@open-everywhere/create 0.7.0 → 0.8.0

package/template/package.json

@@ -10,14 +10,15 @@
     "postinstall": "oe-eve-patch",
     "oe:build": "oe build",
     "predev": "oe build",
-    "dev": "eve dev",
+    "dev": "EVE_TELEMETRY_DISABLED=1 eve dev",
     "prebuild": "oe build",
-    "build": "eve build",
+    "build": "EVE_TELEMETRY_DISABLED=1 eve build",
     "prestart": "oe build",
-    "start": "eve start",
+    "start": "EVE_TELEMETRY_DISABLED=1 eve start",
     "pretypecheck": "oe build",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "check": "create-open-everywhere --check",
+    "check:model-config": "node --import tsx scripts/model-config-check.ts",
     "ops": "node --import tsx scripts/ops-mcp.ts",
     "env:pipe": "node scripts/env-pipe.mjs"
   },

package/template/roster.lock.json

@@ -53,10 +53,13 @@
         "hook/native-input-audit": "mounted",
         "hook/own-account-ask": "mounted",
         "hook/personal-watch-enroll": "mounted",
+        "hook/question-ledger": "mounted",
         "hook/requester-identity": "mounted",
         "hook/requester-messages": "mounted",
         "hook/routine-outcome": "mounted",
+        "hook/routine-report-reply": "mounted",
         "hook/routine-silence": "mounted",
+        "hook/routine-test-run": "mounted",
         "hook/session-park": "mounted",
         "hook/spawn-taint": "mounted",
         "hook/spend": "mounted",
@@ -68,6 +71,7 @@
         "hook/wake-turn-start": "mounted",
         "hook/window-routing": "mounted",
         "schedule/audit-export": "mounted",
+        "schedule/cover-recap": "mounted",
         "schedule/directory-sync": "mounted",
         "schedule/dispatch": "mounted",
         "schedule/dream-mode3": "mounted",
@@ -107,6 +111,7 @@
         "tool/delete_skill": "mounted",
         "tool/describe_image": "mounted",
         "tool/dm_person": "mounted",
+        "tool/doing_for_me": "mounted",
         "tool/edit_reply": "mounted",
         "tool/edit_routine": "mounted",
         "tool/enable_routine": "mounted",
@@ -175,12 +180,15 @@
         "tool/spend_report": "mounted",
         "tool/stand_down": "mounted",
         "tool/subscribe_pr": "mounted",
+        "tool/test_routine": "mounted",
         "tool/unlink_identity": "mounted",
+        "tool/update_list": "mounted",
         "tool/update_status": "mounted",
         "tool/usage_report": "mounted",
         "tool/waiting_on_me": "mounted",
         "tool/walk_pr": "mounted",
-        "tool/work": "mounted"
+        "tool/work": "mounted",
+        "tool/write_canvas": "mounted"
       }
     },
     "@open-everywhere/provider-github": {

package/template/scripts/goldens/roster-plan.txt

@@ -38,10 +38,13 @@ agent/hooks/memory.ts	mounted @open-everywhere/core
 agent/hooks/native-input-audit.ts	mounted @open-everywhere/core
 agent/hooks/own-account-ask.ts	mounted @open-everywhere/core
 agent/hooks/personal-watch-enroll.ts	mounted @open-everywhere/core
+agent/hooks/question-ledger.ts	mounted @open-everywhere/core
 agent/hooks/requester-identity.ts	mounted @open-everywhere/core
 agent/hooks/requester-messages.ts	mounted @open-everywhere/core
 agent/hooks/routine-outcome.ts	mounted @open-everywhere/core
+agent/hooks/routine-report-reply.ts	mounted @open-everywhere/core
 agent/hooks/routine-silence.ts	mounted @open-everywhere/core
+agent/hooks/routine-test-run.ts	mounted @open-everywhere/core
 agent/hooks/sandbox-lifecycle.ts	mounted @open-everywhere/adapters
 agent/hooks/session-park.ts	mounted @open-everywhere/core
 agent/hooks/spawn-taint.ts	mounted @open-everywhere/core
@@ -55,6 +58,7 @@ agent/hooks/wake-turn-start.ts	mounted @open-everywhere/core
 agent/hooks/window-routing.ts	mounted @open-everywhere/core
 agent/lib/providers.generated.ts	providers slack,notion,github
 agent/schedules/audit-export.ts	mounted @open-everywhere/core
+agent/schedules/cover-recap.ts	mounted @open-everywhere/core
 agent/schedules/directory-sync.ts	mounted @open-everywhere/core
 agent/schedules/dispatch.ts	mounted @open-everywhere/core
 agent/schedules/dream-mode3.ts	mounted @open-everywhere/core
@@ -96,6 +100,7 @@ agent/tools/delegate_to_agent.ts	mounted @open-everywhere/core
 agent/tools/delete_skill.ts	mounted @open-everywhere/core
 agent/tools/describe_image.ts	mounted @open-everywhere/core
 agent/tools/dm_person.ts	mounted @open-everywhere/core
+agent/tools/doing_for_me.ts	mounted @open-everywhere/core
 agent/tools/edit_reply.ts	mounted @open-everywhere/core
 agent/tools/edit_routine.ts	mounted @open-everywhere/core
 agent/tools/enable_routine.ts	mounted @open-everywhere/core
@@ -169,11 +174,14 @@ agent/tools/spawn_thread_session.ts	mounted @open-everywhere/core
 agent/tools/spend_report.ts	mounted @open-everywhere/core
 agent/tools/stand_down.ts	mounted @open-everywhere/core
 agent/tools/subscribe_pr.ts	mounted @open-everywhere/core
+agent/tools/test_routine.ts	mounted @open-everywhere/core
 agent/tools/unlink_identity.ts	mounted @open-everywhere/core
+agent/tools/update_list.ts	mounted @open-everywhere/core
 agent/tools/update_status.ts	mounted @open-everywhere/core
 agent/tools/usage_report.ts	mounted @open-everywhere/core
 agent/tools/waiting_on_me.ts	mounted @open-everywhere/core
 agent/tools/walk_pr.ts	mounted @open-everywhere/core
 agent/tools/web_fetch.ts	framework-disabled
 agent/tools/work.ts	mounted @open-everywhere/core
+agent/tools/write_canvas.ts	mounted @open-everywhere/core
 agent/tools/write_file.ts	framework-disabled

package/template/scripts/model-config-check.ts

@@ -0,0 +1,81 @@
+// THE LIVE MODEL CONFIG CHECK — `npm run check:model-config` (OPE-2556).
+//
+//   npm run check:model-config            check this app's resolved models against its models.targets and models.dataPolicy
+//   npm run check:model-config -- --json  the same, as one JSON object
+//
+// It loads the app's own config (settings, stack, domains, roles), lists the models the deployment can resolve (the stack
+// roles, the gateway transcription routes, the domain and role routes, models.force, and each declared subagent's
+// bare model id on the target it goes through), and
+// reads the gateway's PUBLIC `/v1/models/<id>/endpoints` for each one. A `models.dataPolicy` row or a `providers.only`
+// row that no provider can meet is named, for example "region eu: no provider for deepseek/deepseek-v4-flash-0731".
+// Run it BEFORE a deploy that changes either setting: under such a row every call of that model fails closed.
+//
+// 🔴 TWO COPIES, ONE TEXT (OPE-2563). The repository runs this file, and the scaffold template ships the same bytes
+// at the same app-relative path, so a scaffolded app runs the check before its first deploy and the setup skill
+// names one command in both homes. `test:scaffold` refuses a copy that drifts.
+//
+// It needs the network and no credential: the endpoints read is unauthenticated. So it is NOT in the `npm test` chain.
+// The same check runs on a deployment, in the `model-route` row of `GET /eve/v1/oe/status` (adapters gateway-probe.ts),
+// which `npx @open-everywhere/create --check --host <url>` reports.
+//
+// A bare model id that no stack role names goes through the primary role's target (OPE-2566). The check names each
+// such id, so a subagent that would leave its role's target is visible before a deploy.
+//
+// Exit: 0 when every demand can be served or a part is unknown (printed), 1 when a demand cannot be served, or when a
+// role names a target other than `gateway` and the app does not register its roles for bare ids.
+
+import { getConfig } from "@open-everywhere/core/agent/access/config.js";
+import { getSettings } from "@open-everywhere/core/agent/settings/settings.js";
+import { modelTargetFor, resolvableModels } from "@open-everywhere/core/agent/model/targets.js";
+import { bareModelFallbacks, bareModelRoutes, bareModelRoutesUnregistered, bareModelVia } from "@open-everywhere/core/agent/model/bare-model-via.js";
+import { declaredSubagentModels } from "@open-everywhere/core/agent/ops/sovereignty-facts.js";
+import { importAppModule, resolveAppRoot } from "@open-everywhere/core/agent/scaffold/app-root.js";
+import { checkModelConfig, configCheckSummary } from "@open-everywhere/adapters/agent/model/model-config-check.js";
+import { targetBaseUrl } from "@open-everywhere/adapters/agent/model/target-url.js";
+
+// The deployer's app config loads from the app root (`OE_APP_ROOT`, else the directory npm ran in — OPE-2195).
+const APP_ROOT = resolveAppRoot();
+await importAppModule("agent/lib/register-config.ts", APP_ROOT);
+const { MODELS, TRANSCRIPTION_ROLE } = await importAppModule<typeof import("../agent/model/models.js")>("agent/model/models.ts", APP_ROOT);
+
+const settings = getSettings().models;
+// The gateway transcription routes carry the `gateway` target's rows too, so they are checked with the roles.
+const transcription = [TRANSCRIPTION_ROLE.primary, TRANSCRIPTION_ROLE.fallback].flatMap((r) => (r?.via === "gateway" ? [{ id: r.id }] : []));
+// A declared subagent's bare id is checked on the target it goes through: its role's, else the primary role's.
+const routes = bareModelRoutes(Object.values(MODELS));
+// The app's `agent/model/models.ts` registers the roles at load (the import above ran it). An app scaffolded before
+// 0.8.0 does not, so at run time every bare id still goes through `gateway`, whatever this check computes.
+// That matters only when a role names a target other than `gateway`: then a bare id leaves the role's target.
+const unregisteredLeak = bareModelRoutesUnregistered(routes);
+const declared = (await declaredSubagentModels(APP_ROOT)) ?? [];
+// A subagent whose module did not load has an unknown model: it is named, and the check cannot read it.
+const unloaded = declared.filter((b) => b.id === undefined).map((b) => b.where);
+const subagents = declared.flatMap((b) => (b.id === undefined ? [] : [{ where: b.where, id: b.id }]));
+const bare = subagents.map((b) => ({ id: b.id, via: bareModelVia(b.id, routes).via }));
+const fallbacks = bareModelFallbacks(subagents, routes);
+const models = resolvableModels([...Object.values(MODELS), ...transcription, ...bare], getConfig().loadDomains(), getConfig().loadRoles?.() ?? [], settings.force);
+const result = await checkModelConfig({
+  models,
+  targets: settings.targets,
+  policy: settings.dataPolicy,
+  baseUrlFor: (via) => targetBaseUrl(via, modelTargetFor(via, settings.targets)),
+  timeoutMs: 15_000,
+});
+
+if (process.argv.includes("--json")) {
+  console.log(JSON.stringify({ met: result.met, checked: result.checked, models, findings: result.findings, bareRoutesUnregistered: unregisteredLeak, bareDefaultVia: routes.fallback, bareFallbacks: fallbacks, unloadedSubagents: unloaded }, null, 2));
+} else {
+  console.log(configCheckSummary(result));
+  for (const f of result.findings) console.log(`  ${f.met === "no" ? "✗" : "?"} ${f.detail}`);
+  if (unregisteredLeak) {
+    console.log("  ✗ agent/model/models.ts does not call registerBareModelRoutes, so every bare id goes via gateway, not the targets below. Add the line from the 0.8.0 template.");
+  }
+  // Every declared subagent, with the target its bare id goes through; then the target of any other bare id.
+  for (const b of subagents) {
+    const r = bareModelVia(b.id, routes);
+    console.log(r.source === "role" ? `  · ${b.where}: via ${r.via}, its role's target` : `  · ${b.where}: no role names ${b.id}, so it goes via ${r.via}, the primary role's target`);
+  }
+  for (const w of unloaded) console.log(`  ? ${w}: model unknown, its module did not load, so it was not checked`);
+  console.log(`  · any other bare id (eve evaluate()): via ${routes.fallback}, the primary role's target`);
+}
+process.exit(result.met === "no" || unregisteredLeak ? 1 : 0);

package/template/scripts/ops-mcp.ts

@@ -47,5 +47,5 @@ registerSurfaceTrustPreflight();
 const server = buildOpsServer();
 await server.connect(new StdioServerTransport());
 process.stderr.write(
-  "open-everywhere-ops MCP server ready on stdio (preflight · surface_manifest · surface_app_package · scaffold_env · scaffold_credential_key · secret_set/list/rm)\n",
+  "open-everywhere-ops MCP server ready on stdio (preflight · surface_manifest · surface_app_package · surface_app_create · scaffold_env · scaffold_credential_key · secret_set/list/rm)\n",
 );