@tealbrick/kit 0.2.7 → 0.3.0-rc.10

package/dist/native.js

@@ -0,0 +1,193 @@
+import { resolve } from 'node:path';
+import { guidedNativeSetup, nativeSdkConfig } from './native-setup.js';
+import { applyKit, readKit } from './index.js';
+import { deviceLabel, loginPortal, portalOrigin } from './onboarding.js';
+import { PortalHttpError } from '@tealbrick/portal';
+import { RuntimeConnector } from '@tealbrick/portal/runtime';
+import { MarketplaceRuntimeConnector } from '@tealbrick/portal/marketplace-runtime';
+import { serveMcp } from '@tealbrick/portal/mcp';
+import { runtimeSecret } from './secrets.js';
+const harnesses = { claude: 'Claude Agent SDK', codex: 'Codex', langchain: 'LangChain' };
+/** Enroll an existing, accurately labelled owned card. Registration belongs to Portal. */
+export async function setupNative(root, input, login) {
+    if (!Object.hasOwn(harnesses, input.harness))
+        throw Error('kit_native_harness_required');
+    if (!login.workspaces.some(w => w.id === input.workspaceId))
+        throw Error('kit_portal_workspace_required');
+    const old = await readKit(root);
+    if (old.runtime && (old.runtime.issuer !== login.issuer || old.runtime.org !== login.org || old.runtime.workspaceId !== input.workspaceId || old.runtime.agentId !== input.agentId))
+        throw Error('kit_runtime_existing_binding_mismatch');
+    if (old.native && old.native.harness !== input.harness)
+        throw Error('kit_native_harness_mismatch');
+    if (old.portal || old.voice || old.vision || old.deliver !== undefined || old.avm || old.routines || old.selfEvolution || old.runtime && !old.native)
+        throw Error('kit_native_eve_configuration_conflict');
+    const snapshot = await login.client.request('/api/workspace?workspaceId=' + encodeURIComponent(input.workspaceId));
+    const agent = snapshot.agents?.find((a) => a.id === input.agentId && a.bindable);
+    const node = snapshot.draft?.nodes?.find((n) => n.id === input.nodeId && n.data?.agentId === input.agentId && n.data.kind === 'agent');
+    if (snapshot.workspace?.id !== input.workspaceId || !agent || !node)
+        throw Error('kit_owned_agent_card_required');
+    if (agent.runtime !== harnesses[input.harness] || node.data.harness !== harnesses[input.harness])
+        throw Error('kit_native_portal_harness_mismatch');
+    const enrolled = await login.client.request('/api/runtime/connections', { workspaceId: input.workspaceId, nodeId: input.nodeId, agentId: input.agentId });
+    if (!enrolled.connectionId || !enrolled.credential || !Number.isFinite(enrolled.expiresAt) || enrolled.expiresAt <= Date.now())
+        throw Error('kit_runtime_enrollment_failed');
+    await applyKit(root, { version: 1, native: { harness: input.harness, active: true, ...(old.native?.marketplace === undefined ? {} : { marketplace: old.native.marketplace }) }, runtime: { issuer: login.issuer, org: login.org, workspaceId: input.workspaceId, agentId: input.agentId, connectionId: enrolled.connectionId, credentialRef: 'TEALBRICK_RUNTIME_CREDENTIAL', bindings: old.runtime?.bindings ?? {} } }, { TEALBRICK_RUNTIME_CREDENTIAL: enrolled.credential });
+    return { connected: true, agentId: input.agentId, connectionId: enrolled.connectionId, harness: input.harness };
+}
+/** A fresh connector per invocation rechecks Portal and local activation. No authorization cache
+ * survives MCP reconnect, local deactivation or a request boundary. No session is created here. */
+export function nativeConnector() {
+    async function current() {
+        const config = await readKit(process.cwd());
+        if (!config.native?.active || !config.runtime)
+            throw Error('runtime_product_inactive');
+        const { credentialRef, ...runtime } = config.runtime;
+        return new RuntimeConnector({ ...runtime, credential: () => runtimeSecret(credentialRef), resolveCredential: runtimeSecret });
+    }
+    return { marketplace: async () => { const config = await readKit(process.cwd()); if (!config.native?.active || !config.native.marketplace || !config.runtime)
+            return undefined; const { credentialRef, ...identity } = config.runtime; return new MarketplaceRuntimeConnector({ ...identity, credential: () => runtimeSecret(credentialRef) }); }, capabilities: async () => (await current()).capabilities(true), call: async (registrationId, operation, input = {}, signal) => (await current()).call(registrationId, operation, input, signal) };
+}
+/** serve/enroll take boolean switches, so they are parsed separately from setup flags. */
+function serveFlags(args, values, switches) {
+    const flags = {};
+    for (let i = 0; i < args.length; i++) {
+        const name = /^--([a-z-]+)$/.exec(args[i])?.[1];
+        if (!name || flags[name] !== undefined)
+            throw Error('kit_native_invalid_arguments');
+        if (switches.includes(name)) {
+            flags[name] = true;
+            continue;
+        }
+        if (!values.includes(name) || !args[i + 1] || args[i + 1].startsWith('--'))
+            throw Error('kit_native_invalid_arguments');
+        flags[name] = args[++i];
+    }
+    return flags;
+}
+export const nativeUsage = 'Usage: tealbrick native setup --harness claude|codex|langchain [--workspace-name NAME | --create-workspace NAME] [--agent-name NAME | --create-agent NAME] [--issuer HTTPS_ORIGIN] | native mcp [--root DIRECTORY] | native serve [--root DIRECTORY] [--install-launchd [--no-load] | --uninstall] | native enroll --url HTTPS_ORIGIN [--port PORT] [--root DIRECTORY] [--skip-endpoint-check] | native acp [--root DIRECTORY] [--buzz-cli PATH] | native enable|disable | native marketplace-enable|marketplace-disable';
+export async function nativeCommand(args, root) {
+    if (args[0] === 'acp') {
+        const flags = serveFlags(args.slice(1), ['root', 'buzz-cli'], []);
+        if (typeof flags.root === 'string') {
+            root = resolve(flags.root);
+            process.chdir(root);
+        }
+        const { serveAcp } = await import('./native-acp.js');
+        await serveAcp(root, typeof flags['buzz-cli'] === 'string' ? { buzzCli: resolve(flags['buzz-cli']) } : {});
+        return;
+    }
+    if (args[0] === 'serve' || args[0] === 'enroll') {
+        const flags = args[0] === 'serve' ? serveFlags(args.slice(1), ['root'], ['install-launchd', 'uninstall', 'no-load']) : serveFlags(args.slice(1), ['root', 'url', 'port'], ['skip-endpoint-check']);
+        if (typeof flags.root === 'string') {
+            root = resolve(flags.root);
+            process.chdir(root);
+        }
+        if (args[0] === 'serve') {
+            const { serveNative, installLaunchd, uninstallLaunchd } = await import('./native-serve.js');
+            if (flags['install-launchd'] && flags.uninstall)
+                throw Error('kit_native_invalid_arguments');
+            if (flags.uninstall) {
+                console.log(JSON.stringify(await uninstallLaunchd(root)));
+                return;
+            }
+            if (flags['install-launchd']) {
+                console.log(JSON.stringify(await installLaunchd(root, { load: !flags['no-load'] })));
+                return;
+            }
+            if (flags['no-load'])
+                throw Error('kit_native_invalid_arguments');
+            await serveNative(root);
+            return;
+        }
+        if (typeof flags.url !== 'string')
+            throw Error('kit_native_public_url_required');
+        const { enrollNative } = await import('./native-enroll.js');
+        const state = await readKit(root);
+        if (!state.native || !state.runtime)
+            throw Error('kit_native_setup_required');
+        const login = await loginPortal(portalOrigin(state.runtime.issuer), (url, code) => console.error(`Approve Tealbrick endpoint registration: ${url}\nCode: ${code}`), { label: deviceLabel('native enroll', root) });
+        try {
+            const result = await enrollNative(root, { url: flags.url, ...(typeof flags.port === 'string' ? { port: Number(flags.port) } : {}) }, login, { verifyEndpoint: !flags['skip-endpoint-check'] });
+            console.log(JSON.stringify(result));
+            if (!flags['skip-endpoint-check'] && !result.endpointVerified) {
+                console.error('Portal registration is saved. Start `tealbrick native serve` and the HTTPS proxy, then re-run enroll to verify the endpoint.');
+                process.exitCode = 2;
+            }
+        }
+        catch (error) {
+            if (error instanceof PortalHttpError && /^[a-z_]+$/.test(error.code ?? ''))
+                throw Error('kit_portal_' + error.code);
+            throw error;
+        }
+        return;
+    }
+    const command = args[0], flags = {};
+    // A bare `tealbrick native` or help request prints usage; it is not a failed setup.
+    if (!command || command === 'help' || command === '--help' || command === '-h') {
+        console.log(nativeUsage);
+        return;
+    }
+    for (let i = 1; i < args.length; i += 2) {
+        if (!/^--(root|harness|workspace|workspace-name|create-workspace|node|agent|agent-name|create-agent|delegation|issuer)$/.test(args[i]) || !args[i + 1] || flags[args[i].slice(2)])
+            throw Error('kit_native_invalid_arguments');
+        flags[args[i].slice(2)] = args[i + 1];
+    }
+    if (flags.root) {
+        root = resolve(flags.root);
+        process.chdir(root);
+    }
+    if (command === 'setup') {
+        if (flags.harness && !Object.hasOwn(harnesses, flags.harness))
+            throw Error('kit_native_harness_required');
+        if (!flags.harness)
+            throw Error('kit_native_harness_required');
+        if (flags.harness === 'codex' && flags.delegation !== 'disabled') {
+            const { confirm } = await import('@inquirer/prompts');
+            if (flags.delegation || !await confirm({ message: 'This Codex Tealbrick profile requires native delegation disabled until scoped child grants are supported. Continue with delegation disabled?', default: false }))
+                throw Error('kit_native_codex_delegation_opt_in_required');
+            flags.delegation = 'disabled';
+        }
+        const issuer = portalOrigin(flags.issuer ?? 'https://portal.tealbrick.com');
+        const login = await loginPortal(issuer, (url, code) => console.error(`Approve Tealbrick setup: ${url}\nCode: ${code}`), { label: deviceLabel(`native setup (${flags.harness})`, root) });
+        const { select, input } = await import('@inquirer/prompts');
+        try {
+            console.log(JSON.stringify(await guidedNativeSetup(root, flags, login, { choose: (message, choices) => select({ message, choices }), name: message => input({ message }) })));
+        }
+        catch (error) {
+            if (error instanceof PortalHttpError && /^[a-z_]+$/.test(error.code ?? ''))
+                throw Error('kit_portal_' + error.code);
+            throw error;
+        }
+        return;
+    }
+    if (command === 'config') {
+        const state = await readKit(root);
+        if (!state.native)
+            throw Error('kit_native_setup_required');
+        console.log(JSON.stringify(nativeSdkConfig(state.native.harness, root, { codexDelegationDisabled: flags.delegation === 'disabled' }), null, 2));
+        return;
+    }
+    if (command === 'mcp') {
+        await serveMcp(nativeConnector());
+        return;
+    }
+    if (command === 'marketplace-enable' || command === 'marketplace-disable') {
+        const old = await readKit(root);
+        if (!old.native)
+            throw Error('kit_native_setup_required');
+        await applyKit(root, { ...old, native: { ...old.native, marketplace: command === 'marketplace-enable' } });
+        console.log(JSON.stringify({ marketplace: command === 'marketplace-enable' }));
+        return;
+    }
+    if (command === 'disable' || command === 'enable') {
+        const old = await readKit(root);
+        if (!old.native)
+            throw Error('kit_native_setup_required');
+        await applyKit(root, { ...old, native: { ...old.native, active: command === 'enable' } });
+        console.log(JSON.stringify({ active: command === 'enable' }));
+        return;
+    }
+    console.error(nativeUsage);
+    process.exitCode = 2;
+}
+export { guidedNativeSetup, nativeSdkConfig };

package/dist/onboarding.d.ts

@@ -1,5 +1,6 @@
 import { PortalClient } from '@tealbrick/portal';
 export interface PortalLogin {
+    issuer: string;
     client: PortalClient;
     org: string;
     userId: string;
@@ -7,15 +8,23 @@ export interface PortalLogin {
         id: string;
         name: string;
     }>;
+    /** Ephemeral user identity for endpoint verification. Never persisted. */
+    identity?: {
+        token: string;
+        bundle: string;
+    };
 }
 /** Reject URLs that would leak credentials or be silently truncated by registration. */
 export declare function portalOrigin(value: string): string;
 export declare function agentOrigin(value: string): string;
 /** Device authorization is interactive; user/refresh tokens never enter kit state. */
+/** Label shown in Portal → Connected access: purpose, host and kit folder, so owners can tell devices apart (portal-core#15). */
+export declare function deviceLabel(purpose: string, root?: string, host?: string): string;
 export declare function loginPortal(issuer: string, show: (url: string, code: string) => void, options?: {
     fetch?: typeof fetch;
     sleep?: (ms: number) => Promise<void>;
     now?: () => number;
+    label?: string;
 }): Promise<PortalLogin>;
 /** Reuse Portal's owned registration + revision-checked canvas APIs, not a parallel card store. */
 export declare function registerPortalCard(login: PortalLogin, input: {

package/dist/onboarding.js

@@ -1,4 +1,6 @@
 import { randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
+import { basename } from 'node:path';
 import { PortalClient, PortalHttpError } from '@tealbrick/portal';
 /** Reject URLs that would leak credentials or be silently truncated by registration. */
 export function portalOrigin(value) {
@@ -14,10 +16,15 @@ export function agentOrigin(value) {
     return url.origin;
 }
 /** Device authorization is interactive; user/refresh tokens never enter kit state. */
+/** Label shown in Portal → Connected access: purpose, host and kit folder, so owners can tell devices apart (portal-core#15). */
+export function deviceLabel(purpose, root = process.cwd(), host = hostname()) {
+    const folder = basename(root) || root;
+    return `Teal Brick ${purpose} · ${host.replace(/\.local$/, '')} · ${folder}`.replace(/[\u0000-\u001f]/g, '').slice(0, 120);
+}
 export async function loginPortal(issuer, show, options = {}) {
     issuer = portalOrigin(issuer);
     const client = new PortalClient({ issuer, fetch: options.fetch });
-    const device = await client.startDevice({ deviceId: randomUUID(), deviceLabel: 'Teal Brick package setup' });
+    const device = await client.startDevice({ deviceId: randomUUID(), deviceLabel: options.label ?? deviceLabel('setup') });
     const verification = new URL(device.verification_uri_complete);
     if (verification.origin !== issuer || verification.username || verification.password)
         throw Error('kit_portal_verification_origin_mismatch');
@@ -53,7 +60,7 @@ export async function loginPortal(issuer, show, options = {}) {
     const directory = await authenticated.request('/api/me/workspaces');
     if (!account.user?.id || !account.user.orgId || directory.accountId !== account.user.id || directory.organizationId !== account.user.orgId || !Array.isArray(directory.workspaces) || directory.workspaces.some(w => !w.id || !w.name))
         throw Error('kit_portal_account_mismatch');
-    return { client: authenticated, org: account.user.orgId, userId: account.user.id, workspaces: directory.workspaces };
+    return { issuer, client: authenticated, org: account.user.orgId, userId: account.user.id, workspaces: directory.workspaces, identity: { token: session.token, bundle: session.bundle } };
 }
 /** Reuse Portal's owned registration + revision-checked canvas APIs, not a parallel card store. */
 export async function registerPortalCard(login, input) {

package/dist/runtime-onboarding.js

@@ -1,6 +1,6 @@
 import { password } from '@inquirer/prompts';
 import { createHash } from 'node:crypto';
-import { loginPortal, portalOrigin } from './onboarding.js';
+import { deviceLabel, loginPortal, portalOrigin } from './onboarding.js';
 import { readKit, applyKit } from './index.js';
 function flags(args) { const out = {}; for (let i = 0; i < args.length; i += 2) {
     if (!/^--[a-z]+$/.test(args[i]) || !args[i + 1] || args[i + 1].startsWith('--'))
@@ -37,7 +37,7 @@ finally {
 export async function runtimeOnboarding(command, args, root) {
     const f = flags(args), old = await readKit(root), issuer = portalOrigin(f.issuer ?? old.portal?.issuer ?? 'https://portal.tealbrick.com');
     const workspaceId = required(f, 'workspace'), nodeId = required(f, 'node');
-    const login = await loginPortal(issuer, (url, code) => console.log(`Approve this customer runtime in Portal: ${url}\nCode: ${code}`));
+    const login = await loginPortal(issuer, (url, code) => console.log(`Approve this customer runtime in Portal: ${url}\nCode: ${code}`), { label: deviceLabel(`runtime ${command}`, root) });
     if (!login.workspaces.some(w => w.id === workspaceId))
         throw Error('kit_portal_workspace_required');
     if (command === 'connect') {
@@ -50,7 +50,7 @@ export async function runtimeOnboarding(command, args, root) {
         const runtime = { issuer, org: login.org, workspaceId, agentId, connectionId: enrolled.connectionId, credentialRef: 'TEALBRICK_RUNTIME_CREDENTIAL', bindings: old.runtime?.bindings ?? {} };
         await applyKit(root, { ...old, runtime }, { TEALBRICK_RUNTIME_CREDENTIAL: enrolled.credential });
         console.log(JSON.stringify({ connectionId: enrolled.connectionId, workspaceId, agentId, expiresAt: enrolled.expiresAt, requiresReload: true }));
-        console.log('Connected. Customer-side tools are mounted; rebuild/restart Eve. Claim a licensed Knowledge instance and set its local binding before calling it.');
+        console.log(old.native ? 'Connected. Native MCP will reload the current connection on each call.' : 'Connected. Customer-side tools are mounted; rebuild/restart Eve.');
         return;
     }
     if (!old.runtime || old.runtime.issuer !== issuer || old.runtime.workspaceId !== workspaceId || old.runtime.org !== login.org)

package/dist/secrets.d.ts

@@ -1,3 +1,4 @@
-export declare function runtimeSecret(name: string): string;
+/** Reads from the environment, then the kit root's private credentials file (cwd unless `root` is given). */
+export declare function runtimeSecret(name: string, root?: string): string;
 /** Lazy: does not read credentials during discovery/build or for unused providers. */
 export declare function secretEnvironment(): NodeJS.ProcessEnv;

package/dist/secrets.js

@@ -1,12 +1,14 @@
 import { readFileSync, lstatSync } from 'node:fs';
+import { join } from 'node:path';
 const namePattern = /^TEALBRICK_[A-Z0-9_]+$/;
-export function runtimeSecret(name) {
+/** Reads from the environment, then the kit root's private credentials file (cwd unless `root` is given). */
+export function runtimeSecret(name, root) {
     if (!namePattern.test(name))
         throw Error('kit_invalid_secret_reference');
     let value = process.env[name];
     if (!value) {
         try {
-            const path = '.tealbrick/kit.credentials.json', stat = lstatSync(path);
+            const path = root === undefined ? '.tealbrick/kit.credentials.json' : join(root, '.tealbrick', 'kit.credentials.json'), stat = lstatSync(path);
             if (!stat.isFile() || stat.isSymbolicLink() || (process.platform !== 'win32' && (stat.mode & 0o077)))
                 throw Error('kit_secret_permissions');
             const data = JSON.parse(readFileSync(path, 'utf8'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tealbrick/kit",
-  "version": "0.2.7",
+  "version": "0.3.0-rc.10",
   "type": "module",
   "license": "MIT",
   "description": "Complete Teal Brick package kit with explicit Eve capability activation",
@@ -13,7 +13,10 @@
     "LICENSE",
     "NOTICE",
     "BOOTSTRAP.md",
-    "RUNTIME.md"
+    "RUNTIME.md",
+    "NATIVE.md",
+    "BUZZ.md",
+    "assets"
   ],
   "bin": {
     "tealbrick": "dist/cli.js"
@@ -30,23 +33,28 @@
     "./secrets": {
       "types": "./dist/secrets.d.ts",
       "import": "./dist/secrets.js"
-    }
+    },
+    "./native": {
+      "types": "./dist/native.d.ts",
+      "import": "./dist/native.js"
+    },
+    "./cli": "./dist/cli.js"
   },
   "scripts": {
     "build": "npm run build --workspace @tealbrick/provider-transport --workspace @tealbrick/portal --workspace @tealbrick/voice --workspace @tealbrick/vision --workspace @tealbrick/deliver --workspace @tealbrick/avm && tsc -p tsconfig.json",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
-    "@tealbrick/portal": "0.2.7",
-    "@tealbrick/avm": "0.2.7",
-    "@tealbrick/voice": "0.2.7",
-    "@tealbrick/vision": "0.2.7",
-    "@tealbrick/deliver": "0.2.7",
+    "@tealbrick/portal": "0.3.0-rc.10",
+    "@tealbrick/avm": "0.3.0-rc.10",
+    "@tealbrick/voice": "0.3.0-rc.10",
+    "@tealbrick/vision": "0.3.0-rc.10",
+    "@tealbrick/deliver": "0.3.0-rc.10",
     "@inquirer/prompts": "8.7.2",
     "zod": "^4.0.0"
   },
   "peerDependencies": {
-    "eve": ">=0.66.0 <0.67.0"
+    "eve": ">=0.70.0 <0.71.0"
   },
   "peerDependenciesMeta": {
     "eve": {
@@ -59,6 +67,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.org"
+    "registry": "https://registry.npmjs.org",
+    "tag": "next"
   }
 }