@tealbrick/avm 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tealbrick contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/PROVENANCE.md

@@ -0,0 +1,38 @@
+# Provenance and source contract
+
+Implementation authored independently for Tealbrick, MIT. No Kybernesis package dependency or copied runtime source. Upstream was inspected; this is not a source-unexposed clean-room claim.
+
+Source authority inspected 2026-09-08: `/Users/puma/work/active/kybernesis-avm`, HEAD `860fb32ef70813760c99631231424fbe0ddde3b1`; `agentvm/bin/avm.py` reports source AVM version 0.12.9. Working checkout may contain additional uncommitted changes; the cited source file, not installed npm CLI metadata, defines this host contract.
+
+- `agentvm/bin/avm.py`: `parser()` and `add_identity_actions()` define host `--json`, `worker ls/status/create/start/stop/promote/destroy/exec`, runs/events, monitor, inventory, bundle and capability manifest. Client uses native worker commands rather than npm `agent spawn` aliases.
+- Same file `main()` maps worker create to kind=worker, profile/mode/catalog/capabilities; exec passes normalized remainder argv. Success envelope is `{api_version:'agentvm/v1',result:...}`; error envelope contains `error.message`; exec returns guest returncode as CLI exit code.
+- `agentvm/lib/agentvmd.py`: source of daemon policy/execution and run metadata. No unsupported daemon API has been invented and no root socket is exposed.
+- Eve 0.49.0 installed docs `docs/extensions.md` plus `docs/guides/dynamic-capabilities.md` and public ToolContext declaration informed extension layout, builder-managed exports and abortSignal propagation. `eve extension init tealbrick-avm-scaffold-20260908` was run in disposable `/tmp` as the scaffold contract reference; package implementation is separately authored.
+
+Environment boundary: no Puma-local AVM invocation, no SSH/live AVM invocation, no remote mutation, no credentials copied. Mock results do not establish deployed host compatibility. Upstream CLI may evolve without changing the envelope version, so consumers should pin and verify their host release independently.
+
+## AVMM update — 2026-09-15
+
+Current compatibility authority supersedes the historical checkout above:
+[Martin-Atrin/avmm, codex/avmm-final](https://github.com/Martin-Atrin/avmm/tree/75078743b9bfc2ba268f1fdeea74f298983dfac4),
+release `0.13.0-alpha.2`. Inspected in `/Users/puma/work/upstreams/avmm` at that exact
+revision. `main` still reports 0.12.8 and is not the selected target.
+
+- `agentvm/bin/avm.py`: current flags for resource pool, local workspaces/users,
+  ownership/shares, resident/wake/cool, provider-neutral ingress, event filters,
+  worker resize and all worker creation selections.
+- `agentvm/bin/agentvm-remote-shell.py`: restricted paired SSH command grammar,
+  attestation requirement and `/usr/local/bin/avm` execution boundary.
+- `agentvm/lib/agentvmd.py`: authoritative verified actor, share action allowlist,
+  auth selection restrictions, queue policy and resource field semantics.
+- `packages/agentvm-cli/src/commands.mjs`, `remote.mjs`, `config.mjs`: operator
+  aliases, quoting contract and current single-connection configuration. Named
+  Teal Brick connection profiles are newly authored convenience configuration;
+  they are not attributed to an upstream multi-host profile API.
+- `docs/releases/0.13.0-alpha.2.md`: upstream ingress acceptance history, distinct
+  from this package's tests and the blocked Neuu preflight.
+
+No upstream runtime source was copied into this package. Tests construct mock
+responses and execute no AVM process on Puma. The attempted SSH Neuu version probe
+failed strict host-key verification before any remote command ran. No key was
+replaced, runtime changed, credential copied or tenant operation executed.

package/README.md

@@ -0,0 +1,165 @@
+# @tealbrick/avm
+
+Typed host-owned AVMM transport and opt-in Eve capabilities. Node 24+, Eve 0.55.0.
+Tested source contract: **AVMM 0.13.0-alpha.2**, `codex/avmm-final` at
+`75078743b9bfc2ba268f1fdeea74f298983dfac4`. The host executable remains
+`/usr/local/bin/avm`; the JSON envelope remains `agentvm/v1`.
+
+## Connection and identity profiles
+
+```ts
+import avm from '@tealbrick/avm/eve';
+export default avm({
+  selectedProfile: 'alice',
+  profiles: {
+    alice: {
+      mode: 'paired', target: 'agentvm-client@host.example',
+      identityFile: '/run/keys/alice',
+    },
+    bob: {
+      mode: 'paired', target: 'agentvm-client@host.example',
+      identityFile: '/run/keys/bob',
+    },
+  },
+});
+```
+
+The operator selects one profile. Model inputs cannot switch host, key, user,
+workspace or policy. Named **connection profiles are a Teal Brick convenience**;
+AVMM's **resource profiles** are `light`, `small`, `standard`, `browser`.
+Neither is itself a tenant security boundary. AVMM verifies the paired SSH key's
+host-managed attestation, local user/workspace binding, ownership and shares.
+A workspace name in an administration request identifies the object to manage;
+it does not authenticate the caller.
+
+- `paired`: speaks AVMM's restricted SSH ForceCommand protocol. Requires `agentvm-client@host` and a bound
+  `identityFile`; rejects sudo and identity-token overrides. Uses only that key,
+  disables SSH agent fallback, skips SSH config (`-F /dev/null`), and therefore
+  requires an actual resolvable hostname/IP, not an SSH-only alias. Host keys must
+  already be trusted. No arbitrary remote Python or shell is required.
+- `operator` (legacy default): constant remote Python subprocess, with argv sent
+  as JSON stdin; optional `sudo: true`. Uses the configured SSH account's authority.
+  This can be host administrator authority and is not a tenant sandbox.
+  Optional `identityTokenFile` references an existing root-managed **remote** file;
+  the package never reads or copies the token. `identityFile` is an SSH key path,
+  never the key contents.
+
+Both execute AVM only on the remote host, preserve strict host-key checking,
+disable forwarding, exclude ambient provider environment, and never load a local
+AVM config or run local AVM. No pairing, credential creation or host installation
+occurs. Backward-compatible single connection: `{target:'nucbox', sudo:true}`.
+
+Harness-neutral consumers use `@tealbrick/avm/client`:
+
+```ts
+import {AvmClient, SshTransport, avmConfigSchema} from '@tealbrick/avm/client';
+const config = avmConfigSchema.parse({
+  target: 'agentvm-client@host.example', mode: 'paired', identityFile: '/run/keys/alice',
+});
+const client = new AvmClient(new SshTransport(config), config);
+const pool = await client.request({operation: 'poolStatus'});
+```
+
+## Reads
+
+`doctor`, `inventory`, `workers`, `workerStatus`, `bundles`, `monitor`,
+`capabilities`, `runs`, `runStatus`, `events`, `poolStatus`, `poolPressure`,
+`poolQueue`, `poolPolicy`, `workspaces`, `workspace`, `users`, `user`, `owner`,
+`shares`, `resident`, `ingress`. Events accept `worker`, `event`, `runId` and
+bounded `limit`; ingress accepts an optional worker. The host can deny reads
+according to the authenticated caller. Successful results are generic JSON,
+not a promise of stable upstream result schemas or a replacement for consumer
+authorization/output handling.
+
+## Explicit action grants
+
+No action tool exists without configured grants. Existing `lifecycle` and fixed
+`commands` grants remain supported. Spawn selections now cover all current worker
+create flags:
+
+```ts
+const policy = {
+  spawns: [{
+    worker: 'reviewer', profile: 'light', mode: 'durable',
+    harnesses: ['eve', 'codex'], bundles: ['base'],
+    mcps: ['approved-mcp'], plugins: ['approved-plugin'],
+    auth: ['codex=shared'], capabilities: ['browser:public'],
+  }],
+  administration: [{
+    name: 'wake-reviewer',
+    request: {operation: 'wake', worker: 'reviewer', idempotencyKey: 'task-123'},
+  }],
+};
+// Attach policy to the connection/profile. Caller chooses only the exact grant:
+// client.request({operation:'configured', action:'wake-reviewer'});
+```
+
+Catalog selections are names, not package installation or credentials.
+Auth choices are `provider=none`, `provider=local`, and `codex=shared`.
+AVMM currently rejects `scoped` and shared auth for other providers; this adapter
+rejects those too. Provider secrets remain with AVMM's configured credential owner.
+
+Named `administration` grants accept strictly validated requests:
+
+| Operation | Configured fields / behavior |
+|---|---|
+| `resize` | worker, memoryTargetMiB |
+| `workspacePut` / `workspaceDisable` | workspace; put: displayName, weight, concurrentHeavyWork, queuePolicy |
+| `tenantSync` | workspace, displayName, principalId, issuer, subject, role, same queue policy fields |
+| `userPut` | user, workspace, role |
+| `ownerSet` | worker, workspace, optional user |
+| `shareGrant` / `shareRevoke` | worker; grant: grantee `{kind:'workspace'|'user',id}`, allow; revoke: shareId |
+| `poolPolicySet` | cpuPercent, memoryMaxBytes, memoryHighBytes, hostMemoryReserveBytes, launchReserveBytes |
+| `residentSet` / `cool` | worker |
+| `wake` | worker, required idempotencyKey, optional source/reason/externalEventId |
+| `ingressPut` | provider, externalIdentity, worker, optional channelScope/metadataFile |
+| `ingressRevoke` | identityId |
+| `ingressWake` | provider, externalIdentity, eventId, optional channelScope/payloadFile/correlationId |
+| `ingressComplete` | wakeId, optional error; record delivery only after actual delivery |
+
+File fields reference trusted remote files; contents are not put into argv.
+These grants are operator configuration, not browser/model input. They cannot
+bypass daemon permissions. Share actions use AVMM's allowlist and exclude destroy
+and ownership transfer. Owner changes, workspace disable, pool changes, cooling,
+and disk destruction have real side effects; grant only the intended operation.
+A fixed ingress/wake grant represents a specific event. A provider adapter needs
+fresh trusted grants for subsequent events and remains responsible for delivery.
+No retries are automatic. Cancellation stops SSH; remote work may continue.
+Reconcile before retrying; wake event keys do not make all CLI commands idempotent.
+
+## Eve and kit
+
+Importing dependencies contributes nothing. An explicit mount contributes inspect;
+a dynamic action is exposed only with grants. It rechecks current configuration
+on each execution, including after profile switching or revocation.
+
+The kit accepts the same configuration under `avm`. `tealbrick setup` can select
+an existing named profile or configure paired/operator SSH. `tealbrick apply
+config.json` supports full profiles and policies. Provider transport is unrelated
+to AVMM's tenant authorization. No channels, hooks, miniapps or credential tools
+are incidentally mounted.
+
+## Evidence and remaining scope
+
+The 2026-09-15 suite passes 95 package tests, including 22 AVM tests, plus isolated
+kit tarball install, strict consumer type checking and Eve discovery/build.
+Coverage includes denial, immutable grants, profile switching/revocation,
+forced-command quoting, transport identity isolation, timeouts/output bounds,
+legacy kit receipts, activation/deactivation and exact command construction.
+All action/transport tests are disposable and mocked; no local AVM is executed.
+
+Live Neuu verification was blocked by a changed SSH host key before connection.
+No tenant isolation, VM creation, cold wake or message delivery was exercised live
+by this package update. Earlier 0.12.9 doctor receipts are historical only.
+
+This remains a bounded adapter, not the entire operator CLI. Host installation,
+pairing, client-key enrollment, trusted VM management, interactive SSH, provider
+login/leases, browser/LCM, role deployment and schedules remain operator-owned.
+The package does not implement a Buzz/Telegram adapter or automatic Portal agent
+registration. Packages are unpublished; neither npm release nor deployment is
+implied by tests.
+
+Deployment authority correction (2026-09-15): live AVMM/Eve/Teal Brick packages
+belong exclusively on Nucbox, the Fedora N150. Neuu attempts above are historical
+and were aimed at the wrong host. Nucbox is reachable and reports AVMM
+0.13.0-alpha.2; its resident Aura still runs Eve 0.49.0. No live upgrade is implied.

package/dist/_chunks/extension-CS1otfhf.mjs

@@ -0,0 +1,232 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import { defineExtension } from "eve/extension";
+import { z } from "zod";
+const id = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/);
+const workspace = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/);
+const user = z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/);
+const nonnegative = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const publicValue = z.string().min(1).max(512).regex(/^[^\0\r\n]+$/);
+const provider = z.string().regex(/^[a-z][a-z0-9._-]{0,63}$/);
+const positive = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+const path = z.string().regex(/^\/[A-Za-z0-9_./ -]+$/).max(4096);
+const queue = {
+	weight: positive.optional(),
+	concurrentHeavyWork: nonnegative.optional(),
+	queuePolicy: z.enum([
+		"fair",
+		"fifo",
+		"reject"
+	]).optional()
+};
+const administrationSchema = z.discriminatedUnion("operation", [
+	z.object({
+		operation: z.literal("tenantSync"),
+		workspace,
+		displayName: publicValue.optional(),
+		principalId: user.optional(),
+		issuer: z.url().optional(),
+		subject: publicValue.optional(),
+		role: z.enum([
+			"member",
+			"admin",
+			"operator"
+		]).default("member"),
+		...queue
+	}).strict(),
+	z.object({
+		operation: z.literal("ingressPut"),
+		provider,
+		externalIdentity: publicValue,
+		worker: id,
+		channelScope: publicValue.optional(),
+		metadataFile: path.optional()
+	}).strict(),
+	z.object({
+		operation: z.literal("ingressRevoke"),
+		identityId: id
+	}).strict(),
+	z.object({
+		operation: z.literal("ingressWake"),
+		provider,
+		externalIdentity: publicValue,
+		eventId: publicValue,
+		channelScope: publicValue.optional(),
+		payloadFile: path.optional(),
+		correlationId: publicValue.optional()
+	}).strict(),
+	z.object({
+		operation: z.literal("ingressComplete"),
+		wakeId: id,
+		error: publicValue.optional()
+	}).strict(),
+	z.object({
+		operation: z.literal("resize"),
+		worker: id,
+		memoryTargetMiB: positive
+	}).strict(),
+	z.object({
+		operation: z.literal("workspacePut"),
+		workspace,
+		displayName: z.string().min(1).max(256).regex(/^[^\0\r\n]+$/).optional(),
+		...queue
+	}).strict(),
+	z.object({
+		operation: z.literal("workspaceDisable"),
+		workspace
+	}).strict(),
+	z.object({
+		operation: z.literal("userPut"),
+		user,
+		workspace,
+		role: z.enum([
+			"member",
+			"admin",
+			"operator"
+		])
+	}).strict(),
+	z.object({
+		operation: z.literal("ownerSet"),
+		worker: id,
+		workspace,
+		user: user.optional()
+	}).strict(),
+	z.object({
+		operation: z.literal("shareGrant"),
+		worker: id,
+		grantee: z.discriminatedUnion("kind", [z.object({
+			kind: z.literal("workspace"),
+			id: workspace
+		}).strict(), z.object({
+			kind: z.literal("user"),
+			id: user
+		}).strict()]),
+		allow: z.array(z.enum([
+			"status",
+			"exec",
+			"start",
+			"stop",
+			"ssh",
+			"logs",
+			"events",
+			"runs",
+			"assignments",
+			"schedule",
+			"capabilities",
+			"auth",
+			"leases",
+			"resident",
+			"wake",
+			"cool",
+			"list",
+			"inventory",
+			"monitor",
+			"roles",
+			"ingress"
+		])).min(1)
+	}).strict(),
+	z.object({
+		operation: z.literal("shareRevoke"),
+		worker: id,
+		shareId: id
+	}).strict(),
+	z.object({
+		operation: z.literal("residentSet"),
+		worker: id
+	}).strict(),
+	z.object({
+		operation: z.literal("wake"),
+		worker: id,
+		reason: z.string().min(1).max(256).optional(),
+		source: z.enum([
+			"cli",
+			"schedule",
+			"control-plane",
+			"delegation"
+		]).default("cli"),
+		externalEventId: id.optional(),
+		idempotencyKey: id
+	}).strict(),
+	z.object({
+		operation: z.literal("cool"),
+		worker: id
+	}).strict(),
+	z.object({
+		operation: z.literal("poolPolicySet"),
+		cpuPercent: positive.optional(),
+		memoryMaxBytes: positive.optional(),
+		memoryHighBytes: positive.optional(),
+		hostMemoryReserveBytes: nonnegative.optional(),
+		launchReserveBytes: nonnegative.optional()
+	}).strict()
+]);
+const policySchema = z.object({
+	lifecycle: z.array(z.object({
+		worker: id,
+		operations: z.array(z.enum([
+			"start",
+			"stop",
+			"promote",
+			"destroy"
+		]))
+	}).strict()).default([]),
+	spawns: z.array(z.object({
+		worker: id,
+		profile: z.enum([
+			"light",
+			"small",
+			"standard",
+			"browser"
+		]),
+		mode: z.enum(["ephemeral", "durable"]),
+		harnesses: z.array(z.string()).optional(),
+		bundles: z.array(z.string()).optional(),
+		capabilities: z.array(z.string()).optional(),
+		mcps: z.array(z.string()).optional(),
+		plugins: z.array(z.string()).optional(),
+		auth: z.array(z.string().regex(/^[a-z][a-z0-9_-]*=(none|local)$|^codex=shared$/)).optional()
+	}).strict()).default([]),
+	commands: z.array(z.object({
+		worker: id,
+		command: id,
+		argv: z.array(z.string().max(8192).refine((v) => !v.includes("\0"))).min(1).max(100)
+	}).strict()).default([]),
+	administration: z.array(z.object({
+		name: id,
+		request: administrationSchema
+	}).strict()).default([])
+}).strict();
+const connectionSchema = z.object({
+	target: z.string().regex(/^(?:[A-Za-z0-9_][A-Za-z0-9_.-]*@)?[A-Za-z0-9][A-Za-z0-9.-]*$/),
+	mode: z.enum(["operator", "paired"]).default("operator"),
+	sudo: z.boolean().default(false),
+	identityFile: path.optional(),
+	identityTokenFile: path.optional(),
+	timeoutMs: z.number().int().min(1).max(3e5).default(3e4),
+	policy: policySchema.default({
+		lifecycle: [],
+		spawns: [],
+		commands: [],
+		administration: []
+	})
+}).strict().refine((c) => c.mode !== "paired" || c.target.startsWith("agentvm-client@") && !c.sudo && !!c.identityFile && !c.identityTokenFile, { message: "Paired mode requires agentvm-client@host and its bound SSH identity file and disallows sudo or identity token overrides" });
+const avmConfigSchema = z.union([connectionSchema, z.object({
+	selectedProfile: id,
+	profiles: z.record(id, connectionSchema)
+}).strict().transform((c, ctx) => {
+	const selected = Object.hasOwn(c.profiles, c.selectedProfile) ? c.profiles[c.selectedProfile] : void 0;
+	if (!selected) {
+		ctx.addIssue({
+			code: "custom",
+			message: "Unknown AVM connection profile"
+		});
+		return z.NEVER;
+	}
+	return selected;
+})]);
+var extension_default = defineExtension({ config: avmConfigSchema });
+export { administrationSchema as n, extension_default as t };