@tpsdev-ai/flair 0.13.0 → 0.14.0

package/dist/cli.js

@@ -7005,6 +7005,7 @@ memory.command("add [content]").requiredOption("--agent <id>")
     .option("--summary <text>", "agent-set multi-sentence dense compression (3-tier chain: subject → summary → content; ops-wkoh)")
     .option("--subject <text>", "one-line title / entity this memory is about")
     .option("--derived-from <csv>", "Comma-separated source Memory IDs this memory was distilled/reflected from (sets Memory.derivedFrom; used by the `rem rapid` reflection loop)")
+    .option("--visibility <value>", "Memory visibility (sets Memory.visibility). Use 'office' to share office-wide with every team agent; omit (default) to keep it private to this agent (flair#509)")
     .action(async (contentArg, opts) => {
     const content = contentArg ?? opts.content;
     if (!content) {
@@ -7021,6 +7022,8 @@ memory.command("add [content]").requiredOption("--agent <id>")
         body.summary = opts.summary;
     if (opts.subject)
         body.subject = opts.subject;
+    if (opts.visibility)
+        body.visibility = String(opts.visibility).trim();
     if (opts.derivedFrom) {
         body.derivedFrom = String(opts.derivedFrom).split(",").map((x) => x.trim()).filter(Boolean);
     }

package/dist/resources/A2AAdapter.js

@@ -2,6 +2,7 @@ import { Resource, databases } from "@harperfast/harper";
 import { access, readFile, readdir } from "node:fs/promises";
 import { constants } from "node:fs";
 import { basename, extname, join } from "node:path";
+import { localBaseUrl, resolvePublicBaseUrl } from "./a2a-url.js";
 const BEADS_ROOT = join(process.env.HOME || "/root", "ops", ".beads");
 const BEADS_ISSUES_DIR = join(BEADS_ROOT, "issues");
 const BEADS_ISSUES_JSONL = join(BEADS_ROOT, "issues.jsonl");
@@ -277,7 +278,13 @@ export class A2AAdapter extends Resource {
     allowRead() { return true; }
     allowCreate() { return true; }
     async get() {
-        const host = process.env.FLAIR_PUBLIC_URL || "http://localhost:9926";
+        // Resolve the URL remote peers should use to reach this Flair. Prefer the
+        // request Host header (how the caller actually reached us) over a
+        // hardcoded port, so a default local install advertises the REAL HTTP
+        // port (19926), not the dead legacy 9926 (flair#507).
+        const ctx = this.getContext?.() ?? {};
+        const ctxRequest = ctx.request ?? ctx;
+        const host = resolvePublicBaseUrl(ctxRequest);
         return new Response(JSON.stringify({
             name: "TPS Agent Team",
             description: "TPS — agent OS for humans and AI agents. Coordinates via Flair.",
@@ -367,7 +374,7 @@ export class A2AAdapter extends Resource {
                                 closeStream();
                                 return;
                             }
-                            const catchupUrl = `http://localhost:9926/OrgEventCatchup/${encodeURIComponent(agentId)}?since=${lastSeen}`;
+                            const catchupUrl = `${localBaseUrl()}/OrgEventCatchup/${encodeURIComponent(agentId)}?since=${lastSeen}`;
                             let events = [];
                             try {
                                 const response = await fetch(catchupUrl);

package/dist/resources/a2a-url.js

@@ -0,0 +1,53 @@
+// URL resolution for the A2A adapter — flair#507.
+//
+// A default local Flair install listens on DEFAULT_HTTP_PORT (19926, the
+// CLI's `DEFAULT_PORT` in src/cli.ts), NOT on 9926 (the legacy early-install
+// port). The A2A agent-card `url` and the streaming catch-up self-fetch must
+// reflect the REAL listening port, or a remote A2A peer that follows discovery
+// hits a dead port.
+//
+// Kept free of any @harperfast/harper import so the resolution logic is
+// unit-testable without spinning up Harper (mirrors agentcard-fields.ts —
+// avoids the simulator-pattern drift that let the AdminInstance predicate be
+// reproduced-not-imported).
+// The CLI's DEFAULT_HTTP_PORT (src/cli.ts `DEFAULT_PORT`). Keep in sync.
+export const DEFAULT_HTTP_PORT = 19926;
+// Loopback base URL for in-process self-calls (e.g. the streaming catch-up
+// fetch). Points at the port Flair is ACTUALLY listening on, which Harper
+// exposes via HTTP_PORT in the runtime env — never the public/proxy URL.
+// Falls back to DEFAULT_HTTP_PORT for a default local install.
+export function localBaseUrl(env = process.env) {
+    return `http://127.0.0.1:${env.HTTP_PORT || DEFAULT_HTTP_PORT}`;
+}
+// Public base URL advertised in the A2A agent card so remote peers can reach
+// this Flair. Mirrors AdminInstance.resolvePublicUrl (flair#404):
+//   1. FLAIR_PUBLIC_URL (explicit override, always wins)
+//   2. Request headers (X-Forwarded-Proto/Host or Host) — how the caller
+//      actually reached us
+//   3. http://127.0.0.1:${HTTP_PORT} — local-only fallback on the REAL port
+export function resolvePublicBaseUrl(request, env = process.env) {
+    if (env.FLAIR_PUBLIC_URL) {
+        return env.FLAIR_PUBLIC_URL.replace(/\/$/, "");
+    }
+    const getHeader = (name) => {
+        const h = request?.headers;
+        if (!h)
+            return undefined;
+        if (typeof h.get === "function")
+            return h.get(name) ?? h.get(name.toLowerCase()) ?? undefined;
+        if (typeof h === "object") {
+            const obj = h.asObject ?? h;
+            return obj[name] ?? obj[name.toLowerCase()] ?? undefined;
+        }
+        return undefined;
+    };
+    const fwdProto = getHeader("X-Forwarded-Proto");
+    const fwdHost = getHeader("X-Forwarded-Host");
+    const host = fwdHost ?? getHeader("Host");
+    if (host && /^[\w.\-:]+$/.test(host)) {
+        const scheme = fwdProto && (fwdProto === "http" || fwdProto === "https") ? fwdProto : "https";
+        const effectiveScheme = fwdProto ? scheme : (host.includes(":") ? "http" : scheme);
+        return `${effectiveScheme}://${host}`;
+    }
+    return localBaseUrl(env);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tpsdev-ai/flair",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Identity, memory, and soul for AI agents. Cryptographic identity (Ed25519), semantic memory with local embeddings, and persistent personality — all in a single process.",
   "type": "module",
   "license": "Apache-2.0",