agenttwin 0.2.0 → 0.2.1

package/README.md

@@ -9,7 +9,6 @@ AgentTwin 0.2.0 executes application code in E2B. No local application container
 Node.js 22+ is required. Run discovery from your project; npx installs the CLI automatically:
 
 ```sh
-npm install --no-save --ignore-scripts /path/to/agenttwin-0.2.0.tgz
 npx agenttwin init
 npx agenttwin example --out ./agenttwin-example
 ```
@@ -104,3 +103,16 @@ npx agenttwin run --file .agenttwin/prepared/notification/agenttwin.world.json
 The output contains your unchanged source, a world spec, a SHA-256 manifest, and `agenttwin.bundle.json`. In Hosted runs, connect with an individual API token, choose that bundle, review the upload and execute. Jobs can be refreshed, cancelled and inspected. Tokens stay in page memory. Discovery imports remain in the browser; executing uploads the explicit bundle to the API.
 
 Supported mapping contracts: bounded Slack operations, PostgreSQL, Redis and custom JSON collections (`GET /path` / `POST /path`). Preparation rejects missing/unreviewed mappings and unsupported vendor SDK operations. Discovery and mappings remain user-reviewed declarations, not proof that every operation or dependency in arbitrary source was discovered. Hosted execution checks the declared assertions.
+
+
+### Coding session and dashboard discovery
+
+Run `npx agenttwin init` inside your repository (Node.js 22+). Interactive init offers an OpenCode session when the CLI is installed; `npx agenttwin init --agent opencode` launches explicitly with your configured provider and its normal permission controls. Provider authentication and usage belong to your coding-agent account. Other coding agents can use `.agenttwin/AGENT-TASK.md`.
+
+The session traces workflows across files, records intents and production failure hypotheses in `.agenttwin/WORKFLOWS.md`, and writes metadata to `.agenttwin/agent-discovery.json`. Static candidates retain their original evidence. Agent candidates remain unverified until the workflow is explicitly prepared and executed. Static discovery preserves distinct exported side-effect entrypoints, including repositories with 100 candidates; it does not prove that every business workflow has been found.
+
+After reviewing discovery, configure `AGENTTWIN_TOKEN` using your individual account token (never paste it into an agent prompt) and run `npx agenttwin sync`. Optional `AGENTTWIN_API_URL` selects your API. The website loads account discovery after you connect in Settings, then refreshes while visible. Sync sends names, operations and relative entrypoint metadata; application source uploads happen separately through reviewed bundles. Avoid sensitive names or identifiers in discovery metadata.
+
+To execute a workflow, supply an executable Node entrypoint, reviewed supported dependency mappings, synthetic fixtures and expected observable outcomes. Run `npx agenttwin prepare --file preparation.json`, review the bundle, and run it through your AgentTwin API or E2B account. Browser/desktop automation and arbitrary vendor SDKs require additional runtimes/adapters. Every application execution is hosted; no local Docker is used.
+
+A run receipt's **Fix & retest** tab exports an evidence-based task for your coding agent. Edit the code in the original project, prepare a new bundle, execute in a fresh sandbox, and compare receipts. This is an interactive coding loop, not an unattended universal repair service.

package/dist/api.js

@@ -7,6 +7,43 @@ import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile2, rename
 import { resolve as resolve2, join as join4, dirname as dirname2, extname } from "path";
 import { tmpdir as tmpdir2 } from "os";
 
+// src/inventory/dashboard-transfer.ts
+function discoveryTransfer(value) {
+  const input = value;
+  if (!input || input.schema !== "company-inventory/v1" || typeof input.name !== "string" || !Array.isArray(input.tools) || !Array.isArray(input.workflows) || input.tools.length > 1e3 || input.workflows.length > 5e3) throw new Error("Invalid discovery metadata");
+  const text = (v, limit = 240) => {
+    if (typeof v !== "string" || v.length > limit || /[\x00-\x1f]/.test(v)) throw new Error("Invalid discovery string");
+    return v;
+  };
+  const strings = (v) => {
+    if (!Array.isArray(v) || v.length > 1e3) throw new Error("Invalid discovery list");
+    return v.map((s) => text(s));
+  };
+  const entrypoint = (v) => {
+    const path = text(v, 500);
+    if (path.startsWith("/") || path.includes("\\") || /(^|[\/])\.\.([\/#]|$)/.test(path) || /^[A-Za-z][A-Za-z0-9+.-]*:/.test(path)) throw new Error("Entrypoint must be relative to the project");
+    return path;
+  };
+  const tools = input.tools.map((raw) => {
+    const t = raw;
+    return { id: text(t.id), title: text(t.title), kind: text(t.kind), category: text(t.category), confidence: text(t.confidence), interface: text(t.interface) };
+  });
+  const workflows = input.workflows.map((raw) => {
+    const w = raw;
+    if (!Array.isArray(w.steps) || w.steps.length > 1e3) throw new Error("Invalid workflow steps");
+    return { id: text(w.id), title: text(w.title), confidence: text(w.confidence), supported: w.supported === true, verified: false, tools: strings(w.tools), steps: w.steps.map((rawStep) => {
+      const step = rawStep;
+      return { tool: text(step.tool), operations: strings(step.operations) };
+    }), ...w.entrypoint ? { entrypoint: entrypoint(w.entrypoint) } : {} };
+  });
+  if (new Set(tools.map((t) => t.id)).size !== tools.length || new Set(workflows.map((w) => w.id)).size !== workflows.length) throw new Error("Duplicate discovery IDs");
+  const ids = new Set(tools.map((t) => t.id));
+  if (workflows.some((w) => w.tools.some((id) => !ids.has(id)) || w.steps.some((s) => !ids.has(s.tool)))) throw new Error("Unknown workflow tool");
+  const result = { schema: "company-inventory/v1", name: text(input.name), generatedAt: input.generatedAt ? text(input.generatedAt) : "", tools, workflows };
+  if (Buffer.byteLength(JSON.stringify(result)) > 2 * 1024 * 1024) throw new Error("Discovery exceeds 2 MiB");
+  return result;
+}
+
 // src/runtime/spec.ts
 var object = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var namePattern = /^[a-z][a-z0-9_]{0,39}$/;
@@ -535,6 +572,22 @@ async function startGateway(opts) {
         send(res, 401, { error: "unauthorized" });
         return;
       }
+      if (path === "/v1/discovery" && req.method === "GET") {
+        send(res, 200, { inventory: store.discoveries?.[account.id] ?? null });
+        return;
+      }
+      if (path === "/v1/discovery" && req.method === "POST") {
+        if (stopping) {
+          send(res, 503, { error: "stopping" });
+          return;
+        }
+        const inventory = discoveryTransfer(await body(req));
+        store.discoveries ??= {};
+        store.discoveries[account.id] = inventory;
+        await save();
+        send(res, 200, { synced: true, tools: inventory.tools.length, workflows: inventory.workflows.length });
+        return;
+      }
       if (path === "/v1/runs" && req.method === "GET") {
         send(res, 200, { jobs: store.jobs.filter((j) => j.accountId === account.id).slice(-100).reverse().map(({ id, status, createdAt }) => ({ id, status, createdAt })) });
         return;