@open-everywhere/create 0.4.0 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-everywhere/create",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "license": "Apache-2.0",
   "type": "module",
   "description": "npx scaffold and setup check for Open Everywhere — one step engine, reported by --check for an agent-led setup.",
@@ -46,8 +46,8 @@
     "test:env-pipe": "tsx scripts/env-pipe-test.ts"
   },
   "dependencies": {
-    "@open-everywhere/core": "0.4.0",
-    "@open-everywhere/provider-slack": "0.4.0",
+    "@open-everywhere/core": "0.5.0",
+    "@open-everywhere/provider-slack": "0.5.0",
     "tsx": "^4.23.9"
   },
   "devDependencies": {

package/template/agent/access/a2a-agents.ts

@@ -0,0 +1,44 @@
+// The A2A AGENTS this app declares (OPE-2425) — config-as-code, changed by pull request only.
+//
+// MCP servers (./mcp-servers.ts) give the agent TOOLS AND DATA. A2A agents give it OTHER AGENTS: a
+// focused enterprise agent — an Agentforce, ServiceNow, Workday or Copilot Studio agent — that takes a
+// whole task in plain language and reports back. Each entry here is one such agent:
+//   • The agent reads the entry's published AGENT CARD and reaches ONLY the card URL's origin (scheme,
+//     host and port). A card that names an endpoint anywhere else is refused.
+//   • `delegate_to_agent` sends it a task. Every delegation takes an approval first: a member's click on
+//     a card that shows the agent, its host and the exact task text, or a pre-approval rule or the
+//     approval judge. The task goes out with the asker's identity attached
+//     (platform, workspace and their verified id) in the message metadata, with the person who approved
+//     it, or the rule that lifted it.
+//   • What the agent answers is UNTRUSTED content: it is fenced like any connector result, and it taints
+//     the turn that reads it.
+//
+// Only an INTERNAL room may delegate: a shared (Slack Connect), public or guest room is refused, and so
+// is a request a guest or external account took part in. `domains` narrows it further.
+//
+// A person cannot add an agent: a name that is not in this list is refused. No secret goes in this
+// file — an agent that needs a token names its credential-store REF (`npx oe secret set <ref>`).
+// See docs/extending/a2a-agents.md.
+
+import { defineA2aAgents } from "@open-everywhere/core/agent/a2a/agents.js";
+
+export const A2A_AGENTS = defineA2aAgents([
+  // Example — an agent with a public card and no credential:
+  //
+  // {
+  //   name: "it-helpdesk",
+  //   cardUrl: "https://<the vendor's agent host>/.well-known/agent-card.json",
+  //   description: "The IT helpdesk agent: opens, reads and updates IT tickets for a person.",
+  // },
+  //
+  // Example — an agent that takes a bearer token. Store the token with `npx oe secret set <ref>` and
+  // name the REF here, never the value:
+  //
+  // {
+  //   name: "hr-agent",
+  //   cardUrl: "https://agents.hr.example/.well-known/agent-card.json",
+  //   description: "The HR agent: answers questions about leave, payroll dates and benefits.",
+  //   auth: { scheme: "bearer", secretRef: "db:a2a:hr-agent-token" },
+  //   domains: ["people-ops"], // optional: only conversations in these memory domains may use it
+  // },
+]);

package/template/agent/access/access-requests.ts

@@ -30,6 +30,7 @@ import { emptyAgentsFile } from "@open-everywhere/core/agent/memory/agents-codem
 import { loadBaseBundles, loadBaseBindings } from "./bundles.js";
 import { loadBaseConnectorCredentials } from "./connector-credentials.js";
 import { loadBaseWebhooks } from "../webhooks/hooks.js";
+import { MCP_SERVERS } from "./mcp-servers.js";
 import { loadBaseDomains, loadBaseSilos, loadDomains } from "../memory/config/domains.js";
 import { loadGroups } from "../identity/groups.js";
 
@@ -61,6 +62,8 @@ export function loadAccessRequests(): AccessRequestsConfig | null {
     // baseline a candidate overlay is validated against before any PR opens.
     hooksPath: process.env.OE_WEBHOOK_HOOKS_PATH || undefined,
     baseWebhooks: loadBaseWebhooks,
+    // The declared MCP servers, so `propose_mcp_server` validates a candidate entry against them (OPE-2420).
+    baseMcpServers: () => MCP_SERVERS,
     // The `create_agent` PR path (create_agent flow, increment 2) rides this SAME config repo, branch
     // and bot credential — only the machine-written file differs (the agents overlay). `baseAgents` is
     // the code-declared agents baseline (empty — agents live only in the overlay); `baseDomains` /

package/template/agent/access/mcp-servers.ts

@@ -16,10 +16,23 @@
 // which needs no client id and no secret. Only a vendor WITHOUT dynamic registration takes a static
 // client, and then this file names the secret's credential-store REF, never its value.
 // See docs/extending/connectors.md#declare-an-mcp-server-in-your-app.
+//
+// "SEARCH SLACK AS YOU" (OPE-2421) is a built-in entry: `slackAsYou({ clientId })` mounts Slack's own MCP
+// server on each person's own Slack sign-in, in their Slack DM only. The agent answers with the bot first and
+// offers the person's connection only when the bot cannot see what was asked; every post as the person takes a
+// card. It reuses the org's own Slack app: name its public Client ID here, and store its Client Secret with
+// `npx oe secret set db:slack:oauth-client-secret`. The Slack app also needs the MCP toggle (its Agents section)
+// and the scopes in the manifest `surface_manifest` returns once this entry is declared.
+// See docs/deploy/surfaces/slack.md#search-slack-as-you.
 
 import { defineMcpServers } from "@open-everywhere/core/agent/connections/mcp-servers.js";
 
 export const MCP_SERVERS = defineMcpServers([
+  // Example — "search Slack as you" on your own Slack app. Import it first:
+  //   import { slackAsYou } from "@open-everywhere/provider-slack/agent/slack-as-you.js";
+  //
+  // slackAsYou({ clientId: "<your Slack app's Client ID>" }),
+  //
   // Example — a vendor with dynamic client registration (the common case). Take the URL from the
   // vendor's own MCP documentation:
   //
@@ -27,6 +40,9 @@ export const MCP_SERVERS = defineMcpServers([
   //   name: "fullstory",
   //   url: "https://<the vendor's hosted MCP endpoint>",
   //   description: "FullStory: search sessions, read session summaries and product analytics.",
+  //   // Optional. The OAuth scopes the sign-in asks for; absent ⇒ no scope parameter is sent and the
+  //   // vendor's default applies. Name the read scopes first: a person's token holds only these.
+  //   signIn: { scopes: ["read:sessions"] },
   // },
   //
   // Example — a vendor WITHOUT dynamic registration. Create the client in the vendor's developer
@@ -43,6 +59,7 @@ export const MCP_SERVERS = defineMcpServers([
   //     clientId: "public-client-id",
   //     clientSecretRef: "db:acme:oauth-client-secret",
   //     bodyEncoding: "form",
+  //     scopes: ["accounts.read", "deals.read"], // optional: the scopes the authorize URL asks for
   //   },
   // },
 ]);

package/template/agent/instructions.md

@@ -72,6 +72,10 @@ set up, they just ask. Pick the move that fits the shape of the ask:
   offer to set it up with `create_routine` so it just happens without anyone asking.
 - **Make it a skill.** A multi-step way-of-doing-things recurs: capture it with
   `create_skill` so next time it's one named move.
+- **Set up a new connector.** "Set up FullStory" or "connect <vendor>" asks for a NEW connector, and that is
+  a pull request, not a grant. A worker researches the vendor's hosted MCP server (`web_search`,
+  `web_fetch`) and proposes it with `propose_mcp_server`: one entry in `agent/access/mcp-servers.ts`
+  on the deployment's config repo, for an admin to merge. It is not set up until the merge.
 
 Some of these verbs live on workers rather than on a conversational seat. If a move above
 names a tool you don't hold, that is not a "can't" — delegate it (`agent`) with a brief

package/template/agent/lib/register-config.ts

@@ -40,6 +40,8 @@ import { loadSpendCheckpoints } from "../spend/checkpoints.js";
 import { loadModelPolicy } from "../model/policy.js";
 import { loadPrincipals } from "../identity/principals.js";
 import { loadGroups } from "../identity/groups.js";
+import { registerA2aAgents } from "@open-everywhere/core/agent/a2a/agents.js";
+import { A2A_AGENTS } from "../access/a2a-agents.js";
 // Side effect: register the operator's per-surface trust registry (identity/trust.ts) at
 // boot, before any binding resolves. Self-registering (calls registerSurfaces on
 // import); nothing to thread through the AppConfig object.
@@ -96,6 +98,12 @@ registerSettings(SETTINGS_OVERRIDES);
 // prices during boot sees a half-wired deployment.
 registerModelPricing(loadModelPricing());
 
+// The A2A AGENTS this app declares (OPE-2425, agent/access/a2a-agents.ts) — the only agents
+// `delegate_to_agent` can reach. Registered on core's own slot rather than carried on AppConfig: the
+// list is validated at import (defineA2aAgents throws on a bad entry), and an unregistered list is
+// empty, so a core-only process delegates to nobody.
+registerA2aAgents(A2A_AGENTS);
+
 registerConfig({
   loadBundles,
   loadBindings,

package/template/agent/memory/config/domains/index.ts

@@ -70,6 +70,12 @@
 // Every member outside Slack must be declared internal in agent/identity/surfaces.ts, or the boot
 // refuses the window (memory/domain.ts assertWindowSourcesVouched).
 //
+// 🔴 THE DEFAULT IS UNIFIED. A declared domain that omits `mode` shares ONE window across its
+// rooms (OPE-2412). It falls back to solo, and the boot logs why, when its reach holds a tenant or
+// glob entry or a room outside Slack is not declared internal. A one-room domain stays solo. To
+// keep each room in its own seat, write `mode: "solo"` on the domain. `org`, `public` and `dm`
+// below are always solo.
+//
 // --- CRITERIA PSEUDO-DOMAINS (optional) — selected by trust/mode, not a channel list.
 //     Each is a singleton (at most one per match) with the full domain toolkit.
 //

package/template/agent/webhooks/hooks.ts

@@ -2,8 +2,8 @@
 // inbound-webhook surface (docs/capabilities/proactivity-and-routines.md in the Open Everywhere repository "Inbound
 // webhook triggers"). Declare a hook: which signature scheme its sender uses (`source`),
 // where its shared secret lives (`secretRef` + the `broker` that ref resolves through),
-// which `slack/TEAM/CHANNEL` surface it fires into, and what the agent should do when it
-// fires. Point the provider at `POST /webhooks/<id>` (channels/webhooks.ts).
+// where it fires (a room on Slack, Discord or Teams, or a person's DM), and what the agent
+// should do when it fires. Point the provider at `POST /webhooks/<id>` (channels/webhooks.ts).
 //
 // SIGNATURE SCHEME: `source` names the registered verifier. `"oe-standard-webhook"` is
 // OUR own contract — the public standard-webhooks spec (`webhook-id` + `webhook-timestamp`
@@ -50,8 +50,8 @@
 // the seam a DB/dashboard would swap behind, same as memory/config/domains.ts and access/
 // bundles.ts. After adding a hook: `npm run typecheck` plus a boot (assertWebhooksValid runs
 // at import time and throws on a malformed entry — id collisions, a missing source, a
-// blank/empty secretRef, a missing broker, a target that isn't a well-formed
-// slack/TEAM/CHANNEL triple).
+// blank/empty secretRef, a missing broker, a target that is neither a room
+// "<platform>/<workspace>/<surface>" nor a person "dm:<principal key>").
 
 import { defineWebhook, assertWebhooksValid, type WebhookHook } from "@open-everywhere/core/agent/webhooks/config.js";
 import { loadHooksOverlay } from "./hooks-overlay.js";
@@ -64,7 +64,7 @@ const hooks: WebhookHook[] = [
   //   source: "oe-standard-webhook",               // OUR contract — a sender you control signs it
   //   secretRef: "DEPLOY_STATUS_WEBHOOK_SECRET",   // shared secret REF (env var NAME here, not the value)
   //   broker: "env",                               // the home that ref resolves through ("env" | "db" | ...)
-  //   target: "slack/<team-id>/<channel-id>",         // fully-qualified slack/TEAM/CHANNEL surface
+  //   target: "slack/<team-id>/<channel-id>",         // a room on any surface, or "dm:<principal key>" for a person
   //   readableBy: [{ level: "domain", domain: "engineering" }],  // WHO may read its events — REQUIRED, no default
   //   posture: "projection",                       // HOW MUCH of the payload reaches the model
   //   project: ["status", "branch"],               // …under "projection": exactly these normalizer field keys

package/template/roster.lock.json

@@ -58,10 +58,12 @@
         "hook/spend": "mounted",
         "hook/stall-guard": "mounted",
         "hook/telemetry": "mounted",
+        "hook/tool-usage": "mounted",
         "hook/turn-anchor": "mounted",
         "hook/wake-accounting-turn": "mounted",
         "hook/wake-turn-start": "mounted",
         "hook/window-routing": "mounted",
+        "schedule/audit-export": "mounted",
         "schedule/directory-sync": "mounted",
         "schedule/dispatch": "mounted",
         "schedule/dream-mode3": "mounted",
@@ -78,6 +80,7 @@
         "tool/cancel_routine": "mounted",
         "tool/cancel_work": "mounted",
         "tool/capture_events": "mounted",
+        "tool/check_agent_task": "mounted",
         "tool/check_pr_status": "mounted",
         "tool/checkout_repo": "mounted",
         "tool/clear_connector_override": "mounted",
@@ -91,6 +94,7 @@
         "tool/create_skill": "mounted",
         "tool/create_ticket": "mounted",
         "tool/declare_webhook": "mounted",
+        "tool/delegate_to_agent": "mounted",
         "tool/delete_skill": "mounted",
         "tool/describe_image": "mounted",
         "tool/dm_person": "mounted",
@@ -116,6 +120,7 @@
         "tool/post_file": "mounted",
         "tool/post_message": "mounted",
         "tool/post_pr_walkthrough": "mounted",
+        "tool/propose_mcp_server": "mounted",
         "tool/purge_memory": "mounted",
         "tool/query_analytics": "mounted",
         "tool/react": "mounted",
@@ -156,6 +161,7 @@
         "tool/unlink_identity": "mounted",
         "tool/update_status": "mounted",
         "tool/usage_report": "mounted",
+        "tool/waiting_on_me": "mounted",
         "tool/walk_pr": "mounted",
         "tool/work": "mounted"
       }

package/template/scripts/goldens/roster-plan.txt

@@ -44,11 +44,13 @@ agent/hooks/spawn-taint.ts	mounted @open-everywhere/core
 agent/hooks/spend.ts	mounted @open-everywhere/core
 agent/hooks/stall-guard.ts	mounted @open-everywhere/core
 agent/hooks/telemetry.ts	mounted @open-everywhere/core
+agent/hooks/tool-usage.ts	mounted @open-everywhere/core
 agent/hooks/turn-anchor.ts	mounted @open-everywhere/core
 agent/hooks/wake-accounting-turn.ts	mounted @open-everywhere/core
 agent/hooks/wake-turn-start.ts	mounted @open-everywhere/core
 agent/hooks/window-routing.ts	mounted @open-everywhere/core
 agent/lib/providers.generated.ts	providers slack,notion,github
+agent/schedules/audit-export.ts	mounted @open-everywhere/core
 agent/schedules/directory-sync.ts	mounted @open-everywhere/core
 agent/schedules/dispatch.ts	mounted @open-everywhere/core
 agent/schedules/dream-mode3.ts	mounted @open-everywhere/core
@@ -67,6 +69,7 @@ agent/tools/browser_tools.ts	mounted @open-everywhere/core
 agent/tools/cancel_routine.ts	mounted @open-everywhere/core
 agent/tools/cancel_work.ts	mounted @open-everywhere/core
 agent/tools/capture_events.ts	mounted @open-everywhere/core
+agent/tools/check_agent_task.ts	mounted @open-everywhere/core
 agent/tools/check_pr_status.ts	mounted @open-everywhere/core
 agent/tools/checkout_repo.ts	mounted @open-everywhere/core
 agent/tools/clear_connector_override.ts	mounted @open-everywhere/core
@@ -80,6 +83,7 @@ agent/tools/create_routine.ts	mounted @open-everywhere/core
 agent/tools/create_skill.ts	mounted @open-everywhere/core
 agent/tools/create_ticket.ts	mounted @open-everywhere/core
 agent/tools/declare_webhook.ts	mounted @open-everywhere/core
+agent/tools/delegate_to_agent.ts	mounted @open-everywhere/core
 agent/tools/delete_skill.ts	mounted @open-everywhere/core
 agent/tools/describe_image.ts	mounted @open-everywhere/core
 agent/tools/dm_person.ts	mounted @open-everywhere/core
@@ -107,6 +111,7 @@ agent/tools/permission_fit_report.ts	mounted @open-everywhere/core
 agent/tools/post_file.ts	mounted @open-everywhere/core
 agent/tools/post_message.ts	mounted @open-everywhere/core
 agent/tools/post_pr_walkthrough.ts	mounted @open-everywhere/core
+agent/tools/propose_mcp_server.ts	mounted @open-everywhere/core
 agent/tools/purge_memory.ts	mounted @open-everywhere/core
 agent/tools/query_analytics.ts	mounted @open-everywhere/core
 agent/tools/react.ts	mounted @open-everywhere/core
@@ -150,6 +155,7 @@ agent/tools/subscribe_pr.ts	mounted @open-everywhere/core
 agent/tools/unlink_identity.ts	mounted @open-everywhere/core
 agent/tools/update_status.ts	mounted @open-everywhere/core
 agent/tools/usage_report.ts	mounted @open-everywhere/core
+agent/tools/waiting_on_me.ts	mounted @open-everywhere/core
 agent/tools/walk_pr.ts	mounted @open-everywhere/core
 agent/tools/web_fetch.ts	framework-disabled
 agent/tools/work.ts	mounted @open-everywhere/core