@nocville/npc 0.4.0 → 0.5.0

package/README.md

@@ -7,18 +7,22 @@ a hand when it needs you, dozes when idle, and shows what it's doing on its spee
 desk sign: `Editing src/GameScene.ts`, `Running pnpm test`, `Searching for 'reconnect'`,
 `Needs your approval`, `Thinking…`. It leaves the office when the session ends.
 
-Requires Node.js 20+. Get an agent key in your Nocville office under **Connect AI coworkers**.
+Requires Node.js 20.12 or newer and a Nocville account.
 
 ## Quick start: AI coworkers
 
 ```bash
-npx @nocville/npc setup
+npx @nocville/npc@latest setup
 ```
 
-Paste your key at the prompt (input is hidden, so the key never lands in your shell history).
-For scripts, pass `--api-key=<your key>` or set `NOCVILLE_API_KEY` instead. That's it. The
-command saves your key to `~/.config/nocville/config.json` (readable only by you), then hooks
-up whichever agents you have installed:
+Setup opens Nocville in your browser. Sign in, choose your team and office, and click
+**Connect this computer**. If the browser asks for local network access, allow it so
+it can return the connection to the setup command on this computer. Keep an existing
+team member's office open during the first connection so encrypted publishing can
+be enabled automatically.
+
+Setup saves the publishing key and verified workspace settings in private files under
+`~/.config/nocville/`, then hooks up whichever agents you have installed:
 
 - **Claude Code**: adds hooks to `~/.claude/settings.json`. New sessions show up right away;
   restart sessions that are already running.
@@ -31,10 +35,10 @@ up whichever agents you have installed:
 Your existing hooks are left alone, and Nocville's hooks never answer permission prompts or
 change what your agent does; they only report activity.
 
-Running your own Nocville server? Add `--api-url=https://your-server`. To send sessions to a
-map other than your team's default, add `--map="Trading Floor"`.
+Using your team’s own Cloudflare hosting? Add `--api-url=https://your-office-host`.
+Use `setup --reconnect` to choose a different office or renew the connection.
 
-Prefer a global install? Run `npm i -g @nocville/npc`, then `nocville-npc setup --api-key=…`.
+Prefer a global install? Run `npm i -g @nocville/npc`, then `nocville-npc setup`.
 When setup runs through `npx`, it copies itself to `~/.config/nocville/runtime/` so the hooks
 keep working after npm clears its cache.
 
@@ -75,8 +79,11 @@ checks the current folder (`--project=<dir>`, `--name=<session name>` to test ot
 Gemini CLI and Cursor on their own. For Cursor, start a new chat after setup.
 
 `nocville-npc uninstall` removes every Nocville hook. `nocville-npc init` only saves
-credentials. Every setup command takes the key from `--api-key`, then `NOCVILLE_API_KEY`, then
-the saved config, and otherwise prompts for it (in a terminal) or exits with an error. `nocville-npc doctor` checks connectivity and sends a test push.
+credentials. Cloudflare setup connects through your browser unless a complete encrypted
+workspace is already configured. For automated installations, supply a trusted
+`--workspace=/absolute/path/workspace.json` and `NOCVILLE_API_KEY`. Legacy self-hosted
+servers still accept the hidden key prompt. `nocville-npc doctor` checks connectivity
+and sends a test push.
 
 ### What you'll see
 
@@ -229,19 +236,14 @@ key and connection work. More at [nocville.com](https://nocville.com).
 
 ## Encrypted Cloudflare workspaces
 
-Download and verify the producer workspace settings in team privacy settings, then:
-
-```sh
-nocville-npc init --workspace=/absolute/path/workspace.json
-# Supply the agent key through NOCVILLE_API_KEY or the existing init prompt.
-nocville-npc system-monitor
-```
-
-`--workspace`, `NOCVILLE_WORKSPACE`, and the saved workspace path are supported in
-that order. Constructor `workspace` overrides them. The first publication displays
-a signing-device fingerprint for the team owner to approve. Approval is shared by
-the local NPCs using this credential, including coding-agent hooks and watchdogs.
-The workspace pins the HTTPS origin and opaque map ID; changing either requires
-matching verified workspace settings. The `doctor` command uses encrypted enrollment
-and an offline probe for these workspaces. The Node SDK README describes private
-profile storage and the encryption boundary.
+Run `npx @nocville/npc@latest setup` to configure encrypted publishing automatically.
+Old keys from the former server deployment cannot publish to encrypted workspaces;
+setup replaces that connection without removing other agents' hooks.
+
+For managed automation, `--workspace`, `NOCVILLE_WORKSPACE`, and the saved workspace
+path are supported in that order. Constructor `workspace` overrides them. The
+workspace pins the HTTPS origin, deployment, team root and map ID. Reconnecting to
+the same team cannot silently replace its pinned encryption identity. Local NPCs,
+agent hooks and watchdogs share an enrolled producer profile for the credential.
+The `doctor` command uses encrypted enrollment and an offline probe. The Node SDK
+README describes private profile storage and the encryption boundary.

package/dist/cjs/cli.js

@@ -47,9 +47,9 @@ const USAGE = `
 nocville-npc <command> [options]
 
 Quick start (AI coworkers):
-  nocville-npc setup                        Paste your agent key (hidden prompt),
+  nocville-npc setup                        Connect your office in the browser,
                                             then hook up installed coding agents
-                                            (whichever are installed)
+  nocville-npc setup --reconnect            Choose an office and renew this connection
   nocville-npc setup --api-key=<agent key>   Same, non-interactive
   nocville-npc uninstall                    Remove all Nocville hooks
 
@@ -186,22 +186,27 @@ async function main() {
         console.log(USAGE);
         process.exit(1);
     }
-    const config = (0, config_js_1.resolveConfig)(parsed.flags);
+    let config = (0, config_js_1.resolveConfig)(parsed.flags);
     const logger = new logger_js_1.Logger('cli', config.debug);
     // Setup-style commands resolve the key: --api-key > env > saved > hidden prompt.
     const isAgentSetup = ['claude-code', 'codex', 'gemini', 'cursor'].includes(parsed.command) &&
         parsed.subcommand === 'setup' &&
         !parsed.flags['uninstall'];
     if (isAgentSetup || parsed.command === 'setup') {
-        if (parsed.command === 'setup') {
-            const { codexHome } = await Promise.resolve().then(() => __importStar(require('./npcs/codex/defaults.js')));
-            if (!(0, node_fs_1.existsSync)((0, node_path_1.join)((0, node_os_1.homedir)(), '.claude')) &&
-                !(0, node_fs_1.existsSync)(codexHome()) &&
-                !(0, node_fs_1.existsSync)((0, node_path_1.join)((0, node_os_1.homedir)(), '.gemini')) &&
-                !(0, node_fs_1.existsSync)((0, node_path_1.join)((0, node_os_1.homedir)(), '.cursor'))) {
-                console.error('Nothing to set up: install Claude Code, Codex, Gemini CLI or Cursor first.');
-                process.exitCode = 1;
-                return;
+        if (!config.workspace || !config.apiKey.includes('.team_') || parsed.flags['reconnect']) {
+            const { connectCloudflareOffice } = await Promise.resolve().then(() => __importStar(require('./core/browser-connect.js')));
+            if (await connectCloudflareOffice(config.apiUrl)) {
+                const { loadUserConfig } = await Promise.resolve().then(() => __importStar(require('./core/user-config.js')));
+                const saved = loadUserConfig();
+                for (const [flag, value] of Object.entries({
+                    'api-key': saved.apiKey,
+                    'api-url': saved.apiUrl,
+                    map: saved.map,
+                    workspace: saved.workspace,
+                }))
+                    if (value)
+                        parsed.flags[flag] = value;
+                config = (0, config_js_1.resolveConfig)(parsed.flags);
             }
         }
         const key = await resolveSetupKey(parsed.flags);
@@ -209,6 +214,16 @@ async function main() {
             return;
         if (key !== undefined)
             parsed.flags['api-key'] = key;
+        config = (0, config_js_1.resolveConfig)(parsed.flags);
+        if (config.workspace) {
+            const { saveUserConfig } = await Promise.resolve().then(() => __importStar(require('./core/user-config.js')));
+            saveUserConfig({
+                workspace: config.workspace,
+                apiUrl: config.apiUrl,
+                apiKey: config.apiKey,
+                map: config.map,
+            });
+        }
     }
     // AI-agent integrations have their own config handling (hooks read the saved config).
     if (parsed.command === 'claude-code') {
@@ -291,6 +306,10 @@ async function main() {
         return;
     }
     // All other NPC types require api-url and token
+    if (!config.workspace &&
+        (config.apiKey.includes('.team_') ||
+            config.apiUrl.replace(/\/+$/, '') === 'https://nocville.com'))
+        throw new Error('Connect this computer to your office first: run npx @nocville/npc@latest setup. Existing legacy keys cannot publish encrypted NPC updates.');
     if (!config.apiKey) {
         console.error('Error: no API key — run `nocville-npc init --api-key=<key>`, or pass --api-key / NOCVILLE_API_KEY');
         process.exit(1);
@@ -639,8 +658,7 @@ async function runSetupAll(flags) {
         console.log('· Cursor not found (~/.cursor missing) — skipped');
     }
     if (!any) {
-        console.error('Nothing to set up: install Claude Code, Codex, Gemini CLI or Cursor first.');
-        process.exitCode = 1;
+        console.log('No supported coding agents found. You can still run NPC commands on this computer.');
     }
 }
 main().catch((err) => {

package/dist/cjs/core/base-npc.js

@@ -139,6 +139,15 @@ class BaseNPC {
         catch {
             /* observer only */
         }
+        if (!result.success && [401, 410].includes(result.statusCode ?? 0)) {
+            // A revoked key or an SDK version the server retired: retrying forever only
+            // costs requests. Stop; restarting after fixing it resumes monitoring.
+            this.logger.error(result.statusCode === 410
+                ? 'This @nocville/npc version is no longer supported — upgrade it. Stopping.'
+                : 'API key rejected (HTTP 401) — check NOCVILLE_API_KEY / team settings. Stopping.');
+            void this.stop();
+            return;
+        }
         if (!result.success) {
             this.reportPushFailure(result.error);
         }

package/dist/cjs/core/browser-connect.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateConnection = validateConnection;
+exports.browserConnection = browserConnection;
+exports.saveBrowserConnection = saveBrowserConnection;
+exports.openConnectionBrowser = openConnectionBrowser;
+exports.connectCloudflareOffice = connectCloudflareOffice;
+const node_http_1 = require("node:http");
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_1 = require("@nocville/node");
+const user_config_js_1 = require("./user-config.js");
+function validateConnection(input, origin, deploymentId) {
+    const value = input;
+    const e = value?.workspace?.encryption;
+    if (typeof value?.apiKey !== 'string' ||
+        !/^nvk_[a-f0-9]{64}\.team_[A-Za-z0-9_-]{1,64}$/.test(value.apiKey) ||
+        value.workspace?.apiUrl !== origin ||
+        e?.deploymentId !== deploymentId ||
+        !/^team_[A-Za-z0-9_-]{1,64}$/.test(e?.teamId ?? '') ||
+        !/^map_[A-Za-z0-9_-]{1,128}$/.test(e?.mapId ?? '') ||
+        !/^[A-Za-z0-9_-]{43}$/.test(e?.trustedRoot ?? '') ||
+        !value.apiKey.endsWith('.' + e.teamId) ||
+        e.profileDirectory !== undefined)
+        throw new Error('Invalid office connection. Start setup again.');
+    return {
+        apiKey: value.apiKey,
+        workspace: {
+            apiUrl: origin,
+            encryption: {
+                deploymentId,
+                teamId: e.teamId,
+                mapId: e.mapId,
+                trustedRoot: e.trustedRoot,
+            },
+        },
+    };
+}
+/** A one-use loopback receiver. Credentials never appear in a URL or terminal output. */
+async function browserConnection(origin, deploymentId, save, timeoutMs = 300000) {
+    const target = new URL(origin);
+    if (target.origin !== origin ||
+        target.username ||
+        target.password ||
+        (target.protocol !== 'https:' &&
+            !(target.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(target.hostname))))
+        throw new Error('Use an HTTPS office address.');
+    const state = (0, node_crypto_1.randomBytes)(32).toString('hex');
+    let finish, fail;
+    const done = new Promise((resolve, reject) => {
+        finish = resolve;
+        fail = reject;
+    });
+    // A timeout may happen while the browser launcher is still opening.
+    void done.catch(() => { });
+    let consumed = false, port = 0;
+    const server = (0, node_http_1.createServer)(async (request, response) => {
+        response.setHeader('Cache-Control', 'no-store');
+        if (request.headers.host !== `127.0.0.1:${port}` ||
+            request.url !== '/complete' ||
+            request.headers.origin !== origin) {
+            response.writeHead(403).end();
+            return;
+        }
+        response.setHeader('Access-Control-Allow-Origin', origin);
+        response.setHeader('Vary', 'Origin');
+        if (request.method === 'OPTIONS') {
+            response.setHeader('Access-Control-Allow-Methods', 'POST');
+            response.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+            response.setHeader('Access-Control-Allow-Private-Network', 'true');
+            response.writeHead(204).end();
+            return;
+        }
+        if (request.method !== 'POST' ||
+            request.headers['content-type']?.split(';')[0] !== 'application/json') {
+            response.writeHead(415).end();
+            return;
+        }
+        try {
+            let size = 0;
+            const chunks = [];
+            for await (const chunk of request) {
+                size += chunk.length;
+                if (size > 16384) {
+                    response.writeHead(413).end();
+                    return;
+                }
+                chunks.push(Buffer.from(chunk));
+            }
+            const body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+            if (body.state !== state || consumed) {
+                response.writeHead(403).end();
+                return;
+            }
+            const value = validateConnection(body, origin, deploymentId);
+            consumed = true;
+            await save(value);
+            response.once('finish', finish);
+            response.writeHead(200, { 'Content-Type': 'application/json' }).end('{"connected":true}');
+        }
+        catch {
+            response.writeHead(400).end('Could not save this office connection. Start setup again.');
+            if (consumed)
+                fail(new Error('Could not save the office connection. Start setup again.'));
+        }
+    });
+    server.requestTimeout = 15000;
+    server.headersTimeout = 10000;
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    port = server.address().port;
+    const timer = setTimeout(() => fail(new Error('Office connection timed out. Run setup again.')), timeoutMs);
+    const url = new URL('/npcs/connect', origin);
+    url.searchParams.set('port', String(port));
+    url.searchParams.set('state', state);
+    return {
+        url: url.href,
+        done,
+        close: () => {
+            clearTimeout(timer);
+            server.close();
+            server.closeAllConnections();
+        },
+    };
+}
+function saveBrowserConnection(value) {
+    const saved = (0, user_config_js_1.loadUserConfig)();
+    if (saved.workspace) {
+        const old = (0, node_1.loadProducerWorkspace)(saved.workspace);
+        if (old.apiUrl === value.workspace.apiUrl &&
+            old.encryption.teamId === value.workspace.encryption.teamId &&
+            (old.encryption.deploymentId !== value.workspace.encryption.deploymentId ||
+                old.encryption.trustedRoot !== value.workspace.encryption.trustedRoot))
+            throw new Error('The office encryption identity changed. Reconnect only after checking with your team owner.');
+    }
+    const directory = (0, node_path_1.join)((0, node_path_1.dirname)((0, user_config_js_1.userConfigPath)()), 'workspaces');
+    (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: 0o700 });
+    const name = (0, node_crypto_1.createHash)('sha256').update(JSON.stringify(value.workspace)).digest('hex');
+    const workspace = (0, node_path_1.join)(directory, name + '.json');
+    const temporary = workspace + '.' + (0, node_crypto_1.randomBytes)(8).toString('hex') + '.tmp';
+    (0, node_fs_1.writeFileSync)(temporary, JSON.stringify(value.workspace, null, 2) + '\n', {
+        mode: 0o600,
+        flag: 'wx',
+    });
+    (0, node_fs_1.renameSync)(temporary, workspace);
+    (0, user_config_js_1.saveUserConfig)({
+        workspace,
+        apiUrl: value.workspace.apiUrl,
+        apiKey: value.apiKey,
+        map: value.workspace.encryption.mapId,
+    });
+}
+function openConnectionBrowser(url) {
+    const command = process.platform === 'darwin'
+        ? 'open'
+        : process.platform === 'win32'
+            ? 'rundll32.exe'
+            : 'xdg-open';
+    const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+    const child = (0, node_child_process_1.spawn)(command, args, { stdio: 'ignore', detached: true });
+    child.on('error', () => { }); // The printed URL also supports systems without a browser launcher.
+    child.unref();
+}
+async function connectCloudflareOffice(apiUrl) {
+    const origin = new URL(apiUrl).origin;
+    const response = await fetch(new URL('/.well-known/nocville.json', origin), {
+        redirect: 'error',
+        signal: AbortSignal.timeout(8000),
+    });
+    if (response.status === 404)
+        return false;
+    if (!response.ok)
+        throw new Error('The office is unavailable. Try setup again shortly.');
+    const info = (await response.json());
+    if (!info.encryptedIngress)
+        return false;
+    if (typeof info.deploymentId !== 'string' || !/^[A-Za-z0-9:_-]{1,128}$/.test(info.deploymentId))
+        throw new Error('Invalid office identity.');
+    const connection = await browserConnection(origin, info.deploymentId, saveBrowserConnection);
+    console.log('Connect this computer in your browser. Sign in, choose your office, and click Connect.');
+    console.log(connection.url);
+    openConnectionBrowser(connection.url);
+    try {
+        await connection.done;
+        console.log('✓ Connected. Private NPC updates will be encrypted on this computer.');
+    }
+    finally {
+        connection.close();
+    }
+    return true;
+}
+//# sourceMappingURL=browser-connect.js.map

package/dist/cjs/core/pixel-art.js

@@ -4,6 +4,7 @@ exports.encodePixelArt = encodePixelArt;
 exports.pixelArtFromPng = pixelArtFromPng;
 exports.pixelDevice = pixelDevice;
 const node_fs_1 = require("node:fs");
+const node_zlib_1 = require("node:zlib");
 const pngjs_1 = require("pngjs");
 /**
  * Helpers for custom pixel-art companions (`screenType: 'pixel-device'`): your NPC's own
@@ -68,7 +69,9 @@ function encodePixelArt(art) {
         const fps = Math.min(12, Math.max(1, Math.round(art.fps ?? 4)));
         tokens.push(`f${frames.length}`, `fps${fps}`);
     }
-    const encoded = pixels.toString('base64');
+    // Deflated indices (`z`) are typically 15–25× smaller for pixel art.
+    tokens.push('z');
+    const encoded = (0, node_zlib_1.deflateRawSync)(pixels, { level: 9 }).toString('base64');
     if (encoded.length > MAX_VALUE)
         throw new Error('Pixel art is too large to send; use fewer frames or a smaller size.');
     return {

package/dist/cjs/core/polling-npc.js

@@ -3,8 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PollingNPC = exports.MIN_POLL_INTERVAL_MS = void 0;
 const base_npc_js_1 = require("./base-npc.js");
 /**
- * Lower bound for any poll interval, so a typo can't exhaust the API's
- * per-service rate limit (60 pushes/min) or hammer the watched source.
+ * Lower bound for any poll interval, so a typo can't hammer the watched source.
+ * The SDK sends changed status at most every 10 s and heartbeats every 30 s;
+ * the server limits producers per key, team and NPC and answers 429.
  */
 exports.MIN_POLL_INTERVAL_MS = 5000;
 /** How long `stop()` waits for an in-flight collection before pushing offline anyway. */

package/dist/cjs/npcs/agent-common/runtime.js

@@ -71,24 +71,57 @@ function ensureStableCliPath(cliPath, _force = true) {
     const pngRoot = findPackageRoot((0, node_path_1.dirname)(req.resolve('pngjs')), 'pngjs');
     if (!pngRoot)
         throw new Error('Cannot install hook runtime: pngjs is missing');
+    // Resolve the complete production dependency closure before copying. Encryption
+    // introduced nested SDK dependencies that the old two-package snapshot omitted.
+    const dependencies = new Map();
+    const collect = (root) => {
+        const manifest = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, 'package.json'), 'utf8'));
+        const previous = dependencies.get(manifest.name);
+        if (previous) {
+            if (readVersion(previous) !== manifest.version)
+                throw new Error(`Cannot install hook runtime: conflicting versions of ${manifest.name}`);
+            return;
+        }
+        dependencies.set(manifest.name, root);
+        const resolveDependency = (0, node_module_1.createRequire)((0, node_path_1.join)(root, 'package.json'));
+        for (const name of Object.keys(manifest.dependencies ?? {}).sort()) {
+            const dependency = findPackageRoot((0, node_path_1.dirname)(resolveDependency.resolve(name)), name);
+            if (!dependency)
+                throw new Error(`Cannot install hook runtime: ${name} is missing`);
+            collect(dependency);
+        }
+    };
+    collect(sdkRoot);
+    collect(pngRoot);
+    const files = (root, prefix = '') => (0, node_fs_1.readdirSync)((0, node_path_1.join)(root, prefix), { withFileTypes: true })
+        .sort((a, b) => a.name.localeCompare(b.name))
+        .flatMap((entry) => {
+        if (entry.name === 'node_modules' ||
+            entry.name.startsWith('.') ||
+            entry.name.endsWith('.map'))
+            return [];
+        const relative = (0, node_path_1.join)(prefix, entry.name);
+        return (0, node_fs_1.statSync)((0, node_path_1.join)(root, relative)).isDirectory() ? files(root, relative) : [relative];
+    });
+    const dependencyFiles = [...dependencies].map(([name, root]) => ({
+        name,
+        root,
+        files: files(root),
+    }));
     const version = readVersion(pkgRoot);
     const hash = (0, node_crypto_1.createHash)('sha256');
-    const hashTree = (root) => {
-        for (const entry of (0, node_fs_1.readdirSync)(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-            hash.update(entry.name);
-            const path = (0, node_path_1.join)(root, entry.name);
-            if (entry.isDirectory())
-                hashTree(path);
-            else if (entry.isFile())
-                hash.update((0, node_fs_1.readFileSync)(path));
+    hash.update((0, node_fs_1.readFileSync)((0, node_path_1.join)(pkgRoot, 'package.json')));
+    for (const file of files((0, node_path_1.join)(pkgRoot, 'dist'))) {
+        hash.update(file);
+        hash.update((0, node_fs_1.readFileSync)((0, node_path_1.join)(pkgRoot, 'dist', file)));
+    }
+    for (const dependency of dependencyFiles) {
+        hash.update(dependency.name);
+        for (const file of dependency.files) {
+            hash.update(file);
+            hash.update((0, node_fs_1.readFileSync)((0, node_path_1.join)(dependency.root, file)));
         }
-    };
-    for (const root of [pkgRoot, sdkRoot]) {
-        hash.update((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, 'package.json')));
-        hashTree((0, node_path_1.join)(root, 'dist'));
     }
-    hash.update((0, node_fs_1.readFileSync)((0, node_path_1.join)(pngRoot, 'package.json')));
-    hashTree((0, node_path_1.join)(pngRoot, 'lib'));
     // Immutable snapshots also support multiple development builds of one version.
     // Never remove files a running watchdog or the current pointer may still use.
     const dest = (0, node_path_1.join)((0, node_path_1.dirname)((0, user_config_js_1.userConfigPath)()), 'runtime', `${version}-${hash.digest('hex').slice(0, 16)}`);
@@ -99,14 +132,13 @@ function ensureStableCliPath(cliPath, _force = true) {
         (0, node_fs_1.mkdirSync)(stage, { recursive: true, mode: 0o700 });
         (0, node_fs_1.cpSync)((0, node_path_1.join)(pkgRoot, 'package.json'), (0, node_path_1.join)(stage, 'package.json'));
         (0, node_fs_1.cpSync)((0, node_path_1.join)(pkgRoot, 'dist'), (0, node_path_1.join)(stage, 'dist'), { recursive: true });
-        const sdkDest = (0, node_path_1.join)(stage, 'node_modules', '@nocville', 'node');
-        (0, node_fs_1.mkdirSync)(sdkDest, { recursive: true });
-        (0, node_fs_1.cpSync)((0, node_path_1.join)(sdkRoot, 'package.json'), (0, node_path_1.join)(sdkDest, 'package.json'));
-        (0, node_fs_1.cpSync)((0, node_path_1.join)(sdkRoot, 'dist'), (0, node_path_1.join)(sdkDest, 'dist'), { recursive: true });
-        const pngDest = (0, node_path_1.join)(stage, 'node_modules', 'pngjs');
-        (0, node_fs_1.mkdirSync)(pngDest, { recursive: true });
-        (0, node_fs_1.cpSync)((0, node_path_1.join)(pngRoot, 'package.json'), (0, node_path_1.join)(pngDest, 'package.json'));
-        (0, node_fs_1.cpSync)((0, node_path_1.join)(pngRoot, 'lib'), (0, node_path_1.join)(pngDest, 'lib'), { recursive: true });
+        for (const dependency of dependencyFiles) {
+            const target = (0, node_path_1.join)(stage, 'node_modules', dependency.name);
+            for (const file of dependency.files) {
+                (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)((0, node_path_1.join)(target, file)), { recursive: true });
+                (0, node_fs_1.cpSync)((0, node_path_1.join)(dependency.root, file), (0, node_path_1.join)(target, file), { dereference: true });
+            }
+        }
         try {
             (0, node_fs_1.renameSync)(stage, dest);
         }

package/dist/cjs/npcs/agent-common/session.js

@@ -261,17 +261,43 @@ function buildAgentPayload(adapter, state, config) {
         map: config.map,
     };
 }
+/**
+ * Clients reused within one process (a long-lived watchdog): a fresh client
+ * re-runs enrollment, manifest, version and session requests on every push.
+ * Any failure (e.g. a hook process took over the producer session) drops it.
+ */
+const clients = new Map();
 async function defaultPush(config, serviceId, payload, timeoutMs) {
-    const client = new node_1.NocvilleClient({
-        workspace: config.workspace,
-        apiUrl: config.apiUrl,
-        apiKey: config.apiKey,
+    const key = JSON.stringify([
+        config.workspace,
+        config.apiUrl,
+        config.apiKey,
         serviceId,
-        timeout: timeoutMs,
-        retries: 0,
-        debug: config.debug,
-    });
-    return client.pushStatus(payload);
+        timeoutMs,
+    ]);
+    let client = clients.get(key);
+    if (!client) {
+        client = new node_1.NocvilleClient({
+            workspace: config.workspace,
+            apiUrl: config.apiUrl,
+            apiKey: config.apiKey,
+            serviceId,
+            timeout: timeoutMs,
+            retries: 0,
+            debug: config.debug,
+        });
+        clients.set(key, client);
+    }
+    try {
+        const result = await client.pushStatus(payload);
+        if (!result.success)
+            clients.delete(key);
+        return result;
+    }
+    catch (error) {
+        clients.delete(key);
+        throw error;
+    }
 }
 /**
  * Push the session's current state if it has unpushed changes (or is offline),

package/dist/cjs/npcs/agent-common/watchdog.js

@@ -7,7 +7,8 @@ const liveness_js_1 = require("./liveness.js");
 const lock_js_1 = require("./lock.js");
 const session_js_1 = require("./session.js");
 exports.WATCHDOG_TICK_MS = 15_000;
-exports.WATCHDOG_HEARTBEAT_MS = 60_000;
+/** Liveness only (status changes push at once); each heartbeat is a billed request. */
+exports.WATCHDOG_HEARTBEAT_MS = 300_000;
 exports.WATCHDOG_OFFLINE_RETRY_MS = 15 * 60_000;
 async function ensureWatchdog(adapter, config, sessionId, cliPath, lockWaitMs) {
     if (adapter.processNames?.length === 0 ||
@@ -42,7 +43,7 @@ async function runWatchdog(adapter, config, sessionId, deps = {}) {
     const delivery = {
         ...deps,
         onResult: (result) => {
-            if (!result.success && [400, 401, 403, 404].includes(result.statusCode ?? 0))
+            if (!result.success && [400, 401, 403, 404, 410].includes(result.statusCode ?? 0))
                 rejected = true;
             deps.onResult?.(result);
         },
@@ -123,7 +124,7 @@ async function runWatchdog(adapter, config, sessionId, deps = {}) {
                     ...deps,
                     force: true,
                     onResult: (result) => {
-                        if (!result.success && [400, 401, 403, 404].includes(result.statusCode ?? 0))
+                        if (!result.success && [400, 401, 403, 404, 410].includes(result.statusCode ?? 0))
                             heartbeatRejected = true;
                         deps.onResult?.(result);
                     },

package/dist/cjs/npcs/claude-code/defaults.js

@@ -8,8 +8,8 @@ exports.DEFAULTS = {
     stateFilePrefix: 'session-',
     stateFileMaxAge: 24 * 60 * 60 * 1000, // 24 hours
     httpTimeout: 4000,
-    /** Watchdog-backed sessions become unknown after three minutes without a heartbeat. */
-    heartbeatSeconds: 90,
+    /** Watchdog-backed sessions become unknown after twelve minutes without a heartbeat. */
+    heartbeatSeconds: 360,
     /** Number of recent activity lines kept in the desk-sign ticker. */
     activityBufferSize: 8,
     /** Coalesce same-phase activity pushes closer together than this. */

package/dist/cjs/npcs/codex/defaults.js

@@ -8,8 +8,8 @@ exports.CODEX_DEFAULTS = {
     /** Hook-mode per-session state (shared with the watcher to avoid double pushes). */
     stateDir: (0, node_path_1.join)((0, node_os_1.tmpdir)(), 'nocville-codex'),
     stateFileMaxAge: 24 * 60 * 60 * 1000,
-    /** Watchdog-backed sessions become unknown after three minutes without a heartbeat. */
-    heartbeatSeconds: 90,
+    /** Watchdog-backed sessions become unknown after twelve minutes without a heartbeat. */
+    heartbeatSeconds: 360,
     minPushGapMs: 1500,
     hookTimeoutSeconds: 10,
     /** Watcher: Codex session rollout logs. */

package/dist/cjs/npcs/cursor/defaults.js

@@ -6,7 +6,7 @@ const node_path_1 = require("node:path");
 exports.CURSOR_DEFAULTS = {
     stateDir: (0, node_path_1.join)((0, node_os_1.tmpdir)(), 'nocville-cursor'),
     stateFileMaxAge: 24 * 60 * 60 * 1000,
-    heartbeatSeconds: 90,
+    heartbeatSeconds: 360,
     minPushGapMs: 1500,
     hookTimeoutSeconds: 10,
 };

package/dist/cjs/npcs/cursor/hook-handler.js

@@ -15,7 +15,7 @@ exports.CURSOR_ADAPTER = {
     label: 'Cursor',
     family: 'cursor',
     stateDir: defaults_js_1.CURSOR_DEFAULTS.stateDir,
-    heartbeatSeconds: 90,
+    heartbeatSeconds: 360,
     processNames: [],
 };
 function cursorServiceId(sessionId, cwd) {