Eve 0.66.0 is the supported baseline. Suite 0.2.7 contains deployment fixes and is not yet published; npm latest remains 0.2.6.

@tealbrick/kit

One installation, explicitly selected capabilities. The kit includes the currently implemented Portal, Voice, Vision, Deliver and AVM packages. Dependencies are code availability, not agent permissions. Nothing is mounted by installing the kit.

Install inside an existing Eve 0.66.0 project:

npm install --save-exact @tealbrick/[email protected]
npx --no-install tealbrick setup

The suite is published on npm. The kit does not install, create or start Eve. Create the Eve project first and configure its primary-model authentication. Eve 0.66.0 and Node 24 are the validated host versions; VM provisioning remains host setup. After Teal Brick setup, build and start Eve to make the agent usable.

See BOOTSTRAP.md for the complete deployment guide, including fresh-machine and existing-agent paths, provider prompts and verification.

Activation

tealbrick setup presents unchecked capability choices for a fresh project. It requires Portal device sign-in and workspace selection, then asks for optional capability settings. Review and apply the selection, then rebuild/restart Eve. tealbrick status reports the saved selection and mount paths.

| Choice | Exposed only when selected | |---|---| | Portal (required by setup) | Authenticated Eve channel and owned workspace agent card | | Voice | Voice manifest/session/transcribe/speak routes | | Vision | Vision manifest/analyze routes; optional native tool with trusted turn-auth module | | Deliver | Root deliver tool | | AVM | SSH inspection extension; no lifecycle mutation policy granted by setup |

Interactive setup always binds Portal identity; offline apply retains explicit configuration control. Native Vision needs an existing module under agent/lib/ default-exporting signed current-turn authorization headers. Setup never substitutes an owner token. Setup now registers and binds an agent card through existing Portal APIs and verifies workspace desktop discovery. Provider metadata synchronization and full live-voice client orchestration remain pending. The kit does not claim all planned Buzz/Knowledge/etc. work exists.

Deselecting a capability removes its kit-owned mounts. Unselected capabilities add no tools, instructions, skills, hooks, channels, connections or schedules. Existing Eve built-ins and separately installed extensions remain the host's responsibility. The running process must be rebuilt/reloaded before removal takes effect there.

Ownership and credentials

State lives in .tealbrick/kit-state.json. Generated mounts contain settings and secret references only. Optional local credentials go to owner-only .tealbrick/kit.credentials.json; /.tealbrick/ is added to .gitignore. Runtime environment values take precedence. Secrets are loaded lazily during requests, never to discover/build disabled features. Deploy credentials using the host's secret facility and keep the runtime working directory at the project root. On Windows, configure account ACLs as well as the file permissions.

Activation refuses to overwrite existing or operator-edited mounts. In particular, an existing agent/channels/eve.ts must be deliberately reconciled with Portal before kit management can own it. It never silently replaces another auth setup. Conflicting legacy standalone deliver mounts are likewise preserved. Deactivation keeps saved credentials; remove/revoke unused credentials separately when desired. A lock serializes kit operations; after a crashed operation inspect state/files before manually removing a stale .tealbrick/kit.lock.

The internal @tealbrick/provider-transport is installed automatically through Voice/Vision/Deliver. npm deduplicates compatible versions. It is never a setup checkbox, running service or model-provider registry. The former unpublished provider-runtime name has been replaced.

Reproducible configuration

tealbrick apply config.json applies a reviewed config; secrets must already be provided by runtime environment or the protected secret file. Empty config disables all kit-owned contributions:

{"version":1}

Programmatic planKit(config) returns exactly which files would be mounted. applyKit(projectRoot, config, credentials?) checks ownership before changes, rolls back ordinary write failures and reports the required reload. No remote writes, service restarts or provider calls occur on installation or activation.

Provider checks and native delivery-channel acceptance are separate. The terminal wizard can configure delivery storage but does not provision buckets or web servers. Tests validate empty/selected/deactivated discovery in a fresh packed Eve consumer, including a single deduplicated provider-transport installation.

AVMM profiles

The avm selection accepts the AVM package connection/policy schema: either {target,sudo} or {selectedProfile,profiles}. Setup can select a saved profile and preserves its grants. New connections can use paired AVMM users or operator SSH. Paired mode requires a dedicated SSH identity path and a resolvable hostname; no credentials are copied. Use tealbrick apply config.json for full workspace, ownership, sharing, pool and ingress grants. Disabling AVM removes its entire mount.