witnora 0.10.2 → 0.10.3

package/README.md

@@ -26,6 +26,13 @@ boundary, writes only missing configuration, and verifies the local evidence
 path. `.witnora/onboarding/receipt.json` is synthetic: it cannot create a run,
 evidence object, release decision, or `CURRENT` assurance.
 
+After the connection self-test, Hosted shows one template-specific next step.
+Place the generated boundary in one meaningful sandbox workflow and run it
+normally. The generated local adapter reuses the saved restricted connection;
+CI and production should use the same project-scoped values from a secret
+manager. The first non-synthetic run completes onboarding, but remains
+`reported` evidence and does not establish a release decision or `CURRENT`.
+
 Without an agent repository, run `npx witnora@latest try --template workflow`
 for an offline-only sample.
 

package/dist/onboard.js

@@ -4,7 +4,7 @@ import { access, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { DEFAULT_WITNORA_SERVER, saveConnection } from "./credentials.js";
 import { verifyControlPlaneConnection } from "./control-plane.js";
-import { parseAgentTemplate, starterAdapter, starterProfile, starterTripwireConfig } from "./onboarding-templates.js";
+import { parseAgentTemplate, starterAdapter, starterInstructions, starterProfile, starterTripwireConfig } from "./onboarding-templates.js";
 import { writeTryEvidence } from "./try.js";
 export async function runOnboard(options) {
     const requestFetch = options.fetch ?? fetch;
@@ -47,6 +47,7 @@ export async function runOnboard(options) {
     output(`Project: ${token.projectId}\nTemplate: ${repository.template} (${repository.kind})\n`);
     output(`Credentials: ${credentialsPath}\nSelf-test receipt: ${receiptPath}\n`);
     output("The synthetic self-test verified the local evidence path. It did not create a run, evidence object, release decision, or CURRENT assurance.\n");
+    output(starterInstructions(repository.template, repository.name));
     return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
         repositoryKind: repository.kind, generatedFiles, receiptPath };
 }

package/dist/onboarding-templates.js

@@ -33,10 +33,13 @@ export function starterAdapter(template, subject) {
     return `#!/usr/bin/env node
 import { randomBytes, randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
 
-const baseUrl = brandedRequired("BASE_URL").replace(/\\\/$/, "");
-const projectId = brandedRequired("PROJECT_ID");
-const apiKey = brandedRequired("API_KEY");
+const connection = await resolveHostedConnection();
+const baseUrl = connection.baseUrl.replace(/\\\/$/, "");
+const projectId = connection.projectId;
+const apiKey = connection.apiKey;
 const agentId = branded("AGENT_ID") ?? ${JSON.stringify(subject)};
 const agentName = branded("AGENT_NAME") ?? humanize(agentId);
 const agentVersion = await discoverAgentVersion();
@@ -65,17 +68,29 @@ if (!response.ok) {
 }
 process.stdout.write(\`Recorded ${eventType} for ${subject}.\\n\`);
 
-function brandedRequired(suffix) {
-  const name = \`WITNORA_\${suffix}\`;
-  const value = process.env[name] ?? process.env[\`AGENTCERT_\${suffix}\`];
-  if (!value) throw new Error(\`\${name} is required. Connect the Witnora CLI or set the hosted project variables. Legacy AGENTCERT_* names remain supported.\`);
-  return value;
-}
-
 function branded(suffix) {
   return process.env[\`WITNORA_\${suffix}\`] ?? process.env[\`AGENTCERT_\${suffix}\`];
 }
 
+async function resolveHostedConnection() {
+  const environment = {
+    baseUrl: branded("BASE_URL"),
+    projectId: branded("PROJECT_ID"),
+    apiKey: branded("API_KEY"),
+  };
+  if (environment.baseUrl && environment.projectId && environment.apiKey) return environment;
+  const configHome = process.env.WITNORA_CONFIG_HOME ?? process.env.AGENTCERT_CONFIG_HOME ?? join(homedir(), ".witnora");
+  try {
+    const credentials = JSON.parse(await readFile(join(configHome, "credentials.json"), "utf8"));
+    const name = process.env.WITNORA_CONNECTION ?? credentials.defaultConnection;
+    const saved = credentials.connections?.[name];
+    if (saved?.server && saved?.projectId && saved?.apiKey) {
+      return { baseUrl: saved.server, projectId: saved.projectId, apiKey: saved.apiKey };
+    }
+  } catch {}
+  throw new Error("No Witnora connection is available. Run witnora onboard --project <project-id> locally, or set WITNORA_BASE_URL, WITNORA_PROJECT_ID, and WITNORA_API_KEY in the runtime secret manager.");
+}
+
 function humanize(value) {
   const unscoped = value.includes("/") ? value.slice(value.lastIndexOf("/") + 1) : value;
   return unscoped.replace(/[-_.]+/g, " ").replace(/\\b\\w/g, (character) => character.toUpperCase()).trim();
@@ -117,19 +132,19 @@ export function starterInstructions(template, subject) {
 Next:
   1. Edit tripwire.yml so startUrl and agent.command/agent.args match your app and browser agent.
   2. Run in CI with Kakarottoooo/agentcert/actions/tripwire@v0, or re-run init with --github-action.
-  3. Run: npx witnora@latest run --tripwire .tripwire/latest/tripwire-result.json --subject ${JSON.stringify(subject)} --fail-on-verdict
+  3. Run: npx witnora@latest run --tripwire .tripwire/latest/tripwire-result.json --subject ${JSON.stringify(subject)} --fail-on-verdict --push
 `;
     if (template === "mcp")
         return `
 Next:
   1. Run MCPBench and write its JSON result to .mcpbench/latest/results.json.
-  2. Run: npx witnora@latest run --mcpbench .mcpbench/latest/results.json --subject ${JSON.stringify(subject)} --fail-on-verdict
+  2. Run: npx witnora@latest run --mcpbench .mcpbench/latest/results.json --subject ${JSON.stringify(subject)} --fail-on-verdict --push
 `;
     return `
 Next:
   1. Wrap the meaningful ${template} agent boundary with witnora.adapter.mjs or copy its envelope call into your framework hook.
-  2. Set WITNORA_BASE_URL, WITNORA_PROJECT_ID, and WITNORA_API_KEY in your secret manager. Legacy AGENTCERT_* names remain supported.
-  3. Run: node witnora.adapter.mjs
+  2. Run one sandbox workflow normally. For a local boundary check, run: node witnora.adapter.mjs
+  3. Local runs reuse the restricted connection saved by onboard. In CI or production, set WITNORA_BASE_URL, WITNORA_PROJECT_ID, and WITNORA_API_KEY in your secret manager.
   4. Generate and push a full evidence bundle when the workflow reaches a deterministic verification point.
 `;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",