@tealbrick/kit 0.3.0-rc.1 → 0.3.0-rc.3

package/BOOTSTRAP.md

@@ -1,4 +1,4 @@
-> Prerelease 0.3.0-rc.1 targets fresh Eve 0.70 installations. Use the explicit candidate version or `next` tag after publication. Stable `latest` remains 0.2.7 for existing Eve 0.66 installations; durable cross-version session migration is not validated.
+> Prerelease 0.3.0-rc.2 targets fresh Eve 0.70 installations. Use the explicit candidate version or `next` tag after publication. Scoped `@tealbrick/*` `latest` remains 0.2.7 for existing Eve 0.66 installations; durable cross-version session migration is not validated.
 
 # Deployment guide: Eve agent + Teal Brick kit
 
@@ -19,7 +19,7 @@ For a fresh machine, the sequence is:
 
 1. Install Node 24 and npm.
 2. Create an Eve 0.70.0 project and configure its primary model credentials.
-3. Install `@tealbrick/kit@0.3.0-rc.1` inside that project.
+3. Install `@tealbrick/kit@0.3.0-rc.2` inside that project.
 4. Run `tealbrick setup` to sign in, select capabilities and register the card.
 5. Build and start Eve, then check a real chat from desktop.
 
@@ -81,7 +81,7 @@ Run this inside the Eve project created in step 2 (or your existing compatible
 project), not in an empty directory or as a global install:
 
 ```bash
-npm install --save-exact @tealbrick/kit@0.3.0-rc.1
+npm install --save-exact @tealbrick/kit@0.3.0-rc.2
 ```
 
 This installs Portal, AVM, Voice, Vision, Deliver and the shared provider transport

package/NATIVE.md

@@ -1,10 +1,10 @@
 # Native agent setup — Stage A candidate
 
-Prerelease suite **0.3.0-rc.1** targets the `next` tag. Stable npm latest remains 0.2.7, which lacks this flow. The `tealbrick` facade forwards the existing kit CLI; it is not another SDK. Matching Portal runtime setup endpoints must be deployed before native onboarding can succeed.
+Prerelease suite **0.3.0-rc.2** targets the `next` tag. The seven scoped `@tealbrick/*` packages keep `latest` at 0.2.7, which lacks this flow. The unscoped `tealbrick` facade currently serves RC1 on both `latest` and `next`; RC2 will initially target `next`, with facade `latest` moved only after registry verification. The `tealbrick` facade forwards the existing kit CLI; it is not another SDK. Matching Portal runtime setup endpoints must be deployed before native onboarding can succeed.
 
 ## Install and connect
 
-Install the review tarballs with the supplied checksum-verifying `install-candidate.mjs`. Once the release is actually published, the intended installation is `npm install --save-exact tealbrick@0.3.0-rc.1`. Today that registry command is not a tested installation path.
+Install the review tarballs with the supplied checksum-verifying `install-candidate.mjs`. Once the release is actually published, the intended installation is `npm install --save-exact tealbrick@0.3.0-rc.2`. RC1 registry installation and live Foxy onboarding have been verified separately. The RC2 command below requires RC2 publication and registry verification; it is not yet a published installation path.
 
 From your native agent workspace:
 
@@ -75,3 +75,9 @@ Each request reloads local activation and fetches signed Portal authorization. R
 ## Acceptance boundary
 
 Disposable installed-artifact tests cover empty-account creation, named selection, permission/ambiguity denial, lost-response retry, signed config, scoped Knowledge-fixture read, revoke/reconnect, deactivation and MCP cancellation. They are not real browser consent or real Knowledge product proof. Root's separate Foxy receipt proves the earlier packed candidate's live Claude MCP inactive denial, exact-session process restart and compaction. Codex and LangChain have independent narrower fixture evidence, not live-provider parity. Marketplace, voice/vision and delegated Tealbrick grants are outside this Stage A claim.
+
+## Name conflicts and interrupted setup
+
+Existing cards are shown with their harness. A card for Eve cannot be converted to Claude by choosing its name. If a name is already used, select an explicitly compatible card or choose another name; setup keeps the approved login during this interaction. Duplicate compatible names require selecting the exact card ID.
+
+A definitive Portal name-conflict rejection permits changing the proposed identity. A timeout or lost response does not: the private journal keeps the original request and idempotency key. Repeat `tealbrick setup --harness <harness>` without new identity-selection flags to reconcile that request. Changing an uncertain request fails with `kit_native_setup_pending_intent_mismatch`; do not delete the journal to bypass it.

package/README.md

@@ -1,4 +1,4 @@
-> Prerelease 0.3.0-rc.1 targets fresh Eve 0.70 installations. Use the explicit candidate version or `next` tag after publication. Stable `latest` remains 0.2.7 for existing Eve 0.66 installations; durable cross-version session migration is not validated.
+> Prerelease 0.3.0-rc.2 targets fresh Eve 0.70 installations. Use the explicit candidate version or `next` tag after publication. Scoped `@tealbrick/*` `latest` remains 0.2.7 for existing Eve 0.66 installations; durable cross-version session migration is not validated.
 
 # @tealbrick/kit
 
@@ -9,7 +9,7 @@ availability, not agent permissions. Nothing is mounted by installing the kit.
 Install inside an existing Eve 0.70.0 project:
 
 ```sh
-npm install --save-exact @tealbrick/kit@0.3.0-rc.1
+npm install --save-exact @tealbrick/kit@0.3.0-rc.2
 npx --no-install tealbrick setup
 ```
 

package/dist/index.d.ts

@@ -8,6 +8,7 @@ declare const schema: z.ZodObject<{
             langchain: "langchain";
         }>;
         active: z.ZodBoolean;
+        marketplace: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
     selfEvolution: z.ZodOptional<z.ZodObject<{
         policyModule: z.ZodString;

package/dist/index.js

@@ -12,7 +12,7 @@ const ref = z.string().regex(/^TEALBRICK_[A-Z0-9_]+$/);
 const runtime = z.object({ issuer: z.string().url(), org: z.string().min(1), workspaceId: z.string().min(1), agentId: z.string().min(1), connectionId: z.string().min(1), credentialRef: ref, bindings: z.record(z.string(), z.object({ endpoint: z.string().url(), instanceId: z.string().min(1), companyId: z.string().min(1), credentialRef: ref }).strict()) }).strict();
 const command = z.tuple([z.string().min(1)]).rest(z.string());
 const routines = z.object({ url: z.string().url(), credentialRef: ref, scope: z.object({ org: z.string().min(1), workspace: z.string().min(1), agent: z.string().min(1), owner: z.string().min(1) }).strict(), buildCommand: command, restartCommand: command }).strict();
-const schema = z.object({ version: z.literal(1), native: z.object({ harness: z.enum(['claude', 'codex', 'langchain']), active: z.boolean() }).strict().optional(), selfEvolution: z.object({ policyModule: z.string().regex(/^deployment\/[a-zA-Z0-9_-]+\.(ts|js|mjs)$/) }).strict().optional(), routines: routines.optional(), portal: auth.optional(), runtime: runtime.optional(), voice: media.optional(), vision: media.optional(), deliver: z.unknown().optional(), avm: z.custom(v => avmConfigSchema.safeParse(v).success).transform(v => 'target' in v ? { target: v.target, sudo: v.sudo ?? false, ...Object.fromEntries(Object.entries(v).filter(([k]) => k !== 'target' && k !== 'sudo')) } : v).optional() }).strict();
+const schema = z.object({ version: z.literal(1), native: z.object({ harness: z.enum(['claude', 'codex', 'langchain']), active: z.boolean(), marketplace: z.boolean().optional() }).strict().optional(), selfEvolution: z.object({ policyModule: z.string().regex(/^deployment\/[a-zA-Z0-9_-]+\.(ts|js|mjs)$/) }).strict().optional(), routines: routines.optional(), portal: auth.optional(), runtime: runtime.optional(), voice: media.optional(), vision: media.optional(), deliver: z.unknown().optional(), avm: z.custom(v => avmConfigSchema.safeParse(v).success).transform(v => 'target' in v ? { target: v.target, sudo: v.sudo ?? false, ...Object.fromEntries(Object.entries(v).filter(([k]) => k !== 'target' && k !== 'sudo')) } : v).optional() }).strict();
 export const capabilities = ['portal', 'runtime', 'voice', 'vision', 'deliver', 'avm', 'routines', 'selfEvolution'];
 const marker = '// Managed by @tealbrick/kit. Change selection with tealbrick setup.\n';
 const render = (body) => marker + body + '\n';

package/dist/native-selection.js

@@ -37,6 +37,8 @@ export async function selectNativeIdentity(root, flags, login, prompts) {
     if (workspaceName && flags.node)
         throw Error('kit_native_existing_node_requires_workspace');
     const cards = directory.agents.filter(a => a.harness === harness).map(agent => ({ agent }));
+    const unavailable = directory.agents.filter(a => a.harness !== harness).map(a => `${a.name} (${a.harness})`);
+    const context = unavailable.length ? ` Unavailable for ${harness}: ${unavailable.join(', ')}. Existing cards cannot be converted.` : '';
     let agentId = flags.agent;
     if (flags['agent-name']) {
         const matches = cards.filter((c) => c.agent.name === flags['agent-name']);
@@ -48,9 +50,9 @@ export async function selectNativeIdentity(root, flags, login, prompts) {
         agentId = old.runtime.agentId;
     let name = flags['create-agent'];
     if (!agentId && !name) {
-        const choice = cards.length ? await prompts.choose('Choose an agent to attach', [...cards.map((c) => ({ name: `${c.agent.name} (${c.agent.id})`, value: c.agent.id })), { name: 'Create an agent', value: '__create__' }]) : '__create__';
+        const choice = cards.length ? await prompts.choose('Choose an agent to attach.' + context, [...cards.map((c) => ({ name: `${c.agent.name} — ${c.agent.harness} (${c.agent.id})`, value: c.agent.id })), { name: 'Create an agent', value: '__create__' }]) : '__create__';
         if (choice === '__create__')
-            name = await prompts.name('New agent name');
+            name = await prompts.name('New agent name.' + context);
         else {
             const card = cards.find((c) => c.agent.id === choice);
             if (!card)
@@ -58,8 +60,21 @@ export async function selectNativeIdentity(root, flags, login, prompts) {
             agentId = card.agent.id;
         }
     }
-    if (name)
-        return { workspace, agent: { name: validName(name) } };
+    while (name) {
+        name = validName(name);
+        const conflicts = directory.agents.filter(a => a.name === name);
+        if (!conflicts.length)
+            return { workspace, agent: { name } };
+        const choice = await prompts.choose(`The name "${name}" already belongs to ${conflicts.map(a => `${a.name} (${a.harness}, ${a.id})`).join(', ')}. Select a compatible ${harness} card or choose another name.`, [...cards.map(c => ({ name: `${c.agent.name} — ${c.agent.harness} (${c.agent.id})`, value: c.agent.id })), { name: 'Choose another name', value: '__create__' }]);
+        if (choice === '__create__') {
+            name = await prompts.name('Different agent name.' + context);
+            continue;
+        }
+        if (!cards.some(c => c.agent.id === choice))
+            throw Error('kit_owned_agent_card_required');
+        agentId = choice;
+        name = undefined;
+    }
     const matches = cards.filter((c) => c.agent.id === agentId);
     if (matches.length !== 1)
         throw Error('kit_owned_agent_card_required');

package/dist/native-setup.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { mkdir, lstat, readFile, writeFile, rename, unlink, realpath } from 'node:fs/promises';
+import { PortalHttpError } from '@tealbrick/portal';
 import { readKit } from './index.js';
 import { selectNativeIdentity, harnessLabels } from './native-selection.js';
 import { setupNative } from './native.js';
@@ -66,26 +67,48 @@ export async function guidedNativeSetup(root, flags, login, prompts) {
         const stamp = { issuer: login.issuer, org: login.org, userId: login.userId, harness };
         if (journal && JSON.stringify(journal.stamp) !== JSON.stringify(stamp))
             throw Error('kit_native_setup_account_mismatch');
-        const explicit = ['workspace', 'workspace-name', 'create-workspace', 'agent', 'node', 'agent-name', 'create-agent'].some(key => flags[key]);
-        let request = journal && !explicit ? journal.request : undefined;
-        if (!request) {
-            const chosen = await selectNativeIdentity(root, flags, login, prompts);
-            const agent = 'id' in chosen.agent ? { mode: 'attach', id: chosen.agent.id, harness: harnessLabels[harness] } : { mode: 'create', name: chosen.agent.name, harness: harnessLabels[harness] };
-            const selection = { workspace: chosen.workspace, agent };
-            if (journal && JSON.stringify({ workspace: journal.request.workspace, agent: journal.request.agent }) === JSON.stringify(selection))
-                request = journal.request;
-            else {
-                if (old.runtime)
+        let request = journal?.status !== 'rejected' ? journal?.request : undefined;
+        let resuming = !!request;
+        let selectionFlags = { ...flags };
+        if (request) {
+            // A prior POST may already have created the identity. Reconcile that exact key first.
+            const mismatched = (flags.agent && request.agent.id !== flags.agent) || (flags['create-agent'] && request.agent.mode === 'create' && request.agent.name !== flags['create-agent'].trim()) || (flags.workspace && request.workspace.id !== flags.workspace) || (flags['create-workspace'] && request.workspace.name !== flags['create-workspace'].trim());
+            if (mismatched)
+                throw Error('kit_native_setup_pending_intent_mismatch');
+        }
+        const saveJournal = async (status) => { const tmp = journalPath + '.' + randomUUID(); await writeFile(tmp, JSON.stringify({ version: 1, stamp, request, status }) + '\n', { flag: 'wx', mode: 0o600 }); await rename(tmp, journalPath); };
+        let prepared;
+        for (let attempt = 0;; attempt++) {
+            if (!request) {
+                const chosen = await selectNativeIdentity(root, selectionFlags, login, prompts);
+                const agent = 'id' in chosen.agent ? { mode: 'attach', id: chosen.agent.id, harness: harnessLabels[harness] } : { mode: 'create', name: chosen.agent.name, harness: harnessLabels[harness] };
+                if (old.runtime && (!('id' in chosen.workspace) || chosen.workspace.id !== old.runtime.workspaceId || !('id' in chosen.agent) || chosen.agent.id !== old.runtime.agentId))
                     throw Error('kit_runtime_existing_binding_mismatch');
-                request = { ...selection, idempotencyKey: randomUUID() };
-                const tmp = journalPath + '.' + randomUUID();
-                await writeFile(tmp, JSON.stringify({ version: 1, stamp, request }) + '\n', { flag: 'wx', mode: 0o600 });
-                await rename(tmp, journalPath);
+                request = { workspace: chosen.workspace, agent, idempotencyKey: randomUUID() };
+                await saveJournal('pending');
+            }
+            try {
+                prepared = await login.client.request('/api/runtime/setup', request);
+                break;
+            }
+            catch (error) {
+                // This exact Portal error occurs before workspace/agent mutation. Other failures
+                // retain the pending request, including timeouts, lost responses and HTTP 5xx.
+                if (!(error instanceof PortalHttpError) || error.status !== 409 || error.code !== 'agent_name_exists_select_existing' || attempt >= 3 || request.agent.mode !== 'create')
+                    throw error;
+                await saveJournal('rejected');
+                resuming = false;
+                selectionFlags = { harness, ...(request.workspace.id ? { workspace: request.workspace.id } : { 'create-workspace': request.workspace.name }), 'create-agent': request.agent.name };
+                request = undefined;
             }
         }
-        const prepared = await login.client.request('/api/runtime/setup', request);
         if (!prepared.workspace?.id || !prepared.agent?.id || !prepared.nodeId || prepared.agent.harness !== harnessLabels[harness])
             throw Error('kit_native_setup_response_invalid');
+        if (resuming && ((flags['create-agent'] && prepared.agent.name !== flags['create-agent'].trim()) || (flags['agent-name'] && prepared.agent.name !== flags['agent-name']) || (flags['workspace-name'] && prepared.workspace.name !== flags['workspace-name'])))
+            throw Error('kit_native_setup_pending_intent_mismatch');
+        if (flags.node && flags.node !== prepared.nodeId)
+            throw Error('kit_owned_agent_card_required');
+        await saveJournal('prepared');
         const authenticated = { ...login, workspaces: [...login.workspaces.filter(w => w.id !== prepared.workspace.id), prepared.workspace] };
         const result = await setupNative(root, { harness, workspaceId: prepared.workspace.id, nodeId: prepared.nodeId, agentId: prepared.agent.id }, authenticated);
         const tmp = configPath + '.' + randomUUID();

package/dist/native.d.ts

@@ -1,6 +1,7 @@
 import { guidedNativeSetup, nativeSdkConfig } from './native-setup.js';
 import { type PortalLogin } from './onboarding.js';
 import { type KnowledgeOperation } from '@tealbrick/portal/runtime';
+import { MarketplaceRuntimeConnector } from '@tealbrick/portal/marketplace-runtime';
 declare const harnesses: {
     readonly claude: "Claude Agent SDK";
     readonly codex: "Codex";
@@ -22,6 +23,7 @@ export declare function setupNative(root: string, input: {
 /** A fresh connector per invocation rechecks Portal and local activation. No authorization cache
  * survives MCP reconnect, local deactivation or a request boundary. No session is created here. */
 export declare function nativeConnector(): {
+    marketplace: () => Promise<MarketplaceRuntimeConnector | undefined>;
     capabilities: () => Promise<{
         revision: string;
         expiresAt: number;

package/dist/native.js

@@ -4,6 +4,7 @@ import { applyKit, readKit } from './index.js';
 import { loginPortal, portalOrigin } from './onboarding.js';
 import { PortalHttpError } from '@tealbrick/portal';
 import { RuntimeConnector } from '@tealbrick/portal/runtime';
+import { MarketplaceRuntimeConnector } from '@tealbrick/portal/marketplace-runtime';
 import { serveMcp } from '@tealbrick/portal/mcp';
 import { runtimeSecret } from './secrets.js';
 const harnesses = { claude: 'Claude Agent SDK', codex: 'Codex', langchain: 'LangChain' };
@@ -30,7 +31,7 @@ export async function setupNative(root, input, login) {
     const enrolled = await login.client.request('/api/runtime/connections', { workspaceId: input.workspaceId, nodeId: input.nodeId, agentId: input.agentId });
     if (!enrolled.connectionId || !enrolled.credential || !Number.isFinite(enrolled.expiresAt) || enrolled.expiresAt <= Date.now())
         throw Error('kit_runtime_enrollment_failed');
-    await applyKit(root, { version: 1, native: { harness: input.harness, active: true }, runtime: { issuer: login.issuer, org: login.org, workspaceId: input.workspaceId, agentId: input.agentId, connectionId: enrolled.connectionId, credentialRef: 'TEALBRICK_RUNTIME_CREDENTIAL', bindings: old.runtime?.bindings ?? {} } }, { TEALBRICK_RUNTIME_CREDENTIAL: enrolled.credential });
+    await applyKit(root, { version: 1, native: { harness: input.harness, active: true, ...(old.native?.marketplace === undefined ? {} : { marketplace: old.native.marketplace }) }, runtime: { issuer: login.issuer, org: login.org, workspaceId: input.workspaceId, agentId: input.agentId, connectionId: enrolled.connectionId, credentialRef: 'TEALBRICK_RUNTIME_CREDENTIAL', bindings: old.runtime?.bindings ?? {} } }, { TEALBRICK_RUNTIME_CREDENTIAL: enrolled.credential });
     return { connected: true, agentId: input.agentId, connectionId: enrolled.connectionId, harness: input.harness };
 }
 /** A fresh connector per invocation rechecks Portal and local activation. No authorization cache
@@ -43,7 +44,8 @@ export function nativeConnector() {
         const { credentialRef, ...runtime } = config.runtime;
         return new RuntimeConnector({ ...runtime, credential: () => runtimeSecret(credentialRef), resolveCredential: runtimeSecret });
     }
-    return { capabilities: async () => (await current()).capabilities(true), call: async (registrationId, operation, input = {}, signal) => (await current()).call(registrationId, operation, input, signal) };
+    return { marketplace: async () => { const config = await readKit(process.cwd()); if (!config.native?.active || !config.native.marketplace || !config.runtime)
+            return undefined; const { credentialRef, ...identity } = config.runtime; return new MarketplaceRuntimeConnector({ ...identity, credential: () => runtimeSecret(credentialRef) }); }, capabilities: async () => (await current()).capabilities(true), call: async (registrationId, operation, input = {}, signal) => (await current()).call(registrationId, operation, input, signal) };
 }
 export async function nativeCommand(args, root) {
     const command = args[0], flags = {};
@@ -91,6 +93,14 @@ export async function nativeCommand(args, root) {
         await serveMcp(nativeConnector());
         return;
     }
+    if (command === 'marketplace-enable' || command === 'marketplace-disable') {
+        const old = await readKit(root);
+        if (!old.native)
+            throw Error('kit_native_setup_required');
+        await applyKit(root, { ...old, native: { ...old.native, marketplace: command === 'marketplace-enable' } });
+        console.log(JSON.stringify({ marketplace: command === 'marketplace-enable' }));
+        return;
+    }
     if (command === 'disable' || command === 'enable') {
         const old = await readKit(root);
         if (!old.native)
@@ -99,6 +109,6 @@ export async function nativeCommand(args, root) {
         console.log(JSON.stringify({ active: command === 'enable' }));
         return;
     }
-    throw Error('Usage: tealbrick native setup --harness claude|codex|langchain [--workspace-name NAME | --create-workspace NAME] [--agent-name NAME | --create-agent NAME] [--issuer HTTPS_ORIGIN] | native mcp [--root DIRECTORY] | native enable|disable');
+    throw Error('Usage: tealbrick native setup --harness claude|codex|langchain [--workspace-name NAME | --create-workspace NAME] [--agent-name NAME | --create-agent NAME] [--issuer HTTPS_ORIGIN] | native mcp [--root DIRECTORY] | native enable|disable | native marketplace-enable|marketplace-disable');
 }
 export { guidedNativeSetup, nativeSdkConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tealbrick/kit",
-  "version": "0.3.0-rc.1",
+  "version": "0.3.0-rc.3",
   "type": "module",
   "license": "MIT",
   "description": "Complete Teal Brick package kit with explicit Eve capability activation",
@@ -43,11 +43,11 @@
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
-    "@tealbrick/portal": "0.3.0-rc.1",
-    "@tealbrick/avm": "0.3.0-rc.1",
-    "@tealbrick/voice": "0.3.0-rc.1",
-    "@tealbrick/vision": "0.3.0-rc.1",
-    "@tealbrick/deliver": "0.3.0-rc.1",
+    "@tealbrick/portal": "0.3.0-rc.3",
+    "@tealbrick/avm": "0.3.0-rc.3",
+    "@tealbrick/voice": "0.3.0-rc.3",
+    "@tealbrick/vision": "0.3.0-rc.3",
+    "@tealbrick/deliver": "0.3.0-rc.3",
     "@inquirer/prompts": "8.7.2",
     "zod": "^4.0.0"
   },