witnora 0.10.3 → 0.11.0

package/README.md

@@ -26,6 +26,44 @@ boundary, writes only missing configuration, and verifies the local evidence
 path. `.witnora/onboarding/receipt.json` is synthetic: it cannot create a run,
 evidence object, release decision, or `CURRENT` assurance.
 
+Onboarding also performs the default private capability discovery locally. It
+does not read source-file contents or upload source code, prompt text,
+credentials, tool inputs, tool outputs, database rows, or file contents. It
+uploads a signed snapshot containing generalized capability metadata and
+digests. Refresh it later with:
+
+```bash
+npx witnora@latest discover
+```
+
+Customers that do not permit repository metadata inspection can choose
+runtime-only discovery in Hosted. Source-assisted analysis is a separate,
+explicit GitHub authorization and is never enabled implicitly.
+
+### Customer-owned Gateway
+
+For a durable recorder that runs beside the Agent in the customer environment,
+choose **Customer-owned Gateway** in Hosted and run:
+
+```bash
+npx witnora@latest gateway init --project your-project-id
+npx witnora@latest gateway doctor
+npx witnora@latest gateway run
+```
+
+Initialization writes a reusable `.witnora/gateway/client.mjs`. Import its
+`witnoraGateway.start`, `event`, and `complete` methods at one existing sandbox
+workflow boundary. The generated README contains the exact code and privacy
+boundary; no Hosted key or source-signing key is written into the repository.
+
+The browser approval issues only `runs:read`, `events:write`, and
+`collector:manage`. The Hosted key is stored in the user's Witnora credential
+directory; the repository contains only metadata-only config plus ignored local
+secrets and queue data. This reference path establishes **RECORDED** evidence.
+It does not claim **ENFORCED** until target write credentials are placed behind a
+controlled execution adapter, or **OUTCOME VERIFIED** until an independent
+read-only probe checks the target state.
+
 After the connection self-test, Hosted shows one template-specific next step.
 Place the generated boundary in one meaningful sandbox workflow and run it
 normally. The generated local adapter reuses the saved restricted connection;

package/dist/cli.js

@@ -36,6 +36,9 @@ import { runAssuranceLoopDemo } from "./assurance-loop-demo.js";
 import { importGenericEval, renderGenericEvalReport } from "./generic-eval.js";
 import { runDesignPartnerCommand } from "./design-partner-v02.js";
 import { runOnboard } from "./onboard.js";
+import { inspectRepository } from "./onboard.js";
+import { runPrivateCapabilityDiscovery } from "./private-discovery.js";
+import { doctorCustomerGateway, initializeCustomerGateway, renderGatewayDoctor, runCustomerGateway } from "./gateway.js";
 import { verifyEvidencePacketV02 } from "./evidence-v02.js";
 process.on("uncaughtException", reportFatalError);
 process.on("unhandledRejection", reportFatalError);
@@ -155,6 +158,50 @@ else if (command === "onboard") {
         openBrowser: readBoolFlag("--no-browser") ? async () => { } : undefined,
     });
 }
+else if (command === "gateway") {
+    const action = process.argv[3] ?? "help";
+    if (action === "init") {
+        const projectId = readFlag("--project") ?? brandedEnvironment("PROJECT_ID");
+        if (!projectId)
+            throw new Error("--project <project-id> is required.");
+        await initializeCustomerGateway({
+            projectId,
+            server: readFlag("--server") ?? brandedEnvironment("BASE_URL") ?? DEFAULT_WITNORA_SERVER,
+            repository: readFlag("--repo") ?? process.cwd(),
+            outDir: readFlag("--dir"),
+            connectionName: readFlag("--name"),
+            force: readBoolFlag("--force"),
+            openBrowser: readBoolFlag("--no-browser") ? async () => { } : undefined,
+        });
+    }
+    else if (action === "doctor") {
+        const result = await doctorCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir") });
+        process.stdout.write(readBoolFlag("--json") ? `${JSON.stringify(result, null, 2)}\n` : renderGatewayDoctor(result));
+        if (result.overall !== "READY_TO_RECORD")
+            process.exitCode = 1;
+    }
+    else if (action === "run") {
+        await runCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir") });
+    }
+    else {
+        throw new Error("Use witnora gateway init|doctor|run.");
+    }
+}
+else if (command === "discover") {
+    const connectionName = readFlag("--connection");
+    const connection = await resolveConnection({
+        name: connectionName,
+        server: readFlag("--server"),
+        projectId: readFlag("--project"),
+        apiKey: readFlag("--api-key"),
+    });
+    const repositoryPath = resolve(readFlag("--repo") ?? process.cwd());
+    const repository = await inspectRepository(repositoryPath, readFlag("--template") ? parseAgentTemplate(readFlag("--template")) : undefined);
+    const result = await runPrivateCapabilityDiscovery({ connection, repository, connectionName: connectionName ?? repository.slug });
+    process.stdout.write(`Private capability discovery completed.\n`);
+    process.stdout.write(`Capability groups: ${result.capabilityCount}\nUnknown groups awaiting review: ${result.unknownCapabilityCount}\n`);
+    process.stdout.write("Uploaded: signed capability metadata and digests only.\nStayed local: source code, prompts, credentials, tool inputs and outputs, database rows, and file contents.\n");
+}
 else if (command === "try") {
     const template = parseAgentTemplate(readFlag("--template") ?? "workflow");
     const subject = readFlag("--subject") ?? `witnora-sample-${template}`;

package/dist/command-help.js

@@ -1,6 +1,21 @@
 export function renderCommandHelp(command) {
     if (command === "sandbox" || command === "browser-adapter")
         return undefined;
+    if (command === "discover")
+        return `Usage:
+  witnora discover [--connection <name>] [--repo <directory>]
+
+Runs capability discovery inside the customer environment and uploads only a signed,
+metadata-only snapshot. Source code, prompt text, credentials, tool inputs and outputs,
+database rows, and file contents are not uploaded. New capability groups remain pending
+until reviewed or observed through a controlled runtime boundary.
+
+Options:
+  --connection <name>     Saved Hosted connection (default: current connection)
+  --repo <directory>      Repository whose local metadata is inspected (default: current directory)
+  --template <type>       Optional repository-type hint
+  --help, -h              Show this help
+`;
     if (command === "onboard")
         return `Usage:
   witnora onboard --project <project-id>
@@ -17,6 +32,31 @@ Options:
   --repo <directory>      Repository to configure (default: current directory)
   --template <type>       Override automatic repository detection
   --no-browser            Print the approval URL without opening it
+`;
+    if (command === "gateway")
+        return `Usage:
+  witnora gateway init --project <project-id>
+  witnora gateway doctor
+  witnora gateway run
+
+Initializes and runs a customer-owned, metadata-only collector beside the Agent.
+The browser approval issues a collector-scoped credential; no API key is copied into
+the repository or exposed to the Agent. The local queue and source signing key remain
+under customer control.
+
+The reference Gateway establishes RECORDED evidence only. ENFORCED requires target
+write credentials behind a controlled execution adapter. OUTCOME VERIFIED requires a
+separate read-only probe.
+
+Options:
+  --server <url>          Hosted server (default: https://witnora.com)
+  --project <id>          Project to authorize (required for init)
+  --repo <directory>      Agent repository (default: current directory)
+  --dir <directory>       Gateway directory (default: .witnora/gateway)
+  --name <name>           Saved collector connection name
+  --no-browser            Print the approval URL without opening it
+  --force                 Replace an existing reviewed local setup
+  --json                  JSON doctor output
 `;
     if (command === "design-partner")
         return `Usage:

package/dist/device-authorization.js

@@ -0,0 +1,69 @@
+import { createHash, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { DEFAULT_WITNORA_SERVER, saveConnection } from "./credentials.js";
+export async function authorizeProjectConnection(options) {
+    const requestFetch = options.fetch ?? fetch;
+    const sleep = options.sleep ?? ((milliseconds) => new Promise((resolveWait) => setTimeout(resolveWait, milliseconds)));
+    const output = options.output ?? ((message) => process.stdout.write(message));
+    const server = normalizeServer(options.server ?? DEFAULT_WITNORA_SERVER);
+    const codeVerifier = randomBytes(48).toString("base64url");
+    const codeChallengeSha256 = createHash("sha256").update(codeVerifier).digest("hex");
+    const device = await jsonRequest(requestFetch, `${server}/v1/onboarding/device-authorizations`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            projectId: options.projectId,
+            connectionName: options.connectionName,
+            credentialProfile: options.credentialProfile ?? "repository",
+            codeChallengeSha256,
+        }),
+    });
+    output(`Authorize Witnora in your browser:\n  ${device.verificationUriComplete}\nCode: ${device.userCode}\n`);
+    await (options.openBrowser ?? openSystemBrowser)(device.verificationUriComplete);
+    const token = await waitForToken(requestFetch, server, device, codeVerifier, sleep, options.timeoutMs ?? device.expiresIn * 1_000);
+    const credentialsPath = await saveConnection(token.connectionName, {
+        server,
+        projectId: token.projectId,
+        apiKey: token.apiKey,
+    }, { configHome: options.configHome });
+    return { ...token, server, credentialsPath };
+}
+async function waitForToken(requestFetch, server, device, codeVerifier, sleep, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const response = await requestFetch(`${server}/v1/onboarding/device-authorizations/token`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ deviceCode: device.deviceCode, codeVerifier }),
+        });
+        const body = await response.json().catch(() => ({}));
+        if (response.ok)
+            return body;
+        if (response.status !== 428 || body.code !== "authorization_pending") {
+            throw new Error(String(body.error ?? `Device authorization failed with HTTP ${response.status}.`));
+        }
+        await sleep(Math.max(1, device.interval) * 1_000);
+    }
+    throw new Error("Device authorization timed out. Run the command again to create a new one-time request.");
+}
+async function jsonRequest(requestFetch, url, init) {
+    const response = await requestFetch(url, init);
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(String(body.error ?? `${init.method ?? "GET"} ${url} failed with HTTP ${response.status}.`));
+    return body;
+}
+async function openSystemBrowser(url) {
+    const command = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: true });
+    child.unref();
+}
+function normalizeServer(value) {
+    const url = new URL(value);
+    const loopback = new Set(["localhost", "127.0.0.1", "[::1]"]).has(url.hostname);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+        throw new Error("Witnora server must use HTTPS. Plain HTTP is allowed only for localhost development.");
+    }
+    return url.toString().replace(/\/$/, "");
+}

package/dist/gateway.js

@@ -0,0 +1,209 @@
+import { randomBytes } from "node:crypto";
+import { access, chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { loadConnection } from "./credentials.js";
+import { authorizeProjectConnection } from "./device-authorization.js";
+const CONFIG_SCHEMA = "witnora.customer_gateway_setup.v0.1";
+const SECRETS_SCHEMA = "witnora.customer_gateway_local_secrets.v0.1";
+export async function initializeCustomerGateway(options) {
+    const repository = resolve(options.repository ?? process.cwd());
+    const outDir = resolve(repository, options.outDir ?? ".witnora/gateway");
+    const output = options.output ?? ((message) => process.stdout.write(message));
+    const slug = safeSlug(basename(repository));
+    const connectionName = options.connectionName ?? `${slug}-gateway`;
+    const configPath = join(outDir, "gateway.json");
+    const secretsPath = join(outDir, "secrets.json");
+    const gitignorePath = join(outDir, ".gitignore");
+    const readmePath = join(outDir, "README.md");
+    const clientPath = join(outDir, "client.mjs");
+    if (!(options.force ?? false)) {
+        const existing = (await Promise.all([configPath, secretsPath, gitignorePath, readmePath, clientPath].map(async (path) => await exists(path) ? path : undefined)))
+            .filter((path) => path !== undefined);
+        if (existing.length > 0) {
+            throw new Error(`Gateway setup already exists at ${existing.join(", ")}. Use --force only after reviewing the existing local setup.`);
+        }
+    }
+    const authorization = await authorizeProjectConnection({
+        projectId: options.projectId,
+        connectionName,
+        credentialProfile: "customer_gateway",
+        server: options.server,
+        openBrowser: options.openBrowser,
+        fetch: options.fetch,
+        sleep: options.sleep,
+        timeoutMs: options.timeoutMs,
+        output,
+        configHome: options.configHome,
+    });
+    const expectedScopes = ["runs:read", "events:write", "collector:manage"];
+    const missingScopes = expectedScopes.filter((scope) => !authorization.scopes.includes(scope));
+    if (missingScopes.length > 0)
+        throw new Error(`Gateway authorization is missing required scope(s): ${missingScopes.join(", ")}.`);
+    const config = {
+        schemaVersion: CONFIG_SCHEMA,
+        projectId: authorization.projectId,
+        server: authorization.server,
+        connectionName: authorization.connectionName,
+        collectorId: `${slug}-collector`,
+        host: "127.0.0.1",
+        port: 8787,
+        storageDirectory: "data",
+        privacyMode: "metadata_only",
+        coverage: { recorded: "configured", enforced: "not_configured", outcomeVerified: "not_configured" },
+    };
+    const secrets = {
+        schemaVersion: SECRETS_SCHEMA,
+        gatewayToken: randomBytes(32).toString("base64url"),
+    };
+    await mkdir(outDir, { recursive: true });
+    await writeExclusive(configPath, `${JSON.stringify(config, null, 2)}\n`, options.force ?? false, 0o644);
+    await writeExclusive(secretsPath, `${JSON.stringify(secrets, null, 2)}\n`, options.force ?? false, 0o600);
+    await writeExclusive(gitignorePath, "secrets.json\ndata/\n", options.force ?? false, 0o644);
+    await writeExclusive(clientPath, gatewayClient(config), options.force ?? false, 0o644);
+    await writeExclusive(readmePath, gatewayReadme(config), options.force ?? false, 0o644);
+    output("\nCustomer-owned Gateway initialized.\n");
+    output(`Configuration: ${configPath}\nLocal secret: ${secretsPath} (never commit or upload)\n`);
+    output("Next:\n");
+    output("  1. Run: npx witnora@latest gateway doctor\n");
+    output("  2. Run: npx witnora@latest gateway run\n");
+    output("  3. Import .witnora/gateway/client.mjs at one sandbox workflow boundary.\n");
+    output("  4. Run that workflow normally; start, event, and complete are recorded locally.\n");
+    output("This reference path establishes RECORDED evidence only. ENFORCED requires target write credentials behind a controlled execution adapter; OUTCOME VERIFIED requires a separate read-only probe.\n");
+    return { configPath, secretsPath, config };
+}
+export async function doctorCustomerGateway(options) {
+    const directory = resolve(options.repository ?? process.cwd(), options.dir ?? ".witnora/gateway");
+    const checks = [];
+    let config;
+    let secrets;
+    try {
+        config = parseConfig(await readFile(join(directory, "gateway.json"), "utf8"));
+        checks.push({ id: "configuration", status: "PASS", message: "Gateway configuration is valid and metadata-only." });
+    }
+    catch (error) {
+        checks.push({ id: "configuration", status: "FAIL", message: message(error) });
+    }
+    try {
+        secrets = parseSecrets(await readFile(join(directory, "secrets.json"), "utf8"));
+        checks.push({ id: "local_auth", status: "PASS", message: "A local Gateway token is present in the ignored customer-owned secret file." });
+    }
+    catch (error) {
+        checks.push({ id: "local_auth", status: "FAIL", message: message(error) });
+    }
+    if (config) {
+        try {
+            const connection = await loadConnection(config.connectionName, { configHome: options.configHome });
+            if (!connection || connection.projectId !== config.projectId || connection.server !== config.server)
+                throw new Error("The saved Gateway credential does not match gateway.json.");
+            checks.push({ id: "hosted_credential", status: "PASS", message: "The collector-scoped Hosted credential is stored outside the repository." });
+        }
+        catch (error) {
+            checks.push({ id: "hosted_credential", status: "FAIL", message: message(error) });
+        }
+        try {
+            const response = await (options.fetch ?? fetch)(`http://${config.host}:${config.port}/healthz`, { signal: AbortSignal.timeout(800) });
+            if (!response.ok)
+                throw new Error(`Gateway health returned HTTP ${response.status}.`);
+            checks.push({ id: "process", status: "PASS", message: `Gateway is listening at http://${config.host}:${config.port}.` });
+        }
+        catch {
+            checks.push({ id: "process", status: "WARN", message: "Gateway is not running yet. Start it with `witnora gateway run`." });
+        }
+    }
+    if (config && secrets) {
+        checks.push({ id: "enforcement", status: "WARN", message: "Write-credential mediation is not configured; current evidence ceiling is RECORDED." });
+        checks.push({ id: "outcome_probe", status: "WARN", message: "An independent read-only outcome probe is not configured." });
+    }
+    const failed = checks.some((check) => check.status === "FAIL");
+    return {
+        schemaVersion: "witnora.customer_gateway_doctor.v0.1",
+        overall: failed ? "SETUP_INCOMPLETE" : "READY_TO_RECORD",
+        checks,
+        evidenceCeiling: "recorded",
+        nextAction: failed ? "Run `witnora gateway init --project <project-id>` again after resolving failed checks." : "Start the Gateway, then send one sandbox run through its local event API.",
+    };
+}
+export async function runCustomerGateway(options) {
+    const { CustomerSourceKeyRing, RemoteCollectorClient, startCustomerOwnedCollectorGateway, } = await import("agentcert-sdk");
+    const directory = resolve(options.repository ?? process.cwd(), options.dir ?? ".witnora/gateway");
+    const config = parseConfig(await readFile(join(directory, "gateway.json"), "utf8"));
+    const secrets = parseSecrets(await readFile(join(directory, "secrets.json"), "utf8"));
+    const connection = await loadConnection(config.connectionName, { configHome: options.configHome });
+    if (!connection || connection.projectId !== config.projectId || connection.server !== config.server) {
+        throw new Error("The saved Gateway credential does not match gateway.json. Run gateway init again.");
+    }
+    const dataDirectory = resolve(directory, config.storageDirectory);
+    const keyRingPath = join(dataDirectory, "source-keys.json");
+    const keyRing = await (await exists(keyRingPath)
+        ? CustomerSourceKeyRing.open(keyRingPath)
+        : CustomerSourceKeyRing.create(keyRingPath, config.collectorId));
+    const gateway = await startCustomerOwnedCollectorGateway({
+        client: new RemoteCollectorClient({ baseUrl: connection.server, projectId: connection.projectId, apiKey: connection.apiKey }),
+        keyRing,
+        gatewayToken: secrets.gatewayToken,
+        storageDirectory: dataDirectory,
+        host: config.host,
+        port: config.port,
+        environment: "customer-owned",
+    });
+    process.stdout.write(`Witnora customer-owned Gateway listening on ${gateway.baseUrl}\n`);
+    process.stdout.write("Evidence ceiling: RECORDED. No target write credential or outcome-probe credential is loaded by this reference process.\n");
+    for (const signal of ["SIGINT", "SIGTERM"]) {
+        process.once(signal, () => void gateway.close().finally(() => process.exit(0)));
+    }
+}
+export function renderGatewayDoctor(result) {
+    return [
+        `Customer-owned Gateway: ${result.overall}`,
+        ...result.checks.map((check) => `${check.status.padEnd(4)} ${check.id}: ${check.message}`),
+        `Evidence ceiling: ${result.evidenceCeiling.toUpperCase()}`,
+        `Next: ${result.nextAction}`,
+        "",
+    ].join("\n");
+}
+function parseConfig(raw) {
+    const value = JSON.parse(raw);
+    if (value.schemaVersion !== CONFIG_SCHEMA || !value.projectId || !value.server || !value.connectionName || !value.collectorId) {
+        throw new Error("gateway.json is missing required Witnora Gateway fields.");
+    }
+    if (value.privacyMode !== "metadata_only")
+        throw new Error("Gateway privacyMode must remain metadata_only.");
+    if (!value.host || !Number.isSafeInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65_535)
+        throw new Error("Gateway host and port are invalid.");
+    return value;
+}
+function parseSecrets(raw) {
+    const value = JSON.parse(raw);
+    if (value.schemaVersion !== SECRETS_SCHEMA || typeof value.gatewayToken !== "string" || value.gatewayToken.length < 32) {
+        throw new Error("secrets.json is missing a valid local Gateway token.");
+    }
+    return value;
+}
+function gatewayReadme(config) {
+    return `# Witnora customer-owned Gateway\n\nThis directory configures a metadata-only Gateway for project \`${config.projectId}\`.\n\n## Start the Gateway\n\n\`\`\`bash\nnpx witnora@latest gateway doctor\nnpx witnora@latest gateway run\n\`\`\`\n\nKeep \`gateway run\` open. In the Agent repository, import the generated client at one meaningful sandbox workflow boundary:\n\n\`\`\`js\nimport { randomUUID } from "node:crypto";\nimport { witnoraGateway } from "./.witnora/gateway/client.mjs";\n\nconst runId = randomUUID();\nawait witnoraGateway.start(runId, { workflow: "sandbox-workflow" });\ntry {\n  // Run the existing customer workflow here. Do not add raw inputs or outputs.\n  await witnoraGateway.event(runId, "workflow.step.completed", { step: "meaningful-boundary" });\n  await witnoraGateway.complete(runId, { status: "completed" });\n} catch (error) {\n  await witnoraGateway.event(runId, "workflow.failed", { errorType: error?.name ?? "Error" });\n  await witnoraGateway.complete(runId, { status: "failed" });\n  throw error;\n}\n\`\`\`\n\nThe generated client reads only the local ignored Gateway token and sends metadata to \`http://${config.host}:${config.port}\`. The Hosted API key and source-signing key stay in the Gateway process. Do not commit \`secrets.json\` or \`data/\`.\n\nThis reference process creates source-signed, durable **RECORDED** evidence. It does not claim complete mediation. **ENFORCED** requires the target write credential to be removed from the Agent and placed behind a controlled execution adapter. **OUTCOME VERIFIED** requires a separate read-only credential and independent probe.\n`;
+}
+function gatewayClient(config) {
+    return `import { readFile } from "node:fs/promises";\n\nconst baseUrl = "http://${config.host}:${config.port}";\nlet gatewayToken;\n\nasync function token() {\n  if (gatewayToken) return gatewayToken;\n  const secrets = JSON.parse(await readFile(new URL("./secrets.json", import.meta.url), "utf8"));\n  if (typeof secrets.gatewayToken !== "string" || secrets.gatewayToken.length < 32) {\n    throw new Error("Witnora local Gateway token is missing or invalid.");\n  }\n  gatewayToken = secrets.gatewayToken;\n  return gatewayToken;\n}\n\nasync function post(runId, operation, body) {\n  if (!/^[A-Za-z0-9._:-]+$/.test(runId)) throw new Error("Witnora runId contains unsupported characters.");\n  const response = await fetch(\`\${baseUrl}/v1/runs/\${encodeURIComponent(runId)}/\${operation}\`, {\n    method: "POST",\n    headers: { authorization: \`Bearer \${await token()}\`, "content-type": "application/json" },\n    body: JSON.stringify(body),\n  });\n  const result = await response.json().catch(() => ({}));\n  if (!response.ok) throw new Error(result.error ?? \`Witnora Gateway returned HTTP \${response.status}.\`);\n  return result;\n}\n\nexport const witnoraGateway = {\n  start(runId, metadata = {}) {\n    return post(runId, "start", { payload: metadata, idempotencyKey: "run-start" });\n  },\n  event(runId, type, metadata = {}, idempotencyKey = \`\${type}-\${crypto.randomUUID()}\`) {\n    return post(runId, "events", { type, payload: metadata, idempotencyKey });\n  },\n  complete(runId, metadata = {}) {\n    return post(runId, "complete", {\n      payload: metadata,\n      evidenceStrength: {\n        schemaVersion: "agentcert.evidence_strength.v0.1",\n        level: "recorded",\n        claims: [],\n        limitations: ["No write-credential mediation or independent outcome probe is configured."],\n      },\n      idempotencyKey: "run-complete",\n    });\n  },\n};\n`;
+}
+async function writeExclusive(path, content, force, mode) {
+    if (!force && await exists(path))
+        throw new Error(`${path} already exists. Use --force only after reviewing the existing local Gateway setup.`);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, content, { encoding: "utf8", mode });
+    await chmod(path, mode).catch(() => undefined);
+}
+async function exists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function safeSlug(value) {
+    return (value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "agent-repository").slice(0, 48);
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/onboard.js

@@ -1,29 +1,32 @@
-import { createHash, randomBytes } from "node:crypto";
-import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
 import { access, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
-import { DEFAULT_WITNORA_SERVER, saveConnection } from "./credentials.js";
+import { DEFAULT_WITNORA_SERVER } from "./credentials.js";
+import { authorizeProjectConnection } from "./device-authorization.js";
 import { verifyControlPlaneConnection } from "./control-plane.js";
+import { inferPrivateCapabilities, runPrivateCapabilityDiscovery } from "./private-discovery.js";
 import { parseAgentTemplate, starterAdapter, starterInstructions, starterProfile, starterTripwireConfig } from "./onboarding-templates.js";
 import { writeTryEvidence } from "./try.js";
 export async function runOnboard(options) {
     const requestFetch = options.fetch ?? fetch;
-    const sleep = options.sleep ?? ((milliseconds) => new Promise((resolveWait) => setTimeout(resolveWait, milliseconds)));
     const output = options.output ?? ((message) => process.stdout.write(message));
     const server = normalizeServer(options.server ?? DEFAULT_WITNORA_SERVER);
     const repositoryPath = resolve(options.repository ?? process.cwd());
     const repository = await inspectRepository(repositoryPath, options.template);
     const connectionName = options.name ?? repository.slug;
-    const codeVerifier = randomBytes(48).toString("base64url");
-    const codeChallengeSha256 = createHash("sha256").update(codeVerifier).digest("hex");
-    const device = await jsonRequest(requestFetch, `${server}/v1/onboarding/device-authorizations`, {
-        method: "POST", headers: { "content-type": "application/json" },
-        body: JSON.stringify({ projectId: options.projectId, connectionName, codeChallengeSha256 }),
+    const token = await authorizeProjectConnection({
+        projectId: options.projectId,
+        connectionName,
+        credentialProfile: "repository",
+        server,
+        openBrowser: options.openBrowser,
+        fetch: requestFetch,
+        sleep: options.sleep,
+        timeoutMs: options.timeoutMs,
+        output,
+        configHome: options.configHome,
     });
-    output(`Authorize Witnora in your browser:\n  ${device.verificationUriComplete}\nCode: ${device.userCode}\n`);
-    await (options.openBrowser ?? openSystemBrowser)(device.verificationUriComplete);
-    const token = await waitForToken(requestFetch, server, device, codeVerifier, sleep, options.timeoutMs ?? device.expiresIn * 1_000);
-    const credentialsPath = await saveConnection(token.connectionName, { server, projectId: token.projectId, apiKey: token.apiKey }, { configHome: options.configHome });
+    const credentialsPath = token.credentialsPath;
     await verifyControlPlaneConnection({ baseUrl: server, projectId: token.projectId, apiKey: token.apiKey, fetch: requestFetch });
     const generatedFiles = await generateRepositoryConfig(repositoryPath, repository.template, repository.name);
     const selfTest = await writeTryEvidence({
@@ -43,30 +46,23 @@ export async function runOnboard(options) {
     const receiptPath = join(repositoryPath, ".witnora", "onboarding", "receipt.json");
     await mkdir(dirname(receiptPath), { recursive: true });
     await writeFile(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
+    const discovery = await runPrivateCapabilityDiscovery({
+        connection: { server, projectId: token.projectId, apiKey: token.apiKey },
+        repository,
+        connectionName: token.connectionName,
+        configHome: options.configHome,
+        fetch: requestFetch,
+    });
     output(`\nConnected ${repository.name} to Witnora.\n`);
     output(`Project: ${token.projectId}\nTemplate: ${repository.template} (${repository.kind})\n`);
     output(`Credentials: ${credentialsPath}\nSelf-test receipt: ${receiptPath}\n`);
+    output(`Private discovery: ${discovery.capabilityCount} capability group(s); source code, prompts, credentials, and payloads stayed local.\n`);
     output("The synthetic self-test verified the local evidence path. It did not create a run, evidence object, release decision, or CURRENT assurance.\n");
     output(starterInstructions(repository.template, repository.name));
     return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
-        repositoryKind: repository.kind, generatedFiles, receiptPath };
-}
-async function waitForToken(requestFetch, server, device, codeVerifier, sleep, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-        const response = await requestFetch(`${server}/v1/onboarding/device-authorizations/token`, {
-            method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ deviceCode: device.deviceCode, codeVerifier }),
-        });
-        const body = await response.json().catch(() => ({}));
-        if (response.ok)
-            return body;
-        if (response.status !== 428 || body.code !== "authorization_pending")
-            throw new Error(String(body.error ?? `Device authorization failed with HTTP ${response.status}.`));
-        await sleep(Math.max(1, device.interval) * 1_000);
-    }
-    throw new Error("Device authorization timed out. Run witnora onboard again to create a new one-time request.");
+        repositoryKind: repository.kind, generatedFiles, receiptPath, discovery };
 }
-async function inspectRepository(repositoryPath, explicitTemplate) {
+export async function inspectRepository(repositoryPath, explicitTemplate) {
     const entries = await readdir(repositoryPath, { withFileTypes: true });
     const names = entries.map((entry) => entry.name).sort();
     const packageJson = await optionalJson(join(repositoryPath, "package.json"));
@@ -82,7 +78,13 @@ async function inspectRepository(repositoryPath, explicitTemplate) {
     const name = rawName.replace(/^@[^/]+\//, "") || "agent-repository";
     const slug = (name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "agent-repository").slice(0, 64);
     const fingerprintSha256 = createHash("sha256").update(JSON.stringify({ kind, name, files: names.filter((value) => !value.startsWith(".")).slice(0, 200) })).digest("hex");
-    return { kind, name, slug, template, fingerprintSha256 };
+    const dependencyNames = packageJson ? [
+        ...Object.keys(record(packageJson.dependencies)),
+        ...Object.keys(record(packageJson.devDependencies)),
+        ...Object.keys(record(packageJson.peerDependencies)),
+    ] : [];
+    const capabilities = inferPrivateCapabilities({ dependencyNames, topLevelNames: names });
+    return { kind, name, slug, template, fingerprintSha256, capabilities };
 }
 async function generateRepositoryConfig(repositoryPath, template, subject) {
     const files = new Map();
@@ -109,12 +111,6 @@ async function jsonRequest(requestFetch, url, init) {
         throw new Error(String(body.error ?? `${init.method ?? "GET"} ${url} failed with HTTP ${response.status}.`));
     return body;
 }
-async function openSystemBrowser(url) {
-    const command = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
-    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
-    const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: true });
-    child.unref();
-}
 async function optionalJson(path) {
     try {
         return JSON.parse(await readFile(path, "utf8"));
@@ -131,3 +127,6 @@ catch {
     return false;
 } }
 function normalizeServer(value) { return new URL(value).toString().replace(/\/$/, ""); }
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}

package/dist/private-discovery.js

@@ -0,0 +1,146 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID, sign } from "node:crypto";
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+export async function runPrivateCapabilityDiscovery(input) {
+    const requestFetch = input.fetch ?? fetch;
+    const request = await jsonRequest(requestFetch, `${input.connection.server}/v1/projects/${encodeURIComponent(input.connection.projectId)}/private-discovery`, {
+        method: "POST",
+        headers: authorization(input.connection.apiKey),
+        body: JSON.stringify({ mode: "private_discovery" }),
+    });
+    const identityPath = discoveryIdentityPath(input.connection.projectId, input.configHome);
+    const identity = await loadOrCreateIdentity(identityPath, input.connection.projectId, input.connectionName);
+    const payload = {
+        schemaVersion: "witnora.private_capability_snapshot.v0.1",
+        requestId: request.id,
+        projectId: input.connection.projectId,
+        challenge: request.challenge,
+        collectorId: `private-discovery:${safeIdentifier(input.connectionName)}`,
+        mode: "private_discovery",
+        generatedAt: new Date().toISOString(),
+        repository: {
+            kind: input.repository.kind,
+            name: `repository-${input.repository.fingerprintSha256.slice(0, 12)}`,
+            fingerprintSha256: input.repository.fingerprintSha256,
+        },
+        privacy: {
+            sourceCodeUploaded: false,
+            rawPromptsUploaded: false,
+            credentialsUploaded: false,
+            payloadsUploaded: false,
+            localRedactionApplied: true,
+        },
+        capabilities: input.repository.capabilities,
+        unknownCapabilityCount: input.repository.capabilities.length,
+    };
+    const payloadSha256 = sha256(canonicalJson(payload));
+    const privateKey = createPrivateKey(identity.privateKeyPem);
+    const publicKey = createPublicKey(identity.publicKeyPem);
+    const snapshot = {
+        payload,
+        payloadSha256,
+        source: {
+            algorithm: "Ed25519",
+            keyId: identity.keyId,
+            publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+            publicKeySha256: sha256(publicKey.export({ type: "spki", format: "der" })),
+            signature: sign(null, Buffer.from(payloadSha256), privateKey).toString("base64url"),
+        },
+    };
+    const completed = await jsonRequest(requestFetch, `${input.connection.server}/v1/projects/${encodeURIComponent(input.connection.projectId)}/private-discovery/${encodeURIComponent(request.id)}/complete`, {
+        method: "POST",
+        headers: authorization(input.connection.apiKey),
+        body: JSON.stringify(snapshot),
+    });
+    return {
+        requestId: completed.id,
+        capabilityCount: input.repository.capabilities.length,
+        unknownCapabilityCount: completed.snapshot?.payload?.unknownCapabilityCount ?? input.repository.capabilities.length,
+        identityPath,
+    };
+}
+export function inferPrivateCapabilities(input) {
+    const searchable = [...input.dependencyNames, ...input.topLevelNames].join(" ").toLowerCase();
+    const detected = new Map();
+    const add = (key, observedName, transport) => detected.set(key, {
+        key,
+        observedName,
+        transport,
+        disposition: "pending",
+        schemaSha256: sha256(canonicalJson({ key, observedName, transport, source: "repository_metadata" })),
+        source: "repository_metadata",
+    });
+    add("workflow:orchestration", "Workflow orchestration", "workflow");
+    if (/playwright|puppeteer|browser-use|stagehand|selenium|computer-use/.test(searchable))
+        add("browser:automation", "Browser automation", "browser");
+    if (/modelcontextprotocol|(^|[^a-z])mcp([^a-z]|$)/.test(searchable))
+        add("mcp:tool-calling", "MCP tool calling", "mcp");
+    if (/axios|undici|node-fetch|httpx|requests|express|fastapi|fetch/.test(searchable))
+        add("http:tool-calling", "HTTP tool calling", "http");
+    if (/codex|aider|coding-agent|swe-agent|openhands/.test(searchable))
+        add("coding:workspace", "Coding workspace", "coding");
+    if (/pandas|duckdb|prisma|sequelize|sqlalchemy|postgres|sqlite|(^|[^a-z])(pg|sql)([^a-z]|$)/.test(searchable))
+        add("data:structured", "Structured data access", "data");
+    if (/slack|discord|twilio|resend|sendgrid|postmark|nodemailer|email/.test(searchable))
+        add("messaging:external", "External messaging", "messaging");
+    return [...detected.values()].sort((left, right) => left.key.localeCompare(right.key));
+}
+function discoveryIdentityPath(projectId, configHome) {
+    const root = configHome ?? process.env.WITNORA_CONFIG_HOME ?? process.env.AGENTCERT_CONFIG_HOME
+        ?? join(process.env.USERPROFILE ?? process.env.HOME ?? ".", ".witnora");
+    return join(root, "private-discovery", `${safeIdentifier(projectId)}.json`);
+}
+async function loadOrCreateIdentity(path, projectId, connectionName) {
+    try {
+        const parsed = JSON.parse(await readFile(path, "utf8"));
+        if (!parsed.keyId || !parsed.privateKeyPem || !parsed.publicKeyPem)
+            throw new Error("identity fields are missing");
+        return parsed;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw new Error(`Witnora private discovery identity is invalid: ${path}`);
+    }
+    const pair = generateKeyPairSync("ed25519");
+    const identity = {
+        keyId: `discovery:${safeIdentifier(connectionName)}:${sha256(projectId).slice(0, 12)}`,
+        privateKeyPem: pair.privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+        publicKeyPem: pair.publicKey.export({ type: "spki", format: "pem" }).toString(),
+    };
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(identity, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    await rename(temporary, path);
+    await chmod(path, 0o600).catch(() => undefined);
+    return identity;
+}
+function authorization(apiKey) {
+    return { authorization: `Bearer ${apiKey}`, "content-type": "application/json" };
+}
+async function jsonRequest(requestFetch, url, init) {
+    const response = await requestFetch(url, init);
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(String(body.error ?? `${init.method ?? "GET"} ${url} failed with HTTP ${response.status}.`));
+    return body;
+}
+function safeIdentifier(value) {
+    return value.trim().replace(/[^A-Za-z0-9._:-]+/g, "-").replace(/^-|-$/g, "").slice(0, 120) || "local";
+}
+function sha256(value) { return createHash("sha256").update(value).digest("hex"); }
+function canonicalJson(value) {
+    if (value === null || typeof value === "boolean" || typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error("Canonical JSON does not support non-finite numbers.");
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value && typeof value === "object")
+        return `{${Object.entries(value)
+            .filter(([, item]) => item !== undefined).sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
+    throw new Error("Canonical JSON contains an unsupported value.");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.10.3",
+  "version": "0.11.0",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",
@@ -66,5 +66,8 @@
   },
   "optionalDependencies": {
     "pg": "^8.16.3"
+  },
+  "dependencies": {
+    "agentcert-sdk": "0.5.0"
   }
 }