witnora 0.20.7 → 0.20.9

package/dist/cli.js

@@ -160,6 +160,7 @@ else if (command === "onboard") {
         repository: readFlag("--repo") ?? process.cwd(),
         template: readFlag("--template") ? parseAgentTemplate(readFlag("--template")) : undefined,
         actionTransport: readActionTransport(readFlag("--action-transport")),
+        waitForActionPathMs: readActionTransport(readFlag("--action-transport")) && !readBoolFlag("--no-wait-for-action-path") ? 10 * 60 * 1_000 : 0,
         openBrowser: readBoolFlag("--no-browser") ? async () => { } : undefined,
     });
 }

package/dist/onboard.js

@@ -125,6 +125,7 @@ export async function runOnboard(options) {
     let assuranceHarnessChanged = false;
     let httpActionSetup;
     let continuousService;
+    let localOutputTaskConfirmed = false;
     const prepareRuntime = async (operation) => {
         const delays = [250, 500, 1_000, 2_000, 4_000, 8_000];
         let lastError;
@@ -304,7 +305,7 @@ export async function runOnboard(options) {
         const runtimeReadiness = doctor.overall === "READY_FOR_RUNTIME" && runtimeBinding
             ? { state: "LOCAL_SANDBOX_READY", checkedAt: new Date().toISOString(), limitations: [] }
             : { state: "RECORDED_ONLY", checkedAt: new Date().toISOString(), limitations: [runtimeLimitation ?? "The local sandbox Runtime worker has not established exact adapter, probe, source-key, identity, mandate, and readiness bindings."] };
-        const actionTransportTest = options.actionTransport
+        let actionTransportTest = options.actionTransport
             ? await runActionTransportTest({
                 transport: options.actionTransport,
                 repository: repositoryPath,
@@ -319,12 +320,66 @@ export async function runOnboard(options) {
             : undefined;
         const localWorkflowCommand = await detectLocalWorkflowCommand(repositoryPath);
         const cliVersion = await currentCliVersion();
+        const agentRunCommand = localWorkflowCommand
+            ? `npx --yes witnora@${cliVersion} gateway exec -- ${localWorkflowCommand.join(" ")}`
+            : undefined;
         await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, {
             status: "verified", attemptId, generatedFiles: relativeGeneratedFiles(repositoryPath, generatedFiles), runtimeReadiness,
             connectedAgent: agentIdentity,
+            agentRunCommand,
             ...(runtimeBinding ? { runtimeBinding } : {}),
         });
-        output(`\nWitnora Setup Autopilot completed for ${repository.name}.\n`);
+        if (actionTransportTest?.state === "WAITING_FOR_ACTION_PATH" && (options.waitForActionPathMs ?? 0) > 0) {
+            output("\nBase setup is complete. Onboarding is waiting for the Business Task and Action path; it has not claimed completion.\n");
+            output(agentRunCommand
+                ? `Open a second terminal in this repository and run the Agent safely once:\n${agentRunCommand}\n`
+                : "Run the Agent normally in its sandbox. If it has no work now, you may enter the workspace and finish Action verification after its first real run.\n");
+            output(`Keep this command open for up to ${Math.max(1, Math.ceil((options.waitForActionPathMs ?? 0) / 60_000))} minutes. It will finish automatically after you confirm the Business Task in the browser; no second onboard command is required. Press Ctrl+C to pause safely.\n`);
+            const resolution = await waitForOnboardingResolution({
+                repository: repositoryPath, server, projectId: token.projectId, apiKey: token.apiKey,
+                env: options.env, fetch: requestFetch, sleep: options.sleep, timeoutMs: options.waitForActionPathMs ?? 0,
+            });
+            if (resolution?.kind === "LOCAL_OUTPUT") {
+                localOutputTaskConfirmed = true;
+                actionTransportTest = undefined;
+                if (assuranceHarnessReadiness.state === "WAITING_FOR_CUSTOMER_HARNESS") {
+                    assuranceHarnessReadiness = { state: "NOT_REQUIRED_FOR_LOCAL_OUTPUT" };
+                }
+            }
+            else if (resolution?.kind === "REAL_PATH") {
+                const lateActivation = resolution.activation;
+                realPathActivation = lateActivation;
+                generatedFiles.push(...lateActivation.generatedFiles);
+                const harness = await activateManagedWorkflowHarness({ repository: repositoryPath, realPathActivations: lateActivation.activations, previousGeneratedModuleSha256: lateActivation.previousGeneratedModuleSha256 });
+                if (harness.created)
+                    generatedFiles.push(harness.path);
+                assuranceHarnessReadiness = { state: "ACTIVE" };
+                httpActionSetup = await configureCustomerHttpAction({ repository: repositoryPath, activations: lateActivation.activations });
+                generatedFiles.push(...httpActionSetup.generatedFiles);
+                if (harness.changed || httpActionSetup.changed) {
+                    await stopGatewayOwners();
+                    if (!options.gatewayLifecycle) {
+                        await installCurrentGatewayService({ repository: repositoryPath, cliEntry: fileURLToPath(new URL("./cli.js", import.meta.url)), configHome: options.configHome });
+                        managedGateway = await waitForInstalledGatewayService({ repository: repositoryPath, fetch: requestFetch, sleep: options.sleep, timeoutMs: options.timeoutMs });
+                    }
+                    else {
+                        managedGateway = await gatewayLifecycle.start({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch, output });
+                    }
+                }
+                actionTransportTest = await runActionTransportTest({
+                    transport: options.actionTransport, repository: repositoryPath, server, projectId: token.projectId, apiKey: token.apiKey,
+                    repositoryIdentity: repository, httpActionReady: httpActionSetup.state === "READY" && Boolean(httpActionSetup.action),
+                    fetch: requestFetch, generatedFiles,
+                });
+                await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, {
+                    status: "verified", attemptId, generatedFiles: relativeGeneratedFiles(repositoryPath, generatedFiles), runtimeReadiness,
+                    connectedAgent: agentIdentity, agentRunCommand, ...(runtimeBinding ? { runtimeBinding } : {}),
+                });
+            }
+        }
+        output(actionTransportTest?.state === "WAITING_FOR_ACTION_PATH"
+            ? `\nWitnora base setup completed for ${repository.name}; Action onboarding is paused and still pending.\n`
+            : `\nWitnora Setup Autopilot completed for ${repository.name}.\n`);
         output(`Project: ${token.projectId}\nTemplate: ${repository.template} (${repository.kind})\n`);
         output(`Credentials: ${credentialsPath}\nSelf-test receipt: ${receiptPath}\n`);
         output(`Private discovery: ${discovery.capabilityCount} capability group(s); ${discovery.unknownCapabilityCount} pending confirmation.\n`);
@@ -337,7 +392,9 @@ export async function runOnboard(options) {
             : `Runtime: RECORDED_ONLY. ${runtimeReadiness.limitations[0]}\n`);
         output(assuranceHarnessReadiness.state === "ACTIVE"
             ? `Assurance Harness: ACTIVE. Nora can dispatch authority-ready Replay and no-write Shadow evaluations without manual Workflow IDs, evaluator origins, credentials, or contract digests.${realPathActivation.activations.length ? ` ${realPathActivation.activations.length} exact sandbox real-path binding(s) passed read-only preflight.` : ""}\n`
-            : `Assurance Harness: WAITING_FOR_CUSTOMER_HARNESS. ${assuranceHarnessReadiness.limitation}\n`);
+            : assuranceHarnessReadiness.state === "NOT_REQUIRED_FOR_LOCAL_OUTPUT"
+                ? "Assurance Harness: NOT_REQUIRED_FOR_LOCAL_OUTPUT. The approved read-only local-output task is confirmed; no external Action transport is required.\n"
+                : `Assurance Harness: WAITING_FOR_CUSTOMER_HARNESS. ${assuranceHarnessReadiness.limitation}\n`);
         if (httpActionSetup?.state === "READY" && httpActionSetup.action) {
             output(`HTTP Action: READY. POST ${managedGateway.baseUrl}${httpActionSetup.action.path}; copy the action-scoped token and request example from .witnora/gateway/HTTP_ACTION.md.\n`);
         }
@@ -347,11 +404,13 @@ export async function runOnboard(options) {
         else if (actionTransportTest) {
             output(`Action transport: ${actionTransportTest.transport.toUpperCase()} is waiting for one exact sandbox Task/action path. ${actionTransportTest.limitation}\n`);
         }
-        output(actionTransportTest?.state === "WAITING_FOR_ACTION_PATH"
-            ? `Base Gateway connected, but ${actionTransportTest.transport.toUpperCase()} Action is not verified yet. Run the Agent's normal sandbox workflow from this repository; there is no Run button in Overview. Once Overview receives the activity, confirm one sandbox Business Task and choose its exact discovered Agent action, then rerun this same command.\n`
-            : "Connected. Nora is monitoring this Agent. Run it normally whenever it is ready; the first source-signed activity will appear automatically without blocking setup.\n");
+        output(localOutputTaskConfirmed
+            ? "Connected. Nora is monitoring this Agent. The approved read-only local-output task is confirmed; no external Action transport is required.\n"
+            : actionTransportTest?.state === "WAITING_FOR_ACTION_PATH"
+                ? `Base Gateway connected, but ${actionTransportTest.transport.toUpperCase()} Action is not verified yet. Run the Agent once and confirm its Business Task in the browser. Recovery only: rerun this command if the original waiting process was closed.\n`
+                : "Connected. Nora is monitoring this Agent. Run it normally whenever it is ready; the first source-signed activity will appear automatically without blocking setup.\n");
         output(localWorkflowCommand
-            ? `Local sandbox command: npx --yes witnora@${cliVersion} gateway exec -- ${localWorkflowCommand.join(" ")}\n`
+            ? `Local sandbox command: ${agentRunCommand}\n`
             : `For a local sandbox workflow, use npx --yes witnora@${cliVersion} gateway exec -- <your normal sandbox command> so the Gateway token stays out of shell history.\n`);
         return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
             repositoryKind: repository.kind, generatedFiles, receiptPath, discovery, setupPlanId: setupPlan.id,
@@ -412,6 +471,24 @@ async function loadMatchingOnboardConnection(options) {
         return undefined;
     }
 }
+async function waitForOnboardingResolution(options) {
+    const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    let waited = 0;
+    let delay = 2_000;
+    while (waited < options.timeoutMs) {
+        const activation = await activateRealPathIntegrations(options);
+        if (activation.activations.length)
+            return { kind: "REAL_PATH", activation };
+        const onboarding = await jsonRequest(options.fetch, `${options.server}/v1/projects/${encodeURIComponent(options.projectId)}/onboarding`, { method: "GET", headers: { authorization: `Bearer ${options.apiKey}` } });
+        if (onboarding.localOutputTaskConfirmed)
+            return { kind: "LOCAL_OUTPUT" };
+        const interval = Math.min(delay, options.timeoutMs - waited);
+        await sleep(interval);
+        waited += interval;
+        delay = Math.min(15_000, Math.round(delay * 1.5));
+    }
+    return undefined;
+}
 async function runActionTransportTest(options) {
     if (!options.httpActionReady)
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.20.7",
+  "version": "0.20.9",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",