey) ||
+        value.workspace?.apiUrl !== origin ||
+        e?.deploymentId !== deploymentId ||
+        !/^team_[A-Za-z0-9_-]{1,64}$/.test(e?.teamId ?? '') ||
+        !/^map_[A-Za-z0-9_-]{1,128}$/.test(e?.mapId ?? '') ||
+        !/^[A-Za-z0-9_-]{43}$/.test(e?.trustedRoot ?? '') ||
+        !value.apiKey.endsWith('.' + e.teamId) ||
+        e.profileDirectory !== undefined)
+        throw new Error('Invalid office connection. Start setup again.');
+    return {
+        apiKey: value.apiKey,
+        workspace: {
+            apiUrl: origin,
+            encryption: {
+                deploymentId,
+                teamId: e.teamId,
+                mapId: e.mapId,
+                trustedRoot: e.trustedRoot,
+            },
+        },
+    };
+}
+/** A one-use loopback receiver. Credentials never appear in a URL or terminal output. */
+async function browserConnection(origin, deploymentId, save, timeoutMs = 300000) {
+    const target = new URL(origin);
+    if (target.origin !== origin ||
+        target.username ||
+        target.password ||
+        (target.protocol !== 'https:' &&
+            !(target.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(target.hostname))))
+        throw new Error('Use an HTTPS office address.');
+    const state = (0, node_crypto_1.randomBytes)(32).toString('hex');
+    let finish, fail;
+    const done = new Promise((resolve, reject) => {
+        finish = resolve;
+        fail = reject;
+    });
+    // A timeout may happen while the browser launcher is still opening.
+    void done.catch(() => { });
+    let consumed = false, port = 0;
+    const server = (0, node_http_1.createServer)(async (request, response) => {
+        response.setHeader('Cache-Control', 'no-store');
+        if (request.headers.host !== `127.0.0.1:${port}` ||
+            request.url !== '/complete' ||
+            request.headers.origin !== origin) {
+            response.writeHead(403).end();
+            return;
+        }
+        response.setHeader('Access-Control-Allow-Origin', origin);
+        response.setHeader('Vary', 'Origin');
+        if (request.method === 'OPTIONS') {
+            response.setHeader('Access-Control-Allow-Methods', 'POST');
+            response.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+            response.setHeader('Access-Control-Allow-Private-Network', 'true');
+            response.writeHead(204).end();
+            return;
+        }
+        if (request.method !== 'POST' ||
+            request.headers['content-type']?.split(';')[0] !== 'application/json') {
+            response.writeHead(415).end();
+            return;
+        }
+        try {
+            let size = 0;
+            const chunks = [];
+            for await (const chunk of request) {
+                size += chunk.length;
+                if (size > 16384) {
+                    response.writeHead(413).end();
+                    return;
+                }
+                chunks.push(Buffer.from(chunk));
+            }
+            const body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+            if (body.state !== state || consumed) {
+                response.writeHead(403).end();
+                return;
+            }
+            const value = validateConnection(body, origin, deploymentId);
+            consumed = true;
+            await save(value);
+            response.once('finish', finish);
+            response.writeHead(200, { 'Content-Type': 'application/json' }).end('{"connected":true}');
+        }
+        catch {
+            response.writeHead(400).end('Could not save this office connection. Start setup again.');
+            if (consumed)
+                fail(new Error('Could not save the office connection. Start setup again.'));
+        }
+    });
+    server.requestTimeout = 15000;
+    server.headersTimeout = 10000;
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    port = server.address().port;
+    const timer = setTimeout(() => fail(new Error('Office connection timed out. Run setup again.')), timeoutMs);
+    const url = new URL('/npcs/connect', origin);
+    url.searchParams.set('port', String(port));
+    url.searchParams.set('state', state);
+    return {
+        url: url.href,
+        done,
+        close: () => {
+            clearTimeout(timer);
+            server.close();
+            server.closeAllConnections();
+        },
+    };
+}
+function saveBrowserConnection(value) {
+    const saved = (0, user_config_js_1.loadUserConfig)();
+    if (saved.workspace) {
+        const old = (0, node_1.loadProducerWorkspace)(saved.workspace);
+        if (old.apiUrl === value.workspace.apiUrl &&
+            old.encryption.teamId === value.workspace.encryption.teamId &&
+            (old.encryption.deploymentId !== value.workspace.encryption.deploymentId ||
+                old.encryption.trustedRoot !== value.workspace.encryption.trustedRoot))
+            throw new Error('The office encryption identity changed. Reconnect only after checking with your team owner.');
+    }
+    const directory = (0, node_path_1.join)((0, node_path_1.dirname)((0, user_config_js_1.userConfigPath)()), 'workspaces');
+    (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: 0o700 });
+    const name = (0, node_crypto_1.createHash)('sha256').update(JSON.stringify(value.workspace)).digest('hex');
+    const workspace = (0, node_path_1.join)(directory, name + '.json');
+    const temporary = workspace + '.' + (0, node_crypto_1.randomBytes)(8).toString('hex') + '.tmp';
+    (0, node_fs_1.writeFileSync)(temporary, JSON.stringify(value.workspace, null, 2) + '\n', {
+        mode: 0o600,
+        flag: 'wx',
+    });
+    (0, node_fs_1.renameSync)(temporary, workspace);
+    (0, user_config_js_1.saveUserConfig)({
+        workspace,
+        apiUrl: value.workspace.apiUrl,
+        apiKey: value.apiKey,
+        map: value.workspace.encryption.mapId,
+    });
+}
+function openConnectionBrowser(url) {
+    const command = process.platform === 'darwin'
+        ? 'open'
+        : process.platform === 'win32'
+            ? 'rundll32.exe'
+            : 'xdg-open';
+    const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+    const child = (0, node_child_process_1.spawn)(command, args, { stdio: 'ignore', detached: true });
+    child.on('error', () => { }); // The printed URL also supports systems without a browser launcher.
+    child.unref();
+}
+async function connectCloudflareOffice(apiUrl) {
+    const origin = new URL(apiUrl).origin;
+    const response = await fetch(new URL('/.well-known/nocville.json', origin), {
+        redirect: 'error',
+        signal: AbortSignal.timeout(8000),
+    });
+    if (response.status === 404)
+        return false;
+    if (!response.ok)
+        throw new Error('The office is unavailable. Try setup again shortly.');
+    const info = (await response.json());
+    if (!info.encryptedIngress)
+        return false;
+    if (typeof info.deploymentId !== 'string' || !/^[A-Za-z0-9:_-]{1,128}$/.test(info.deploymentId))
+        throw new Error('Invalid office identity.');
+    const connection = await browserConnection(origin, info.deploymentId, saveBrowserConnection);
+    console.log('Connect this computer in your browser. Sign in, choose your office, and click Connect.');
+    console.log(connection.url);
+    openConnectionBrowser(connection.url);
+    try {
+        await connection.done;
+        console.log('✓ Connected. Private NPC updates will be encrypted on this computer.');
+    }
+    finally {
+        connection.close();
+    }
+    return true;
+}
+//# sourceMappingURL=browser-connect.js.map

package/dist/cjs/npcs/agent-common/runtime.js

@@ -71,24 +71,57 @@ function ensureStableCliPath(cliPath, _force = true) {
     const pngRoot = findPackageRoot((0, node_path_1.dirname)(req.resolve('pngjs')), 'pngjs');
     if (!pngRoot)
         throw new Error('Cannot install hook runtime: pngjs is missing');
+    // Resolve the complete production dependency closure before copying. Encryption
+    // introduced nested SDK dependencies that the old two-package snapshot omitted.
+    const dependencies = new Map();
+    const collect = (root) => {
+        const manifest = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, 'package.json'), 'utf8'));
+        const previous = dependencies.get(manifest.name);
+        if (previous) {
+            if (readVersion(previous) !== manifest.version)
+                throw new Error(`Cannot install hook runtime: conflicting versions of ${manifest.name}`);
+            return;
+        }
+        dependencies.set(manifest.name, root);
+        const resolveDependency = (0, node_module_1.createRequire)((0, node_path_1.join)(root, 'package.json'));
+        for (const name of Object.keys(manifest.dependencies ?? {}).sort()) {
+            const dependency = findPackageRoot((0, node_path_1.dirname)(resolveDependency.resolve(name)), name);
+            if (!dependency)
+                throw new Error(`Cannot install hook runtime: ${name} is missing`);
+            collect(dependency);
+        }
+    };
+    collect(sdkRoot);
+    collect(pngRoot);
+    const files = (root, prefix = '') => (0, node_fs_1.readdirSync)((0, node_path_1.join)(root, prefix), { withFileTypes: true })
+        .sort((a, b) => a.name.localeCompare(b.name))
+        .flatMap((entry) => {
+        if (entry.name === 'node_modules' ||
+            entry.name.startsWith('.') ||
+            entry.name.endsWith('.map'))
+            return [];
+        const relative = (0, node_path_1.join)(prefix, entry.name);
+        return (0, node_fs_1.statSync)((0, node_path_1.join)(root, relative)).isDirectory() ? files(root, relative) : [relative];
+    });
+    const dependencyFiles = [...dependencies].map(([name, root]) => ({
+        name,
+        root,
+        files: files(root),
+    }));
     const version = readVersion(pkgRoot);
     const hash = (0, node_crypto_1.createHash)('sha256');
-    const hashTree = (root) => {
-        for (const entry of (0, node_fs_1.readdirSync)(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-            hash.update(entry.name);
-            const path = (0, node_path_1.join)(root, entry.name);
-            if (entry.isDirectory())
-                hashTree(path);
-            else if (entry.isFile())
-                hash.update((0, node_fs_1.readFileSync)(path));
+    hash.update((0, node_fs_1.readFileSync)((0, node_path_1.join)(pkgRoot, 'package.json')));
+    for (const file of files((0, node_path_1.join)(pkgRoot, 'dist'))) {
+        hash.update(file);
+        hash.update((0, node_fs_1.readFileSync)((0, node_path_1.join)(pkgRoot, 'dist', file)));
+    }
+    for (const dependency of dependencyFiles) {
+        hash.update(dependency.name);
+        for (const file of dependency.files) {
+            hash.update(file);
+            hash.update((0, node_fs_1.readFileSync)((0, node_path_1.join)(dependency.root, file)));
         }
-    };
-    for (const root of [pkgRoot, sdkRoot]) {
-        hash.update((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, 'package.json')));
-        hashTree((0, node_path_1.join)(root, 'dist'));
     }
-    hash.update((0, node_fs_1.readFileSync)((0, node_path_1.join)(pngRoot, 'package.json')));
-    hashTree((0, node_path_1.join)(pngRoot, 'lib'));
     // Immutable snapshots also support multiple development builds of one version.
     // Never remove files a running watchdog or the current pointer may still use.
     const dest = (0, node_path_1.join)((0, node_path_1.dirname)((0, user_config_js_1.userConfigPath)()), 'runtime', `${version}-${hash.digest('hex').slice(0, 16)}`);
@@ -99,14 +132,13 @@ function ensureStableCliPath(cliPath, _force = true) {
         (0, node_fs_1.mkdirSync)(stage, { recursive: true, mode: 0o700 });
         (0, node_fs_1.cpSync)((0, node_path_1.join)(pkgRoot, 'package.json'), (0, node_path_1.join)(stage, 'package.json'));
         (0, node_fs_1.cpSync)((0, node_path_1.join)(pkgRoot, 'dist'), (0, node_path_1.join)(stage, 'dist'), { recursive: true });
-        const sdkDest = (0, node_path_1.join)(stage, 'node_modules', '@nocville', 'node');
-        (0, node_fs_1.mkdirSync)(sdkDest, { recursive: true });
-        (0, node_fs_1.cpSync)((0, node_path_1.join)(sdkRoot, 'package.json'), (0, node_path_1.join)(sdkDest, 'package.json'));
-        (0, node_fs_1.cpSync)((0, node_path_1.join)(sdkRoot, 'dist'), (0, node_path_1.join)(sdkDest, 'dist'), { recursive: true });
-        const pngDest = (0, node_path_1.join)(stage, 'node_modules', 'pngjs');
-        (0, node_fs_1.mkdirSync)(pngDest, { recursive: true });
-        (0, node_fs_1.cpSync)((0, node_path_1.join)(pngRoot, 'package.json'), (0, node_path_1.join)(pngDest, 'package.json'));
-        (0, node_fs_1.cpSync)((0, node_path_1.join)(pngRoot, 'lib'), (0, node_path_1.join)(pngDest, 'lib'), { recursive: true });
+        for (const dependency of dependencyFiles) {
+            const target = (0, node_path_1.join)(stage, 'node_modules', dependency.name);
+            for (const file of dependency.files) {
+                (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)((0, node_path_1.join)(target, file)), { recursive: true });
+                (0, node_fs_1.cpSync)((0, node_path_1.join)(dependency.root, file), (0, node_path_1.join)(target, file), { dereference: true });
+            }
+        }
         try {
             (0, node_fs_1.renameSync)(stage, dest);
         }

package/dist/cli.js

@@ -12,9 +12,9 @@ const USAGE = `
 nocville-npc <command> [options]
 
 Quick start (AI coworkers):
-  nocville-npc setup                        Paste your agent key (hidden prompt),
+  nocville-npc setup                        Connect your office in the browser,
                                             then hook up installed coding agents
-                                            (whichever are installed)
+  nocville-npc setup --reconnect            Choose an office and renew this connection
   nocville-npc setup --api-key=<agent key>   Same, non-interactive
   nocville-npc uninstall                    Remove all Nocville hooks
 
@@ -151,22 +151,27 @@ async function main() {
         console.log(USAGE);
         process.exit(1);
     }
-    const config = resolveConfig(parsed.flags);
+    let config = resolveConfig(parsed.flags);
     const logger = new Logger('cli', config.debug);
     // Setup-style commands resolve the key: --api-key > env > saved > hidden prompt.
     const isAgentSetup = ['claude-code', 'codex', 'gemini', 'cursor'].includes(parsed.command) &&
         parsed.subcommand === 'setup' &&
         !parsed.flags['uninstall'];
     if (isAgentSetup || parsed.command === 'setup') {
-        if (parsed.command === 'setup') {
-            const { codexHome } = await import('./npcs/codex/defaults.js');
-            if (!existsSync(join(homedir(), '.claude')) &&
-                !existsSync(codexHome()) &&
-                !existsSync(join(homedir(), '.gemini')) &&
-                !existsSync(join(homedir(), '.cursor'))) {
-                console.error('Nothing to set up: install Claude Code, Codex, Gemini CLI or Cursor first.');
-                process.exitCode = 1;
-                return;
+        if (!config.workspace || !config.apiKey.includes('.team_') || parsed.flags['reconnect']) {
+            const { connectCloudflareOffice } = await import('./core/browser-connect.js');
+            if (await connectCloudflareOffice(config.apiUrl)) {
+                const { loadUserConfig } = await import('./core/user-config.js');
+                const saved = loadUserConfig();
+                for (const [flag, value] of Object.entries({
+                    'api-key': saved.apiKey,
+                    'api-url': saved.apiUrl,
+                    map: saved.map,
+                    workspace: saved.workspace,
+                }))
+                    if (value)
+                        parsed.flags[flag] = value;
+                config = resolveConfig(parsed.flags);
             }
         }
         const key = await resolveSetupKey(parsed.flags);
@@ -174,6 +179,16 @@ async function main() {
             return;
         if (key !== undefined)
             parsed.flags['api-key'] = key;
+        config = resolveConfig(parsed.flags);
+        if (config.workspace) {
+            const { saveUserConfig } = await import('./core/user-config.js');
+            saveUserConfig({
+                workspace: config.workspace,
+                apiUrl: config.apiUrl,
+                apiKey: config.apiKey,
+                map: config.map,
+            });
+        }
     }
     // AI-agent integrations have their own config handling (hooks read the saved config).
     if (parsed.command === 'claude-code') {
@@ -256,6 +271,10 @@ async function main() {
         return;
     }
     // All other NPC types require api-url and token
+    if (!config.workspace &&
+        (config.apiKey.includes('.team_') ||
+            config.apiUrl.replace(/\/+$/, '') === 'https://nocville.com'))
+        throw new Error('Connect this computer to your office first: run npx @nocville/npc@latest setup. Existing legacy keys cannot publish encrypted NPC updates.');
     if (!config.apiKey) {
         console.error('Error: no API key — run `nocville-npc init --api-key=<key>`, or pass --api-key / NOCVILLE_API_KEY');
         process.exit(1);
@@ -604,8 +623,7 @@ async function runSetupAll(flags) {
         console.log('· Cursor not found (~/.cursor missing) — skipped');
     }
     if (!any) {
-        console.error('Nothing to set up: install Claude Code, Codex, Gemini CLI or Cursor first.');
-        process.exitCode = 1;
+        console.log('No supported coding agents found. You can still run NPC commands on this computer.');
     }
 }
 main().catch((err) => {

package/dist/core/browser-connect.d.ts

@@ -0,0 +1,16 @@
+import { type ProducerWorkspace } from '@nocville/node';
+export interface BrowserConnection {
+    apiKey: string;
+    workspace: ProducerWorkspace;
+}
+export declare function validateConnection(input: unknown, origin: string, deploymentId: string): BrowserConnection;
+/** A one-use loopback receiver. Credentials never appear in a URL or terminal output. */
+export declare function browserConnection(origin: string, deploymentId: string, save: (value: BrowserConnection) => void | Promise<void>, timeoutMs?: number): Promise<{
+    url: string;
+    done: Promise<void>;
+    close: () => void;
+}>;
+export declare function saveBrowserConnection(value: BrowserConnection): void;
+export declare function openConnectionBrowser(url: string): void;
+export declare function connectCloudflareOffice(apiUrl: string): Promise<boolean>;
+//# sourceMappingURL=browser-connect.d.ts.map

package/dist/core/browser-connect.js

@@ -0,0 +1,189 @@
+import { createServer } from 'node:http';
+import { randomBytes, createHash } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { mkdirSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { loadProducerWorkspace } from '@nocville/node';
+import { loadUserConfig, saveUserConfig, userConfigPath } from './user-config.js';
+export function validateConnection(input, origin, deploymentId) {
+    const value = input;
+    const e = value?.workspace?.encryption;
+    if (typeof value?.apiKey !== 'string' ||
+        !/^nvk_[a-f0-9]{64}\.team_[A-Za-z0-9_-]{1,64}$/.test(value.apiKey) ||
+        value.workspace?.apiUrl !== origin ||
+        e?.deploymentId !== deploymentId ||
+        !/^team_[A-Za-z0-9_-]{1,64}$/.test(e?.teamId ?? '') ||
+        !/^map_[A-Za-z0-9_-]{1,128}$/.test(e?.mapId ?? '') ||
+        !/^[A-Za-z0-9_-]{43}$/.test(e?.trustedRoot ?? '') ||
+        !value.apiKey.endsWith('.' + e.teamId) ||
+        e.profileDirectory !== undefined)
+        throw new Error('Invalid office connection. Start setup again.');
+    return {
+        apiKey: value.apiKey,
+        workspace: {
+            apiUrl: origin,
+            encryption: {
+                deploymentId,
+                teamId: e.teamId,
+                mapId: e.mapId,
+                trustedRoot: e.trustedRoot,
+            },
+        },
+    };
+}
+/** A one-use loopback receiver. Credentials never appear in a URL or terminal output. */
+export async function browserConnection(origin, deploymentId, save, timeoutMs = 300000) {
+    const target = new URL(origin);
+    if (target.origin !== origin ||
+        target.username ||
+        target.password ||
+        (target.protocol !== 'https:' &&
+            !(target.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(target.hostname))))
+        throw new Error('Use an HTTPS office address.');
+    const state = randomBytes(32).toString('hex');
+    let finish, fail;
+    const done = new Promise((resolve, reject) => {
+        finish = resolve;
+        fail = reject;
+    });
+    // A timeout may happen while the browser launcher is still opening.
+    void done.catch(() => { });
+    let consumed = false, port = 0;
+    const server = createServer(async (request, response) => {
+        response.setHeader('Cache-Control', 'no-store');
+        if (request.headers.host !== `127.0.0.1:${port}` ||
+            request.url !== '/complete' ||
+            request.headers.origin !== origin) {
+            response.writeHead(403).end();
+            return;
+        }
+        response.setHeader('Access-Control-Allow-Origin', origin);
+        response.setHeader('Vary', 'Origin');
+        if (request.method === 'OPTIONS') {
+            response.setHeader('Access-Control-Allow-Methods', 'POST');
+            response.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+            response.setHeader('Access-Control-Allow-Private-Network', 'true');
+            response.writeHead(204).end();
+            return;
+        }
+        if (request.method !== 'POST' ||
+            request.headers['content-type']?.split(';')[0] !== 'application/json') {
+            response.writeHead(415).end();
+            return;
+        }
+        try {
+            let size = 0;
+            const chunks = [];
+            for await (const chunk of request) {
+                size += chunk.length;
+                if (size > 16384) {
+                    response.writeHead(413).end();
+                    return;
+                }
+                chunks.push(Buffer.from(chunk));
+            }
+            const body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+            if (body.state !== state || consumed) {
+                response.writeHead(403).end();
+                return;
+            }
+            const value = validateConnection(body, origin, deploymentId);
+            consumed = true;
+            await save(value);
+            response.once('finish', finish);
+            response.writeHead(200, { 'Content-Type': 'application/json' }).end('{"connected":true}');
+        }
+        catch {
+            response.writeHead(400).end('Could not save this office connection. Start setup again.');
+            if (consumed)
+                fail(new Error('Could not save the office connection. Start setup again.'));
+        }
+    });
+    server.requestTimeout = 15000;
+    server.headersTimeout = 10000;
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    port = server.address().port;
+    const timer = setTimeout(() => fail(new Error('Office connection timed out. Run setup again.')), timeoutMs);
+    const url = new URL('/npcs/connect', origin);
+    url.searchParams.set('port', String(port));
+    url.searchParams.set('state', state);
+    return {
+        url: url.href,
+        done,
+        close: () => {
+            clearTimeout(timer);
+            server.close();
+            server.closeAllConnections();
+        },
+    };
+}
+export function saveBrowserConnection(value) {
+    const saved = loadUserConfig();
+    if (saved.workspace) {
+        const old = loadProducerWorkspace(saved.workspace);
+        if (old.apiUrl === value.workspace.apiUrl &&
+            old.encryption.teamId === value.workspace.encryption.teamId &&
+            (old.encryption.deploymentId !== value.workspace.encryption.deploymentId ||
+                old.encryption.trustedRoot !== value.workspace.encryption.trustedRoot))
+            throw new Error('The office encryption identity changed. Reconnect only after checking with your team owner.');
+    }
+    const directory = join(dirname(userConfigPath()), 'workspaces');
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const name = createHash('sha256').update(JSON.stringify(value.workspace)).digest('hex');
+    const workspace = join(directory, name + '.json');
+    const temporary = workspace + '.' + randomBytes(8).toString('hex') + '.tmp';
+    writeFileSync(temporary, JSON.stringify(value.workspace, null, 2) + '\n', {
+        mode: 0o600,
+        flag: 'wx',
+    });
+    renameSync(temporary, workspace);
+    saveUserConfig({
+        workspace,
+        apiUrl: value.workspace.apiUrl,
+        apiKey: value.apiKey,
+        map: value.workspace.encryption.mapId,
+    });
+}
+export function openConnectionBrowser(url) {
+    const command = process.platform === 'darwin'
+        ? 'open'
+        : process.platform === 'win32'
+            ? 'rundll32.exe'
+            : 'xdg-open';
+    const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+    const child = spawn(command, args, { stdio: 'ignore', detached: true });
+    child.on('error', () => { }); // The printed URL also supports systems without a browser launcher.
+    child.unref();
+}
+export async function connectCloudflareOffice(apiUrl) {
+    const origin = new URL(apiUrl).origin;
+    const response = await fetch(new URL('/.well-known/nocville.json', origin), {
+        redirect: 'error',
+        signal: AbortSignal.timeout(8000),
+    });
+    if (response.status === 404)
+        return false;
+    if (!response.ok)
+        throw new Error('The office is unavailable. Try setup again shortly.');
+    const info = (await response.json());
+    if (!info.encryptedIngress)
+        return false;
+    if (typeof info.deploymentId !== 'string' || !/^[A-Za-z0-9:_-]{1,128}$/.test(info.deploymentId))
+        throw new Error('Invalid office identity.');
+    const connection = await browserConnection(origin, info.deploymentId, saveBrowserConnection);
+    console.log('Connect this computer in your browser. Sign in, choose your office, and click Connect.');
+    console.log(connection.url);
+    openConnectionBrowser(connection.url);
+    try {
+        await connection.done;
+        console.log('✓ Connected. Private NPC updates will be encrypted on this computer.');
+    }
+    finally {
+        connection.close();
+    }
+    return true;
+}
+//# sourceMappingURL=browser-connect.js.map

package/dist/npcs/agent-common/runtime.js

@@ -66,24 +66,57 @@ export function ensureStableCliPath(cliPath, _force = true) {
     const pngRoot = findPackageRoot(dirname(req.resolve('pngjs')), 'pngjs');
     if (!pngRoot)
         throw new Error('Cannot install hook runtime: pngjs is missing');
+    // Resolve the complete production dependency closure before copying. Encryption
+    // introduced nested SDK dependencies that the old two-package snapshot omitted.
+    const dependencies = new Map();
+    const collect = (root) => {
+        const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+        const previous = dependencies.get(manifest.name);
+        if (previous) {
+            if (readVersion(previous) !== manifest.version)
+                throw new Error(`Cannot install hook runtime: conflicting versions of ${manifest.name}`);
+            return;
+        }
+        dependencies.set(manifest.name, root);
+        const resolveDependency = createRequire(join(root, 'package.json'));
+        for (const name of Object.keys(manifest.dependencies ?? {}).sort()) {
+            const dependency = findPackageRoot(dirname(resolveDependency.resolve(name)), name);
+            if (!dependency)
+                throw new Error(`Cannot install hook runtime: ${name} is missing`);
+            collect(dependency);
+        }
+    };
+    collect(sdkRoot);
+    collect(pngRoot);
+    const files = (root, prefix = '') => readdirSync(join(root, prefix), { withFileTypes: true })
+        .sort((a, b) => a.name.localeCompare(b.name))
+        .flatMap((entry) => {
+        if (entry.name === 'node_modules' ||
+            entry.name.startsWith('.') ||
+            entry.name.endsWith('.map'))
+            return [];
+        const relative = join(prefix, entry.name);
+        return statSync(join(root, relative)).isDirectory() ? files(root, relative) : [relative];
+    });
+    const dependencyFiles = [...dependencies].map(([name, root]) => ({
+        name,
+        root,
+        files: files(root),
+    }));
     const version = readVersion(pkgRoot);
     const hash = createHash('sha256');
-    const hashTree = (root) => {
-        for (const entry of readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-            hash.update(entry.name);
-            const path = join(root, entry.name);
-            if (entry.isDirectory())
-                hashTree(path);
-            else if (entry.isFile())
-                hash.update(readFileSync(path));
+    hash.update(readFileSync(join(pkgRoot, 'package.json')));
+    for (const file of files(join(pkgRoot, 'dist'))) {
+        hash.update(file);
+        hash.update(readFileSync(join(pkgRoot, 'dist', file)));
+    }
+    for (const dependency of dependencyFiles) {
+        hash.update(dependency.name);
+        for (const file of dependency.files) {
+            hash.update(file);
+            hash.update(readFileSync(join(dependency.root, file)));
         }
-    };
-    for (const root of [pkgRoot, sdkRoot]) {
-        hash.update(readFileSync(join(root, 'package.json')));
-        hashTree(join(root, 'dist'));
     }
-    hash.update(readFileSync(join(pngRoot, 'package.json')));
-    hashTree(join(pngRoot, 'lib'));
     // Immutable snapshots also support multiple development builds of one version.
     // Never remove files a running watchdog or the current pointer may still use.
     const dest = join(dirname(userConfigPath()), 'runtime', `${version}-${hash.digest('hex').slice(0, 16)}`);
@@ -94,14 +127,13 @@ export function ensureStableCliPath(cliPath, _force = true) {
         mkdirSync(stage, { recursive: true, mode: 0o700 });
         cpSync(join(pkgRoot, 'package.json'), join(stage, 'package.json'));
         cpSync(join(pkgRoot, 'dist'), join(stage, 'dist'), { recursive: true });
-        const sdkDest = join(stage, 'node_modules', '@nocville', 'node');
-        mkdirSync(sdkDest, { recursive: true });
-        cpSync(join(sdkRoot, 'package.json'), join(sdkDest, 'package.json'));
-        cpSync(join(sdkRoot, 'dist'), join(sdkDest, 'dist'), { recursive: true });
-        const pngDest = join(stage, 'node_modules', 'pngjs');
-        mkdirSync(pngDest, { recursive: true });
-        cpSync(join(pngRoot, 'package.json'), join(pngDest, 'package.json'));
-        cpSync(join(pngRoot, 'lib'), join(pngDest, 'lib'), { recursive: true });
+        for (const dependency of dependencyFiles) {
+            const target = join(stage, 'node_modules', dependency.name);
+            for (const file of dependency.files) {
+                mkdirSync(dirname(join(target, file)), { recursive: true });
+                cpSync(join(dependency.root, file), join(target, file), { dereference: true });
+            }
+        }
         try {
             renameSync(stage, dest);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocville/npc",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Put your Claude Code and Codex sessions (and your servers) in the Nocville office as live NPCs",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,7 +24,7 @@
   ],
   "dependencies": {
     "pngjs": "^7.0.0",
-    "@nocville/node": "^0.4.0"
+    "@nocville/node": "^0.4.1"
   },
   "peerDependencies": {
     "puppeteer-core": "*"