agenttwin 0.3.9 → 0.3.10

package/README.md

@@ -14,7 +14,7 @@ npx agenttwin init
 
 `init` discovers your repository and opens a persistent control menu. Bare `npx agenttwin` opens the same entry point. Select a reviewed world, inspect every service's support, run correctness checks, explore seeded faults, replay a failure, verify a source-only patch, save a regression, import an incident, or connect your account—all from this menu, without remembering flags or separate command names. `npx agenttwin refresh` updates discovery without executing application code. Existing advanced commands remain available to CI and coding agents.
 
-Discovery writes the inventory, workflow candidates, `agenttwin.config.json`, `ENVIRONMENT.md`, `REPLICATION.md`, and an offline browser report. A discovered candidate is not an executable specification: the menu accepts a reviewed `agenttwin.world.json` with explicit bundled Node files, synthetic services, invocation and required outcomes. The optional demo is clearly labeled as synthetic. Redirected input and `--yes` only perform discovery; they never start the interactive execution loop. `init --json --dry-run` writes nothing. Account sharing is explicit; having an existing token does not automatically upload evidence during init.
+Discovery writes the inventory, workflow candidates, `agenttwin.config.json`, `ENVIRONMENT.md`, `REPLICATION.md`, and an offline browser report. A discovered candidate is not an executable specification: the menu accepts a reviewed `agenttwin.world.json` with explicit bundled Node files, synthetic services, invocation and required outcomes. The optional demo is clearly labeled as synthetic. Redirected input and `--yes` only perform discovery; they never start the interactive execution loop. `init --json --dry-run` writes nothing. Interactive init connects and syncs discovery after the first browser approval; saved connections sync without another approval. Noninteractive init never uploads automatically.
 
 Seeded exploration includes an unfaulted control and up to 31 timeout-after-write trials. A seed controls the selected service/path and delay, not OS scheduling or arbitrary application randomness. Each trial uses fresh service state. Captured application files, checks, fault cases and receipts stay under `.agenttwin/explorations/`. Replay uses the captured application; patch verification uses current application files with the captured checks and fault cases. Hash mismatches reject accidental snapshot edits. This is local evidence, not a tamper-proof security boundary; protected CI anchors saved regression checks in a trusted Git baseline. Unexercised fault targets and unsupported provider operations remain incomplete.
 
@@ -138,11 +138,11 @@ Older releases without this updater cannot update themselves. After the new rele
 
 ### Coding session and dashboard discovery
 
-Run `npx agenttwin init` inside your repository (Node.js 22.12+). Interactive init opens the guided repository menu and offers account connection and reviewed project sharing. It does not launch another coding agent automatically. `npx agenttwin init --agent opencode` launches OpenCode explicitly with your configured provider and its normal permission controls. Provider authentication and usage belong to your coding-agent account. Other coding agents can use `.agenttwin/AGENT-TASK.md`.
+Run `npx agenttwin init` inside your repository (Node.js 22.12+). Interactive init connects your account, syncs project discovery and opens the guided repository menu. It does not launch another coding agent automatically. `npx agenttwin init --agent opencode` launches OpenCode explicitly with your configured provider and its normal permission controls. Provider authentication and usage belong to your coding-agent account. Other coding agents can use `.agenttwin/AGENT-TASK.md`.
 
 The session traces workflows across files, records intents and production failure hypotheses in `.agenttwin/WORKFLOWS.md`, and writes metadata to `.agenttwin/agent-discovery.json`. Static candidates retain their original evidence. Agent candidates remain unverified until the workflow is explicitly prepared and executed. Static discovery preserves distinct exported side-effect entrypoints, including repositories with 100 candidates; it does not prove that every business workflow has been found.
 
-Create a workspace at https://agenttwin.si/signup/ or run `npx agenttwin login` from your repository. Run `npx agenttwin init`, review discovery, then choose account connection and approve sharing in the guided menu. Sign in in your browser and enter the code shown in the terminal when prompted. Terminal credentials are stored with owner-only permissions in `~/.agenttwin/credentials.json`, outside your repository. You can still supply `AGENTTWIN_TOKEN` for automation. Optional `AGENTTWIN_API_URL` selects your API. The website loads account discovery after you connect in Settings, then refreshes while visible. Sync sends names, operations and relative entrypoint metadata; application source uploads happen separately through reviewed bundles. Avoid sensitive names or identifiers in discovery metadata.
+Create a workspace at https://agenttwin.si/signup/ or run `npx agenttwin login` from your repository. Run `npx agenttwin init`. On first use, sign in in the browser, compare its prefilled connection code with your terminal, and click Connect terminal. Keep init running: project discovery syncs automatically, and onboarding refreshes to show it. Subsequent interactive init runs use the saved connection without another sharing prompt. Terminal credentials are stored with owner-only permissions in `~/.agenttwin/credentials.json`, outside your repository. You can still supply `AGENTTWIN_TOKEN` for automation. Optional `AGENTTWIN_API_URL` selects your API. The website loads account discovery after you connect in Settings, then refreshes while visible. Sync sends names, operations and relative entrypoint metadata; application source uploads happen separately through reviewed bundles. Avoid sensitive names or identifiers in discovery metadata.
 
 To execute a workflow, supply an executable Node entrypoint, reviewed supported dependency mappings, synthetic fixtures and expected observable outcomes. Run `npx agenttwin prepare --file preparation.json`, review the bundle, and run it through your AgentTwin API or E2B account. Browser/desktop automation and arbitrary vendor SDKs require additional runtimes/adapters. The CLI is the default runner; select a hosted runner only when the workflow requires it. No local Docker is used.
 

package/dist/cli.js

@@ -1876,6 +1876,12 @@ function validVerificationUrl(base, value) {
     return false;
   }
 }
+function pairingUrl(base, verificationUrl, userCode) {
+  if (!validVerificationUrl(base, verificationUrl) || !/^[A-F0-9]{10}$/.test(userCode)) throw new Error("Invalid pairing response.");
+  const url = new URL(verificationUrl);
+  url.hash = new URLSearchParams({ user_code: userCode }).toString();
+  return url.toString();
+}
 async function runLogin(log) {
   const base = apiBase(process.env.AGENTTWIN_API_URL || "https://api.agenttwin.si");
   const request = async (path2, input = {}) => fetch(base + path2, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(input), redirect: "error", signal: AbortSignal.timeout(15e3) });
@@ -1883,12 +1889,13 @@ async function runLogin(log) {
   if (!response.ok) throw new Error("Cannot start sign in. Please try again.");
   const device = await response.json();
   if (!/^[a-f0-9]{64}$/.test(device.deviceCode) || !/^[A-F0-9]{10}$/.test(device.userCode) || !validVerificationUrl(base, device.verificationUrl)) throw new Error("Invalid pairing response.");
-  log(`Sign in or create an account at ${device.verificationUrl}`);
+  const browserUrl = pairingUrl(base, device.verificationUrl, device.userCode);
+  log(`Sign in or create an account at ${browserUrl}`);
   log(`Enter this code to connect this terminal: ${device.userCode}`);
-  log("Only approve the code shown in this terminal. No passwords or API keys to paste.");
-  if (process.platform === "darwin") execFile("open", [device.verificationUrl], () => {
+  log("Compare the browser code with this terminal, then choose Connect terminal. No passwords or API keys to paste.");
+  if (process.platform === "darwin") execFile("open", [browserUrl], () => {
   });
-  else if (process.platform === "linux") execFile("xdg-open", [device.verificationUrl], () => {
+  else if (process.platform === "linux") execFile("xdg-open", [browserUrl], () => {
   });
   const deadline = Date.now() + 6e5;
   while (Date.now() < deadline) {
@@ -1899,7 +1906,7 @@ async function runLogin(log) {
     if (!poll.ok || !/^at_user_[a-f0-9]{64}$/.test(data.token ?? "")) throw new Error(data.error || "Unable to finish sign in.");
     await saveConnection(base, data.token);
     log(`Connected to ${data.workspace}. Login saved privately outside your repository.`);
-    log("Return to the guided menu to review and share this repository.");
+    log("Terminal approved. Continuing project connection\u2026");
     return;
   }
   throw new Error("Sign in expired. Run npx agenttwin login again.");
@@ -1922,7 +1929,7 @@ import { join as join34 } from "path";
 // package.json
 var package_default = {
   name: "agenttwin",
-  version: "0.3.9",
+  version: "0.3.10",
   description: "Give your agent a test world before it touches the real one.",
   keywords: [
     "agent",
@@ -9056,7 +9063,7 @@ async function runInit(opts) {
     if (opts.sync) {
       const synced = await runSync(opts.cwd);
       if (!opts.json) ok2(`Synced ${synced.workflows} candidates: ${synced.dashboard}`);
-    } else if (!opts.json) info(opts.controller ? "Account connection and reviewed sharing are available in the control menu. Nothing was uploaded." : "Connect this terminal: npx agenttwin login. Then send reviewed discovery: npx agenttwin sync.");
+    } else if (!opts.json) info(opts.controller ? "Discovery saved locally. Interactive init will now connect your account and sync this project." : "Connect this terminal: npx agenttwin login. Then send reviewed discovery: npx agenttwin sync.");
   }
   process.exitCode = result.exitCode;
   return wrote;
@@ -9066,21 +9073,6 @@ async function runInit(opts) {
 import { createInterface as createInterface3 } from "readline/promises";
 import { readFile as readFile23, writeFile as writeFile22 } from "fs/promises";
 import { join as join27, resolve as resolve14 } from "path";
-
-// src/runtime/local-workspace.ts
-async function detectLocalWorkspace(request = fetch) {
-  try {
-    const response = await request("http://localhost:8080/v1/dev/workspace", { redirect: "error", signal: AbortSignal.timeout(700) });
-    if (!response.ok) return null;
-    const data = await response.json();
-    if (data.schema !== "agenttwin/local-workspace-v1" || data.dashboard !== "http://localhost:3000/onboarding/") return null;
-    return { api: "http://localhost:8080", dashboard: data.dashboard };
-  } catch {
-    return null;
-  }
-}
-
-// src/commands/control.ts
 init_store();
 init_contracts();
 
@@ -9201,25 +9193,17 @@ async function runControl(opts) {
   };
   const connectAndShare = async () => {
     const connection = await savedConnection();
+    const destination = process.env.AGENTTWIN_API_URL || connection?.base || "https://api.agenttwin.si";
+    log(`Connecting this project to ${destination}. Sync sends detected service names, workflow metadata, Git metadata and test evidence; application source and credentials stay local.`);
     if (!process.env.AGENTTWIN_TOKEN && (!connection || process.env.AGENTTWIN_API_URL && connection.base !== process.env.AGENTTWIN_API_URL)) await runLogin(log);
-    log("Discovery is local until you share it. Sharing sends detected service names, workflow metadata, Git metadata and test evidence; application source and credentials stay local.");
-    if ((await ask("Share this repository with your workspace? [y/N]")).toLowerCase() === "y") {
-      const result = await runSync(opts.cwd);
-      log(`Project shared: ${opts.cwd}. Open your workspace and check for your project. ${result.dashboard}`);
-    } else log("Kept on this computer. This repository will not appear in your online workspace yet.");
+    const result = await runSync(opts.cwd);
+    log(`Project connected: ${result.tools} services and ${result.workflows} workflow candidates synced. ${result.dashboard}`);
   };
   try {
-    if (!process.env.AGENTTWIN_API_URL && !process.env.AGENTTWIN_TOKEN) {
-      const local = await detectLocalWorkspace();
-      if (local && (await ask(`Local AgentTwin workspace detected at ${local.dashboard}. Connect to it instead of production for this session? [y/N]`)).toLowerCase() === "y") process.env.AGENTTWIN_API_URL = local.api;
-    }
-    log("Repository discovered locally. To see it in onboarding, connect this terminal and share its reviewed discovery.");
-    if ((await ask("Connect and share this project now? [y/N]")).toLowerCase() === "y") {
-      try {
-        await connectAndShare();
-      } catch (error) {
-        log(`Connection stopped: ${error instanceof Error ? error.message : String(error)}. Retry with option 9.`);
-      }
+    try {
+      await connectAndShare();
+    } catch (error) {
+      log(`Connection stopped: ${error instanceof Error ? error.message : String(error)}. Local discovery is saved. Retry with option 9.`);
     }
     while (true) {
       log("\nAgentTwin \xB7 your repository control center");