create-openagent 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog — create-openagent
 
+## [0.5.0] - 2026-10-12
+
+- Pin SDK 0.7.0 and expose soft plush/flat finish and on-face/raised eye controls
+  across every family, preserving wearables and real verified-request state.
+- Keep the persisted signer/receiver, restart/replay/revocation behavior and
+  loopback-only transport unchanged; qualify the generated HTTP controls with
+  the same packed SDK used by browser acceptance.
+
 ## [0.4.0] - 2026-10-12
 
 - Pin SDK 0.6.0 and add combinable glasses/headphones controls that preserve the

package/README.md

@@ -5,7 +5,7 @@ explicit receiver trust, authenticated HTTP requests and animated avatars run
 locally without a Life account or a hosted identity service.
 
 ```sh
-npx create-openagent@0.4.0 my-agent-app --yes
+npx create-openagent@0.5.0 my-agent-app --yes
 cd my-agent-app
 npm install
 npm run dev
@@ -15,7 +15,9 @@ In a second terminal, run `npm run agent`. It signs an actual server-issued
 challenge; the receiver verifies the signature and current trust and consumes
 the challenge exactly once. The viewer uses Autos by default, offers all 17 families and 62 kinds with face
 framing (including SpaceX and holiday characters), and updates from actual verified requests. It uses the same SDK player you can
-mount in your own UI.
+mount in your own UI. SDK 0.7.0 adds soft plush as the default finish, flat material
+as an option, and on-face or raised eye placement on every family. Those controls
+keep the selected accessories and actual verified-request state intact.
 
 Node 20+ is required. Private keys and receiver state stay in the generated
 application's ignored local data directory. Preserve this directory across

package/dist/index.js

@@ -8,7 +8,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "create-openagent",
-  version: "0.4.0",
+  version: "0.5.0",
   description: "Create a working OpenAgentID app with local identity, real verification and live avatars.",
   license: "Apache-2.0 OR MIT",
   author: "L1fe Labs, Inc. <eng@l1fe.ai>",
@@ -155,7 +155,7 @@ function generateStarterTemplate(projectName) {
         identity: "node src/identity.mjs",
         test: "node --test test/*.test.mjs"
       },
-      dependencies: { "@openagentid/sdk": "0.6.0" }
+      dependencies: { "@openagentid/sdk": "0.7.0" }
     }, null, 2) + "\n" },
     { path: ".gitignore", content: "node_modules/\n.openagent/\ncoverage/\n.env\n" },
     { path: "src/workspaces.mjs", content: workspaces },
@@ -433,6 +433,8 @@ var html = String.raw`<!doctype html>
 <p id="identity"></p><div class="controls"><label>Family <select id="skin"></select></label>
 <label>Kind <select id="shape"></select></label>
 <label>Expression <select id="expression"><option value="">Follow actual status</option></select></label></div>
+<div class="controls"><label>Finish <select id="finish"><option value="plush">Soft plush</option><option value="flat">Flat vector</option></select></label>
+<label>Eyes <select id="eye-placement"><option value="face">On face</option><option value="raised">Raised</option></select></label></div>
 <fieldset><legend>Accessories</legend><div id="accessories" class="controls"></div></fieldset>
 <p>In another terminal, run:</p><pre>npm run agent -- "Hello from my agent"</pre>
 <p>This viewer is read-only. A completed request appears after the receiver verifies a fresh signed proof.</p>
@@ -444,6 +446,8 @@ var viewer = String.raw`import { mountCharacter, getCharacterExpressions, getCha
 
 const skin = document.querySelector('#skin');
 const shape = document.querySelector('#shape');
+const finish = document.querySelector('#finish');
+const eyePlacement = document.querySelector('#eye-placement');
 const catalog = getCharacterSkins();
 const accessories = document.querySelector('#accessories');
 const selectedAccessories = () => Array.from(accessories.querySelectorAll('input:checked'), input => input.value);
@@ -469,6 +473,8 @@ for (const value of getCharacterExpressions()) {
 let player, did, revision = -1, latestStatus = 'idle', stopped = false, timer;
 skin.addEventListener('change', () => { kinds(); player?.setAppearance({ skin: skin.value }); });
 shape.addEventListener('change', () => player?.setAppearance({ shape: shape.value || null }));
+finish.addEventListener('change', () => player?.setAppearance({ finish: finish.value }));
+eyePlacement.addEventListener('change', () => player?.setAppearance({ eyePlacement: eyePlacement.value }));
 accessories.addEventListener('change', () => player?.setAppearance({ accessories: selectedAccessories() }));
 expression.addEventListener('change', () => player?.update({ status: latestStatus, expression: expression.value || null }));
 async function refresh() {
@@ -481,7 +487,7 @@ async function refresh() {
         !['idle', 'working', 'success'].includes(state.status) || !Number.isSafeInteger(state.completedRequests) || state.completedRequests < 0) throw new Error('Invalid receiver state.');
     if (!player || state.did !== did) {
       player?.dispose(); document.querySelector('#avatar').replaceChildren();
-      did = state.did; player = mountCharacter(document.querySelector('#avatar'), did, { skin: skin.value, accessories: selectedAccessories(), ...(shape.value ? { shape: shape.value } : {}), size: 280, reducedMotion: 'system' });
+      did = state.did; player = mountCharacter(document.querySelector('#avatar'), did, { skin: skin.value, finish: finish.value, eyePlacement: eyePlacement.value, accessories: selectedAccessories(), ...(shape.value ? { shape: shape.value } : {}), size: 280, reducedMotion: 'system' });
       identity.textContent = did; revision = -1;
     }
     if (state.revision !== revision) {
@@ -502,7 +508,7 @@ Requires Node 20+. Run npm install, then npm run dev. Open the numeric loopback
 
     npm run agent -- "Hello from my agent"
 
-The command obtains a receiver-issued challenge, signs it with a persisted Ed25519 key, and sends a proof. After verification, the receiver hashes and echoes the message. The browser shows the real completed-request count, animated Autos by default, 16 optional families (including SpaceX and seasonal characters), distinct kinds, face framing, combinable glasses/headphones and selectable expressions. It does not simulate work or broadcast runtime state elsewhere. Reduced motion follows your browser preference.
+The command obtains a receiver-issued challenge, signs it with a persisted Ed25519 key, and sends a proof. After verification, the receiver hashes and echoes the message. The browser shows the real completed-request count, animated Autos by default, 16 optional families (including SpaceX and seasonal characters), distinct kinds, face framing, combinable glasses/headphones, soft plush by default with a flat-vector option, on-face or raised eyes and selectable expressions. It does not simulate work or broadcast runtime state elsewhere. Reduced motion follows your browser preference.
 
 On first setup, src/workspaces.mjs creates two separate local authorities, persists a unique receiver audience and explicitly imports the signer's public DID/key document into the receiver with trustIdentity. The receiver has no signing key for that agent. The public export is .openagent/identity.json. Private keys, challenge and replay state remain under .openagent/ and are excluded from git. Inspect public identity with npm run identity -- export. Never publish .openagent/ or serve it as static assets.
 
@@ -646,6 +652,12 @@ test('host, browser-origin, closed-schema and private/static paths are refused',
   const markup = await viewer.text();
   assert.match(markup, /<select id="skin"><\/select>/);
   assert.match(markup, /<select id="shape"><\/select>/);
+  assert.match(markup, /<select id="finish"><option value="plush">Soft plush<\/option><option value="flat">Flat vector<\/option>/);
+  assert.match(markup, /<select id="eye-placement"><option value="face">On face<\/option><option value="raised">Raised<\/option>/);
+  const viewerScript = await (await fetch(f.app.url + '/viewer.js')).text();
+  assert.match(viewerScript, /setAppearance\(\{ finish: finish.value \}\)/);
+  assert.match(viewerScript, /setAppearance\(\{ eyePlacement: eyePlacement.value \}\)/);
+  assert.match(viewerScript, /skin: skin.value, finish: finish.value, eyePlacement: eyePlacement.value, accessories: selectedAccessories\(\)/);
   const script = await fetch(f.app.url + '/character-player.js');
   assert.equal(script.status, 200); assert.match(await script.text(), /mountCharacter/);
   const huge = await post(f.app, '/request', { value: 'x'.repeat(25000) }); assert.equal(huge.status, 413);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openagent",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Create a working OpenAgentID app with local identity, real verification and live avatars.",
   "license": "Apache-2.0 OR MIT",
   "author": "L1fe Labs, Inc. <eng@l1fe.ai>",