@tealbrick/kit 0.3.0-rc.1 → 0.3.0-rc.4

package/dist/native-setup.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { mkdir, lstat, readFile, writeFile, rename, unlink, realpath } from 'node:fs/promises';
+import { PortalHttpError } from '@tealbrick/portal';
 import { readKit } from './index.js';
 import { selectNativeIdentity, harnessLabels } from './native-selection.js';
 import { setupNative } from './native.js';
@@ -66,26 +67,48 @@ export async function guidedNativeSetup(root, flags, login, prompts) {
         const stamp = { issuer: login.issuer, org: login.org, userId: login.userId, harness };
         if (journal && JSON.stringify(journal.stamp) !== JSON.stringify(stamp))
             throw Error('kit_native_setup_account_mismatch');
-        const explicit = ['workspace', 'workspace-name', 'create-workspace', 'agent', 'node', 'agent-name', 'create-agent'].some(key => flags[key]);
-        let request = journal && !explicit ? journal.request : undefined;
-        if (!request) {
-            const chosen = await selectNativeIdentity(root, flags, login, prompts);
-            const agent = 'id' in chosen.agent ? { mode: 'attach', id: chosen.agent.id, harness: harnessLabels[harness] } : { mode: 'create', name: chosen.agent.name, harness: harnessLabels[harness] };
-            const selection = { workspace: chosen.workspace, agent };
-            if (journal && JSON.stringify({ workspace: journal.request.workspace, agent: journal.request.agent }) === JSON.stringify(selection))
-                request = journal.request;
-            else {
-                if (old.runtime)
+        let request = journal?.status !== 'rejected' ? journal?.request : undefined;
+        let resuming = !!request;
+        let selectionFlags = { ...flags };
+        if (request) {
+            // A prior POST may already have created the identity. Reconcile that exact key first.
+            const mismatched = (flags.agent && request.agent.id !== flags.agent) || (flags['create-agent'] && request.agent.mode === 'create' && request.agent.name !== flags['create-agent'].trim()) || (flags.workspace && request.workspace.id !== flags.workspace) || (flags['create-workspace'] && request.workspace.name !== flags['create-workspace'].trim());
+            if (mismatched)
+                throw Error('kit_native_setup_pending_intent_mismatch');
+        }
+        const saveJournal = async (status) => { const tmp = journalPath + '.' + randomUUID(); await writeFile(tmp, JSON.stringify({ version: 1, stamp, request, status }) + '\n', { flag: 'wx', mode: 0o600 }); await rename(tmp, journalPath); };
+        let prepared;
+        for (let attempt = 0;; attempt++) {
+            if (!request) {
+                const chosen = await selectNativeIdentity(root, selectionFlags, login, prompts);
+                const agent = 'id' in chosen.agent ? { mode: 'attach', id: chosen.agent.id, harness: harnessLabels[harness] } : { mode: 'create', name: chosen.agent.name, harness: harnessLabels[harness] };
+                if (old.runtime && (!('id' in chosen.workspace) || chosen.workspace.id !== old.runtime.workspaceId || !('id' in chosen.agent) || chosen.agent.id !== old.runtime.agentId))
                     throw Error('kit_runtime_existing_binding_mismatch');
-                request = { ...selection, idempotencyKey: randomUUID() };
-                const tmp = journalPath + '.' + randomUUID();
-                await writeFile(tmp, JSON.stringify({ version: 1, stamp, request }) + '\n', { flag: 'wx', mode: 0o600 });
-                await rename(tmp, journalPath);
+                request = { workspace: chosen.workspace, agent, idempotencyKey: randomUUID() };
+                await saveJournal('pending');
+            }
+            try {
+                prepared = await login.client.request('/api/runtime/setup', request);
+                break;
+            }
+            catch (error) {
+                // This exact Portal error occurs before workspace/agent mutation. Other failures
+                // retain the pending request, including timeouts, lost responses and HTTP 5xx.
+                if (!(error instanceof PortalHttpError) || error.status !== 409 || error.code !== 'agent_name_exists_select_existing' || attempt >= 3 || request.agent.mode !== 'create')
+                    throw error;
+                await saveJournal('rejected');
+                resuming = false;
+                selectionFlags = { harness, ...(request.workspace.id ? { workspace: request.workspace.id } : { 'create-workspace': request.workspace.name }), 'create-agent': request.agent.name };
+                request = undefined;
             }
         }
-        const prepared = await login.client.request('/api/runtime/setup', request);
         if (!prepared.workspace?.id || !prepared.agent?.id || !prepared.nodeId || prepared.agent.harness !== harnessLabels[harness])
             throw Error('kit_native_setup_response_invalid');
+        if (resuming && ((flags['create-agent'] && prepared.agent.name !== flags['create-agent'].trim()) || (flags['agent-name'] && prepared.agent.name !== flags['agent-name']) || (flags['workspace-name'] && prepared.workspace.name !== flags['workspace-name'])))
+            throw Error('kit_native_setup_pending_intent_mismatch');
+        if (flags.node && flags.node !== prepared.nodeId)
+            throw Error('kit_owned_agent_card_required');
+        await saveJournal('prepared');
         const authenticated = { ...login, workspaces: [...login.workspaces.filter(w => w.id !== prepared.workspace.id), prepared.workspace] };
         const result = await setupNative(root, { harness, workspaceId: prepared.workspace.id, nodeId: prepared.nodeId, agentId: prepared.agent.id }, authenticated);
         const tmp = configPath + '.' + randomUUID();

package/dist/native.d.ts

@@ -1,6 +1,7 @@
 import { guidedNativeSetup, nativeSdkConfig } from './native-setup.js';
 import { type PortalLogin } from './onboarding.js';
 import { type KnowledgeOperation } from '@tealbrick/portal/runtime';
+import { MarketplaceRuntimeConnector } from '@tealbrick/portal/marketplace-runtime';
 declare const harnesses: {
     readonly claude: "Claude Agent SDK";
     readonly codex: "Codex";
@@ -22,6 +23,7 @@ export declare function setupNative(root: string, input: {
 /** A fresh connector per invocation rechecks Portal and local activation. No authorization cache
  * survives MCP reconnect, local deactivation or a request boundary. No session is created here. */
 export declare function nativeConnector(): {
+    marketplace: () => Promise<MarketplaceRuntimeConnector | undefined>;
     capabilities: () => Promise<{
         revision: string;
         expiresAt: number;

package/dist/native.js

@@ -4,6 +4,7 @@ import { applyKit, readKit } from './index.js';
 import { loginPortal, portalOrigin } from './onboarding.js';
 import { PortalHttpError } from '@tealbrick/portal';
 import { RuntimeConnector } from '@tealbrick/portal/runtime';
+import { MarketplaceRuntimeConnector } from '@tealbrick/portal/marketplace-runtime';
 import { serveMcp } from '@tealbrick/portal/mcp';
 import { runtimeSecret } from './secrets.js';
 const harnesses = { claude: 'Claude Agent SDK', codex: 'Codex', langchain: 'LangChain' };
@@ -30,7 +31,7 @@ export async function setupNative(root, input, login) {
     const enrolled = await login.client.request('/api/runtime/connections', { workspaceId: input.workspaceId, nodeId: input.nodeId, agentId: input.agentId });
     if (!enrolled.connectionId || !enrolled.credential || !Number.isFinite(enrolled.expiresAt) || enrolled.expiresAt <= Date.now())
         throw Error('kit_runtime_enrollment_failed');
-    await applyKit(root, { version: 1, native: { harness: input.harness, active: true }, runtime: { issuer: login.issuer, org: login.org, workspaceId: input.workspaceId, agentId: input.agentId, connectionId: enrolled.connectionId, credentialRef: 'TEALBRICK_RUNTIME_CREDENTIAL', bindings: old.runtime?.bindings ?? {} } }, { TEALBRICK_RUNTIME_CREDENTIAL: enrolled.credential });
+    await applyKit(root, { version: 1, native: { harness: input.harness, active: true, ...(old.native?.marketplace === undefined ? {} : { marketplace: old.native.marketplace }) }, runtime: { issuer: login.issuer, org: login.org, workspaceId: input.workspaceId, agentId: input.agentId, connectionId: enrolled.connectionId, credentialRef: 'TEALBRICK_RUNTIME_CREDENTIAL', bindings: old.runtime?.bindings ?? {} } }, { TEALBRICK_RUNTIME_CREDENTIAL: enrolled.credential });
     return { connected: true, agentId: input.agentId, connectionId: enrolled.connectionId, harness: input.harness };
 }
 /** A fresh connector per invocation rechecks Portal and local activation. No authorization cache
@@ -43,9 +44,72 @@ export function nativeConnector() {
         const { credentialRef, ...runtime } = config.runtime;
         return new RuntimeConnector({ ...runtime, credential: () => runtimeSecret(credentialRef), resolveCredential: runtimeSecret });
     }
-    return { capabilities: async () => (await current()).capabilities(true), call: async (registrationId, operation, input = {}, signal) => (await current()).call(registrationId, operation, input, signal) };
+    return { marketplace: async () => { const config = await readKit(process.cwd()); if (!config.native?.active || !config.native.marketplace || !config.runtime)
+            return undefined; const { credentialRef, ...identity } = config.runtime; return new MarketplaceRuntimeConnector({ ...identity, credential: () => runtimeSecret(credentialRef) }); }, capabilities: async () => (await current()).capabilities(true), call: async (registrationId, operation, input = {}, signal) => (await current()).call(registrationId, operation, input, signal) };
+}
+/** serve/enroll take boolean switches, so they are parsed separately from setup flags. */
+function serveFlags(args, values, switches) {
+    const flags = {};
+    for (let i = 0; i < args.length; i++) {
+        const name = /^--([a-z-]+)$/.exec(args[i])?.[1];
+        if (!name || flags[name] !== undefined)
+            throw Error('kit_native_invalid_arguments');
+        if (switches.includes(name)) {
+            flags[name] = true;
+            continue;
+        }
+        if (!values.includes(name) || !args[i + 1] || args[i + 1].startsWith('--'))
+            throw Error('kit_native_invalid_arguments');
+        flags[name] = args[++i];
+    }
+    return flags;
 }
 export async function nativeCommand(args, root) {
+    if (args[0] === 'serve' || args[0] === 'enroll') {
+        const flags = args[0] === 'serve' ? serveFlags(args.slice(1), ['root'], ['install-launchd', 'uninstall', 'no-load']) : serveFlags(args.slice(1), ['root', 'url', 'port'], ['skip-endpoint-check']);
+        if (typeof flags.root === 'string') {
+            root = resolve(flags.root);
+            process.chdir(root);
+        }
+        if (args[0] === 'serve') {
+            const { serveNative, installLaunchd, uninstallLaunchd } = await import('./native-serve.js');
+            if (flags['install-launchd'] && flags.uninstall)
+                throw Error('kit_native_invalid_arguments');
+            if (flags.uninstall) {
+                console.log(JSON.stringify(await uninstallLaunchd(root)));
+                return;
+            }
+            if (flags['install-launchd']) {
+                console.log(JSON.stringify(await installLaunchd(root, { load: !flags['no-load'] })));
+                return;
+            }
+            if (flags['no-load'])
+                throw Error('kit_native_invalid_arguments');
+            await serveNative(root);
+            return;
+        }
+        if (typeof flags.url !== 'string')
+            throw Error('kit_native_public_url_required');
+        const { enrollNative } = await import('./native-enroll.js');
+        const state = await readKit(root);
+        if (!state.native || !state.runtime)
+            throw Error('kit_native_setup_required');
+        const login = await loginPortal(portalOrigin(state.runtime.issuer), (url, code) => console.error(`Approve Tealbrick endpoint registration: ${url}\nCode: ${code}`));
+        try {
+            const result = await enrollNative(root, { url: flags.url, ...(typeof flags.port === 'string' ? { port: Number(flags.port) } : {}) }, login, { verifyEndpoint: !flags['skip-endpoint-check'] });
+            console.log(JSON.stringify(result));
+            if (!flags['skip-endpoint-check'] && !result.endpointVerified) {
+                console.error('Portal registration is saved. Start `tealbrick native serve` and the HTTPS proxy, then re-run enroll to verify the endpoint.');
+                process.exitCode = 2;
+            }
+        }
+        catch (error) {
+            if (error instanceof PortalHttpError && /^[a-z_]+$/.test(error.code ?? ''))
+                throw Error('kit_portal_' + error.code);
+            throw error;
+        }
+        return;
+    }
     const command = args[0], flags = {};
     for (let i = 1; i < args.length; i += 2) {
         if (!/^--(root|harness|workspace|workspace-name|create-workspace|node|agent|agent-name|create-agent|delegation|issuer)$/.test(args[i]) || !args[i + 1] || flags[args[i].slice(2)])
@@ -91,6 +155,14 @@ export async function nativeCommand(args, root) {
         await serveMcp(nativeConnector());
         return;
     }
+    if (command === 'marketplace-enable' || command === 'marketplace-disable') {
+        const old = await readKit(root);
+        if (!old.native)
+            throw Error('kit_native_setup_required');
+        await applyKit(root, { ...old, native: { ...old.native, marketplace: command === 'marketplace-enable' } });
+        console.log(JSON.stringify({ marketplace: command === 'marketplace-enable' }));
+        return;
+    }
     if (command === 'disable' || command === 'enable') {
         const old = await readKit(root);
         if (!old.native)
@@ -99,6 +171,6 @@ export async function nativeCommand(args, root) {
         console.log(JSON.stringify({ active: command === 'enable' }));
         return;
     }
-    throw Error('Usage: tealbrick native setup --harness claude|codex|langchain [--workspace-name NAME | --create-workspace NAME] [--agent-name NAME | --create-agent NAME] [--issuer HTTPS_ORIGIN] | native mcp [--root DIRECTORY] | native enable|disable');
+    throw Error('Usage: tealbrick native setup --harness claude|codex|langchain [--workspace-name NAME | --create-workspace NAME] [--agent-name NAME | --create-agent NAME] [--issuer HTTPS_ORIGIN] | native mcp [--root DIRECTORY] | native serve [--root DIRECTORY] [--install-launchd [--no-load] | --uninstall] | native enroll --url HTTPS_ORIGIN [--port PORT] [--root DIRECTORY] [--skip-endpoint-check] | native enable|disable | native marketplace-enable|marketplace-disable');
 }
 export { guidedNativeSetup, nativeSdkConfig };

package/dist/onboarding.d.ts

@@ -8,6 +8,11 @@ export interface PortalLogin {
         id: string;
         name: string;
     }>;
+    /** Ephemeral user identity for endpoint verification. Never persisted. */
+    identity?: {
+        token: string;
+        bundle: string;
+    };
 }
 /** Reject URLs that would leak credentials or be silently truncated by registration. */
 export declare function portalOrigin(value: string): string;

package/dist/onboarding.js

@@ -53,7 +53,7 @@ export async function loginPortal(issuer, show, options = {}) {
     const directory = await authenticated.request('/api/me/workspaces');
     if (!account.user?.id || !account.user.orgId || directory.accountId !== account.user.id || directory.organizationId !== account.user.orgId || !Array.isArray(directory.workspaces) || directory.workspaces.some(w => !w.id || !w.name))
         throw Error('kit_portal_account_mismatch');
-    return { issuer, client: authenticated, org: account.user.orgId, userId: account.user.id, workspaces: directory.workspaces };
+    return { issuer, client: authenticated, org: account.user.orgId, userId: account.user.id, workspaces: directory.workspaces, identity: { token: session.token, bundle: session.bundle } };
 }
 /** Reuse Portal's owned registration + revision-checked canvas APIs, not a parallel card store. */
 export async function registerPortalCard(login, input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tealbrick/kit",
-  "version": "0.3.0-rc.1",
+  "version": "0.3.0-rc.4",
   "type": "module",
   "license": "MIT",
   "description": "Complete Teal Brick package kit with explicit Eve capability activation",
@@ -43,11 +43,11 @@
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
-    "@tealbrick/portal": "0.3.0-rc.1",
-    "@tealbrick/avm": "0.3.0-rc.1",
-    "@tealbrick/voice": "0.3.0-rc.1",
-    "@tealbrick/vision": "0.3.0-rc.1",
-    "@tealbrick/deliver": "0.3.0-rc.1",
+    "@tealbrick/portal": "0.3.0-rc.4",
+    "@tealbrick/avm": "0.3.0-rc.4",
+    "@tealbrick/voice": "0.3.0-rc.4",
+    "@tealbrick/vision": "0.3.0-rc.4",
+    "@tealbrick/deliver": "0.3.0-rc.4",
     "@inquirer/prompts": "8.7.2",
     "zod": "^4.0.0"
   },