@tealbrick/kit 0.2.6 → 0.2.7

package/BOOTSTRAP.md

@@ -1,13 +1,12 @@
-> Eve 0.63.0 is a candidate; the approved baseline remains Eve 0.58.1. Suite 0.2.4 is an unpublished compatibility candidate.
+> Eve 0.66.0 is the supported baseline. Suite 0.2.7 contains deployment fixes and is not yet published; npm latest remains 0.2.6.
 
 # Deployment guide: Eve agent + Teal Brick kit
 
 This guide installs the seven implemented packages through one kit and activates
-only the capabilities you select. The supported harness line is **Eve 0.63.x**;
-**0.63.0** and **AI SDK 7.0.105** are the current tested versions. Use Node **24**.
+only the capabilities you select. The supported harness line is **Eve 0.66.x**;
+**0.66.0** and **AI SDK 7.0.107** are the current tested versions. Use Node **24**.
 
-**Release status:** `@tealbrick/kit@0.2.4` is the unpublished Eve 0.63 compatibility candidate for the
-complete suite. Use the npm installation in step 3. Do not substitute an unrelated unscoped `tealbrick` package.
+**Release status:** `@tealbrick/kit@0.2.7` is the unpublished deployment-fix suite. Until publication, install the validated local tarballs with workspace dependency overrides; the versioned npm command in step 3 applies after publication. Do not substitute an unrelated unscoped `tealbrick` package.
 
 ## What installs what
 
@@ -19,12 +18,12 @@ Eve runs the agent and needs its own working primary-model authentication.
 For a fresh machine, the sequence is:
 
 1. Install Node 24 and npm.
-2. Create an Eve 0.63.0 project and configure its primary model credentials.
-3. Install `@tealbrick/kit@0.2.4` inside that project.
+2. Create an Eve 0.66.0 project and configure its primary model credentials.
+3. Install `@tealbrick/kit@0.2.7` inside that project.
 4. Run `tealbrick setup` to sign in, select capabilities and register the card.
 5. Build and start Eve, then check a real chat from desktop.
 
-For an **existing Eve 0.63.0 project**, start at step 3 from its project directory.
+For an **existing Eve 0.66.0 project**, start at step 3 from its project directory.
 Do not run `eve init` over an existing agent. Preserve its model configuration and
 review any existing Eve channel before setup, as explained under Portal below.
 
@@ -40,14 +39,14 @@ npm --version
 
 The first command should report `v24.x`. Run the remaining commands as the account
 that will own the new agent project. For our deployment this account runs on
-Nucbox/Fedora N150. This package guide does not provision a VM or install AVMM.
+an AVMM guest on Neuu after the September23 migration. This package guide does not provision a VM or install AVMM.
 
 ## 2. Create a fresh Eve project
 
 Choose an unused project directory, outside any existing live agent:
 
 ```bash
-npx --yes eve@0.63.0 init tealbrick-agent --model openai/gpt-5.6-terra
+npx --yes eve@0.66.0 init tealbrick-agent --model openai/gpt-5.6-terra
 ```
 
 Finish scaffolding and return to the terminal before continuing. If Eve starts
@@ -55,7 +54,7 @@ Finish scaffolding and return to the terminal before continuing. If Eve starts
 
 ```bash
 cd tealbrick-agent
-npm install --save-exact eve@0.63.0 ai@7.0.105
+npm install --save-exact eve@0.66.0 ai@7.0.107
 ```
 
 Keep `package-lock.json` under version control.
@@ -82,7 +81,7 @@ Run this inside the Eve project created in step 2 (or your existing compatible
 project), not in an empty directory or as a global install:
 
 ```bash
-npm install --save-exact @tealbrick/kit@0.2.4
+npm install --save-exact @tealbrick/kit@0.2.7
 ```
 
 This installs Portal, AVM, Voice, Vision, Deliver and the shared provider transport
@@ -245,3 +244,15 @@ Restart the running Eve process after the rebuild. Deselecting a capability remo
 its kit-owned mounts. Setup refuses to overwrite hand-edited mounts. Saved settings
 and optional local secrets live under ignored `.tealbrick/`; secrets are not embedded
 in generated source. Disabling a capability does not revoke or delete its credentials.
+
+## Eve 0.66 deployment additions (suite 0.2.7)
+
+`tealbrick setup` now includes Persistent routines and Production self-evolution.
+Routines require an enrolled host bridge, scope and runtime token; setup mounts
+CRUD, production dispatch and desktop delivery together. Self-evolution requires
+an existing `deployment/*.ts` native Eve policy module outside the writable agent
+tree. Native proposals require the deployment's existing governed activation path.
+
+AVMM/guests migrated to Neuu on September23. Verify current canonical migration
+records before targeting either host. Do not create new canary agents. Committed
+source, npm publication and installed deployment are separate states.

package/README.md

@@ -1,4 +1,4 @@
-> Eve 0.63.0 is a candidate; the approved baseline remains Eve 0.58.1. Suite 0.2.4 is an unpublished compatibility candidate.
+> Eve 0.66.0 is the supported baseline. Suite 0.2.7 contains deployment fixes and is not yet published; npm latest remains 0.2.6.
 
 # @tealbrick/kit
 
@@ -6,16 +6,16 @@ One installation, explicitly selected capabilities. The kit includes the current
 implemented Portal, Voice, Vision, Deliver and AVM packages. Dependencies are code
 availability, not agent permissions. Nothing is mounted by installing the kit.
 
-Install inside an existing Eve 0.63.0 project:
+Install inside an existing Eve 0.66.0 project:
 
 ```sh
-npm install --save-exact @tealbrick/kit@0.2.4
+npm install --save-exact @tealbrick/kit@0.2.7
 npx --no-install tealbrick setup
 ```
 
 The suite is published on npm. The kit does not install, create or start Eve.
 Create the Eve project first and configure its primary-model authentication.
-Eve 0.63.0 and Node 24 are the validated host versions; VM provisioning remains
+Eve 0.66.0 and Node 24 are the validated host versions; VM provisioning remains
 host setup. After Teal Brick setup, build and start Eve to make the agent usable.
 
 See [BOOTSTRAP.md](BOOTSTRAP.md) for the complete deployment guide, including fresh-machine and existing-agent paths, provider prompts and verification.

package/dist/cli.js

@@ -37,6 +37,8 @@ async function main() {
             { name: 'Voice: live-session / STT / TTS endpoints', value: 'voice', checked: !!old.voice },
             { name: 'Vision API (native tool requires a trusted turn-auth adapter)', value: 'vision', checked: !!old.vision },
             { name: 'Deliver files to chat', value: 'deliver', checked: old.deliver !== undefined },
+            { name: 'Production self-evolution (requires deployment policy)', value: 'selfEvolution', checked: !!old.selfEvolution },
+            { name: 'Persistent routines, desktop management and AVMM wake', value: 'routines', checked: !!old.routines },
             { name: 'AVM inspection over SSH', value: 'avm', checked: !!old.avm },
         ] });
     const config = { version: 1 }, credentials = {};
@@ -95,6 +97,15 @@ async function main() {
                 delete config.avm.identityTokenFile;
         }
     }
+    if (selected.includes('selfEvolution'))
+        config.selfEvolution = { policyModule: await input({ message: 'Deployment policy module outside agent/ (deployment/name.ts)', default: old.selfEvolution?.policyModule }) };
+    if (selected.includes('routines')) {
+        const credentialRef = 'TEALBRICK_ROUTINE_BRIDGE_TOKEN';
+        const token = await password({ message: 'Host routine bridge token (blank keeps existing runtime secret)', mask: '*' });
+        if (token)
+            credentials[credentialRef] = token;
+        config.routines = { url: await input({ message: 'Enrolled host routine bridge URL including /routines', default: old.routines?.url }), credentialRef, scope: { org: login.org, workspace: workspaceId, agent: name, owner: await input({ message: 'Portal managing user ID (must match the host enrollment)', default: old.routines?.scope.owner }) }, buildCommand: JSON.parse(await input({ message: 'Build command JSON argv', default: JSON.stringify(old.routines?.buildCommand ?? ['npm', 'run', 'build']) })), restartCommand: JSON.parse(await input({ message: 'Operator-configured restart command JSON argv', default: old.routines ? JSON.stringify(old.routines.restartCommand) : undefined })) };
+    }
     console.log(JSON.stringify({ enabled: planKit(config).enabled, mounts: Object.keys(planKit(config).files) }, null, 2));
     if (!await confirm({ message: 'Apply settings and register this agent in the selected Portal workspace? Rebuild/restart Eve afterward.', default: false }))
         return;

package/dist/index.d.ts

@@ -1,6 +1,21 @@
 import { z } from 'zod';
 declare const schema: z.ZodObject<{
     version: z.ZodLiteral<1>;
+    selfEvolution: z.ZodOptional<z.ZodObject<{
+        policyModule: z.ZodString;
+    }, z.core.$strict>>;
+    routines: z.ZodOptional<z.ZodObject<{
+        url: z.ZodString;
+        credentialRef: z.ZodString;
+        scope: z.ZodObject<{
+            org: z.ZodString;
+            workspace: z.ZodString;
+            agent: z.ZodString;
+            owner: z.ZodString;
+        }, z.core.$strict>;
+        buildCommand: z.ZodTuple<[z.ZodString], z.ZodString>;
+        restartCommand: z.ZodTuple<[z.ZodString], z.ZodString>;
+    }, z.core.$strict>>;
     portal: z.ZodOptional<z.ZodObject<{
         issuer: z.ZodString;
         org: z.ZodString;
@@ -922,7 +937,7 @@ declare const schema: z.ZodObject<{
     }>>>;
 }, z.core.$strict>;
 export type KitConfig = z.input<typeof schema>;
-export declare const capabilities: readonly ["portal", "runtime", "voice", "vision", "deliver", "avm"];
+export declare const capabilities: readonly ["portal", "runtime", "voice", "vision", "deliver", "avm", "routines", "selfEvolution"];
 export interface MountPlan {
     enabled: string[];
     files: Record<string, string>;

package/dist/index.js

@@ -10,8 +10,10 @@ const auth = z.object({ issuer: z.string().url().refine(v => new URL(v).protocol
 const media = z.object({ settings: z.unknown(), authorizationModule: z.string().optional() }).strict();
 const ref = z.string().regex(/^TEALBRICK_[A-Z0-9_]+$/);
 const runtime = z.object({ issuer: z.string().url(), org: z.string().min(1), workspaceId: z.string().min(1), agentId: z.string().min(1), connectionId: z.string().min(1), credentialRef: ref, bindings: z.record(z.string(), z.object({ endpoint: z.string().url(), instanceId: z.string().min(1), companyId: z.string().min(1), credentialRef: ref }).strict()) }).strict();
-const schema = z.object({ version: z.literal(1), portal: auth.optional(), runtime: runtime.optional(), voice: media.optional(), vision: media.optional(), deliver: z.unknown().optional(), avm: z.custom(v => avmConfigSchema.safeParse(v).success).transform(v => 'target' in v ? { target: v.target, sudo: v.sudo ?? false, ...Object.fromEntries(Object.entries(v).filter(([k]) => k !== 'target' && k !== 'sudo')) } : v).optional() }).strict();
-export const capabilities = ['portal', 'runtime', 'voice', 'vision', 'deliver', 'avm'];
+const command = z.tuple([z.string().min(1)]).rest(z.string());
+const routines = z.object({ url: z.string().url(), credentialRef: ref, scope: z.object({ org: z.string().min(1), workspace: z.string().min(1), agent: z.string().min(1), owner: z.string().min(1) }).strict(), buildCommand: command, restartCommand: command }).strict();
+const schema = z.object({ version: z.literal(1), selfEvolution: z.object({ policyModule: z.string().regex(/^deployment\/[a-zA-Z0-9_-]+\.(ts|js|mjs)$/) }).strict().optional(), routines: routines.optional(), portal: auth.optional(), runtime: runtime.optional(), voice: media.optional(), vision: media.optional(), deliver: z.unknown().optional(), avm: z.custom(v => avmConfigSchema.safeParse(v).success).transform(v => 'target' in v ? { target: v.target, sudo: v.sudo ?? false, ...Object.fromEntries(Object.entries(v).filter(([k]) => k !== 'target' && k !== 'sudo')) } : v).optional() }).strict();
+export const capabilities = ['portal', 'runtime', 'voice', 'vision', 'deliver', 'avm', 'routines', 'selfEvolution'];
 const marker = '// Managed by @tealbrick/kit. Change selection with tealbrick setup.\n';
 const render = (body) => marker + body + '\n';
 const hash = (data) => createHash('sha256').update(data).digest('hex');
@@ -65,6 +67,25 @@ export function planKit(value) {
     }
     if (c.avm)
         files['agent/extensions/tealbrick-avm.ts'] = render(`import avm from '@tealbrick/avm/eve';\nexport default avm(${JSON.stringify(c.avm)});`);
+    if (c.selfEvolution) {
+        if (!c.portal)
+            throw Error('kit_evolution_requires_portal');
+        // Native deployed authoring policy lives outside the agent-authored tree.
+        const module = '../../' + c.selfEvolution.policyModule;
+        files['agent/extensions/tealbrick-self-evolution.ts'] = render(`import selfModification from 'eve/self-modification';\nimport policy from ${JSON.stringify(module)};\nexport default selfModification(policy);`);
+    }
+    if (c.routines) {
+        if (!c.portal || c.routines.scope.org !== c.portal.org || c.routines.scope.agent !== c.portal.agent)
+            throw Error('kit_routines_require_matching_portal');
+        const r = c.routines;
+        const endpoint = new URL(r.url);
+        if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.username || endpoint.password || endpoint.search || endpoint.hash)
+            throw Error('kit_invalid_routine_endpoint');
+        files['agent/lib/tealbrick-routines.ts'] = render(`import {createRoutineClient} from '@tealbrick/avm/routines-client';\nimport {runtimeSecret} from '@tealbrick/kit/secrets';\nexport const scope=${JSON.stringify(r.scope)};\nexport const bridge=createRoutineClient({url:${JSON.stringify(r.url)},token:async()=>{const token=await runtimeSecret(${JSON.stringify(r.credentialRef)});if(!token)throw Error('routine_credential_missing');return token;}});`);
+        files['agent/tools/tealbrick_routines.ts'] = render(`import {routineTool} from '@tealbrick/avm/routines-eve';\nimport {bridge,scope} from '../lib/tealbrick-routines';\nexport default routineTool({bridge,scope});`);
+        files['agent/channels/management.ts'] = render(`import {managementChannel} from '@tealbrick/portal/management/eve';\nimport {bridge,scope} from '../lib/tealbrick-routines';\nexport default managementChannel({auth:${JSON.stringify(c.portal)},appRoot:process.cwd(),routines:{owner:scope.owner,call:(action,input)=>bridge.call(action,input)},buildCommand:${JSON.stringify(r.buildCommand)},restartCommand:${JSON.stringify(r.restartCommand)}});`);
+        files['agent/schedules/tealbrick-routines.ts'] = render(`import {routineDispatcher} from '@tealbrick/avm/routines-eve';\nimport {bridge} from '../lib/tealbrick-routines';\nimport delivery from '../channels/management';\nexport default routineDispatcher({bridge,delivery});`);
+    }
     return { enabled: capabilities.filter(k => c[k] !== undefined), files };
 }
 async function optional(path) { try {
@@ -128,6 +149,11 @@ export async function applyKit(root, config, credentials = {}) {
             else if (content !== null)
                 throw Error(`kit_mount_conflict:${name}`);
         }
+        if (config.selfEvolution) {
+            const path = await safe(root, config.selfEvolution.policyModule);
+            if (await optional(path) === null)
+                throw Error('kit_evolution_policy_module_missing');
+        }
         if (config.vision?.authorizationModule) {
             const path = await safe(root, config.vision.authorizationModule);
             if (await optional(path) === null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tealbrick/kit",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "type": "module",
   "license": "MIT",
   "description": "Complete Teal Brick package kit with explicit Eve capability activation",
@@ -37,11 +37,11 @@
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
-    "@tealbrick/portal": "0.2.6",
-    "@tealbrick/avm": "0.2.6",
-    "@tealbrick/voice": "0.2.6",
-    "@tealbrick/vision": "0.2.6",
-    "@tealbrick/deliver": "0.2.6",
+    "@tealbrick/portal": "0.2.7",
+    "@tealbrick/avm": "0.2.7",
+    "@tealbrick/voice": "0.2.7",
+    "@tealbrick/vision": "0.2.7",
+    "@tealbrick/deliver": "0.2.7",
     "@inquirer/prompts": "8.7.2",
     "zod": "^4.0.0"
   },