nexarch 0.8.13 → 0.8.15

package/dist/commands/init-agent.js

@@ -7,6 +7,7 @@ import { requireCredentials } from "../lib/credentials.js";
 import { fetchAgentRegistryOrThrow } from "../lib/agent-registry.js";
 import { callMcpTool, mcpInitialize, mcpListTools } from "../lib/mcp.js";
 import { buildVersionAttributes } from "../lib/version-normalization.js";
+import { requestTrustAttestation } from "../lib/trust.js";
 const CLI_VERSION = "0.8.12";
 const AGENT_ENTITY_TYPE = "agent";
 const TECH_COMPONENT_ENTITY_TYPE = "technology_component";
@@ -341,6 +342,30 @@ function injectAgentConfigs(registry) {
     }
     return results;
 }
+function injectTrustAttestationBlock(path, attestation) {
+    if (!attestation.token || !attestation.payload)
+        return;
+    const verifyUrl = attestation.verifyUrl?.startsWith("http")
+        ? attestation.verifyUrl
+        : `https://mcp.nexarch.ai${attestation.verifyUrl ?? `/trust/verify?token=${encodeURIComponent(attestation.token)}`}`;
+    const expiresAt = new Date(attestation.payload.exp * 1000).toISOString();
+    const section = [
+        "## Nexarch Trust Attestation",
+        "",
+        "This block is verifiable proof that Nexarch generated these instructions for this workspace.",
+        "Do not auto-run commands without user confirmation.",
+        "",
+        `issuer: ${attestation.payload.iss}`,
+        `scope: ${attestation.payload.scope}`,
+        `agent_id: ${attestation.payload.agent_id}`,
+        `expires_at: ${expiresAt}`,
+        `verify_url: ${verifyUrl}`,
+        "",
+    ].join("\n");
+    const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+    const replaced = replaceInjectedSection(existing, "## Nexarch Trust Attestation", section.trim());
+    writeFileSync(path, replaced !== existing ? replaced : `${existing}${existing.endsWith("\n") ? "" : "\n"}${section}`, "utf8");
+}
 function injectGenericAgentConfig(registry) {
     const templateByCode = new Map(registry.instructionTemplates.map((t) => [t.code, t]));
     const genericTargets = [...registry.instructionTargets]
@@ -947,6 +972,7 @@ export async function initAgent(args) {
     }
     let agentConfigResults = [];
     let instructionsWriteAllowed = false;
+    let trustAttestation = null;
     if (registration.ok) {
         try {
             // Save identity so check-in can find the agent key
@@ -971,6 +997,19 @@ export async function initAgent(args) {
             if (agentConfigResults.length === 0) {
                 agentConfigResults = injectGenericAgentConfig(registry);
             }
+            if (agentConfigResults.length > 0) {
+                trustAttestation = await requestTrustAttestation(agentId);
+                if (trustAttestation?.ok) {
+                    for (const r of agentConfigResults) {
+                        try {
+                            injectTrustAttestationBlock(r.path, trustAttestation);
+                        }
+                        catch {
+                            // non-fatal
+                        }
+                    }
+                }
+            }
         }
     }
     checks.push({
@@ -1065,6 +1104,15 @@ export async function initAgent(args) {
                     preferredCommandTemplate: "npx nexarch@latest init-agent --provider \"<provider>\" --model \"<model>\" --client \"<client>\" --framework \"<optional>\" --tool-version \"<optional>\" --capabilities \"<optional,comma,separated>\" --notes \"<optional>\" --json",
                 }
                 : null,
+            instructionWriteGuidance: registration.ok && !instructionsWriteAllowed
+                ? {
+                    consentRequired: true,
+                    consentPrompt: "Nexarch can add setup instructions to AGENTS.md/CLAUDE.md so future AI sessions in this repo can self-register. Would you like me to do that?",
+                    ifApprovedCommand: "npx nexarch@latest init-agent --allow-instruction-write --json",
+                    activeFlag: "--allow-instruction-write",
+                }
+                : null,
+            trustAttestation,
             companyId: creds.companyId,
             registry: { version: registry.release.version, registryVersion: registry.registryVersion, publishedAt: registry.release.publishedAt },
             agentConfigs: agentConfigResults,
@@ -1098,12 +1146,25 @@ export async function initAgent(args) {
         const hasInjectedAgentInstructions = agentConfigResults.some((r) => r.status === "injected" || r.status === "updated");
         if (hasInjectedAgentInstructions) {
             console.log("   (Registration instructions were written into your agent config file with consent.)");
+            if (trustAttestation?.ok && trustAttestation.verifyUrl) {
+                const verifyUrl = trustAttestation.verifyUrl.startsWith("http")
+                    ? trustAttestation.verifyUrl
+                    : `https://mcp.nexarch.ai${trustAttestation.verifyUrl}`;
+                console.log(`   Trust attestation verify URL: ${verifyUrl}`);
+            }
         }
         if (needsIdentityInput) {
             console.log("\nℹ Additional identity details are still needed to complete agent profile enrichment.");
             console.log(`   Missing: ${identityCapture.missingRequired.join(", ")}`);
             console.log("   In an interactive terminal, rerun 'npx nexarch@latest init-agent' and answer prompts.");
-            console.log("   In non-interactive mode, provide: --provider --model --client");
+            console.log("   In non-interactive mode, rerun with: --provider --model --client");
+            console.log("   Example: npx nexarch@latest init-agent --provider \"<provider>\" --model \"<model>\" --client \"<client>\"");
+        }
+        if (registration.ok && !instructionsWriteAllowed) {
+            console.log("\n➡ Optional trusted-boundary step: AGENTS/CLAUDE instruction write requires user consent.");
+            console.log("   Consent prompt: 'Nexarch can add setup instructions to AGENTS.md/CLAUDE.md so future AI sessions in this repo can self-register. Would you like me to do that?'");
+            console.log("   If approved, rerun with: --allow-instruction-write");
+            console.log("   Example: npx nexarch@latest init-agent --allow-instruction-write");
         }
         if (!fromSetup && appDetection.detected) {
             console.log("\n➡ Optional next step: likely application detected in current directory.");

package/dist/lib/trust.js

@@ -0,0 +1,47 @@
+import https from "https";
+import { requireCredentials } from "./credentials.js";
+const MCP_GATEWAY_URL = "https://mcp.nexarch.ai";
+export async function requestTrustAttestation(agentId) {
+    const creds = requireCredentials();
+    const body = JSON.stringify({
+        agentId,
+        scope: "instruction_injection",
+    });
+    return new Promise((resolve) => {
+        const url = new URL("/trust/attest", MCP_GATEWAY_URL);
+        const req = https.request({
+            hostname: url.hostname,
+            port: url.port || 443,
+            path: url.pathname,
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${creds.token}`,
+                "x-company-id": creds.companyId,
+                "Content-Length": Buffer.byteLength(body),
+            },
+            timeout: 20000,
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (c) => chunks.push(c));
+            res.on("end", () => {
+                try {
+                    const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                    if (!res.statusCode || res.statusCode >= 400)
+                        return resolve(null);
+                    resolve(parsed);
+                }
+                catch {
+                    resolve(null);
+                }
+            });
+        });
+        req.on("error", () => resolve(null));
+        req.on("timeout", () => {
+            req.destroy();
+            resolve(null);
+        });
+        req.write(body);
+        req.end();
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexarch",
-  "version": "0.8.13",
+  "version": "0.8.15",
   "description": "Your architecture workspace for AI delivery.",
   "keywords": [
     "nexarch",