{
"$schema": "https://cmn.dev/schemas/v1/spore-core.json",
"id": "agent-first-http",
"name": "Agent-First HTTP",
"version": "0.12.0",
"domain": "agentfirstkit.com",
"key": "ed25519.BwbSzqdDYyMN1pPW5snRk3afrJAovHn8aueMvDpfNKVw",
"synopsis": "Give your AI agent its own private browser — so it reads the real page, past logins and bot walls, without ever touching yours.",
"intent": [
"Give AI agents a deterministic URL acquisition layer that reports status, final URL, headers, body artifacts, redirects, timing, and typed transport failures as structured JSONL instead of prose",
"Focus on pages and web resources that are hard for agents to acquire through a simple shell fetch: JavaScript-rendered, cookie- or session-bound, bot-walled, or XHR-injected pages a plain HTTP request cannot turn into usable artifacts",
"Preserve session identity for multi-step web workflows: scoped request defaults, concurrent requests, streaming bodies, downloads, and future browser-backed fetch state belong in one agent-readable session"
],
"license": "MIT",
"mutations": [
"Discover the standard local host for every command that needs one rather than only for fetch --takeover: with no --endpoint-url the local host container is inspected read-only, its token read from its own data volume, and /health verified before anything is sent",
"Never start or recreate a container while discovering, keep inline the default so a plain fetch needs no host at all, never second-guess an explicit --endpoint-url, and let fetch --profile discover instead of erroring when no endpoint is given",
"Let --token-secret name where a token lives rather than only carry it: env:NAME, file:PATH#DOT_PATH, container:NAME and literal:TOKEN, with container:NAME covering the host token in a named volume that no path on the machine can address",
"Classify token sources while argv is projected and read them only at connect time, so a rejected invocation never opens a file or spawns a container runtime and no error can echo what it read",
"Adopt the shared value-source grammar in place of a private copy, so an unaccepted source is refused as cli_invalid_argument_value at exit 2 while argv resolves, --token-secret prompt answers with what it does accept, and the syntax is rendered from the declaration instead of repeated across every reference row",
"Carry a resolved token as a secret-typed value end to end, exposing the bytes only where they are needed and rendering every other debug output as redacted",
"Require afhttp host to name the source of the token it demands from callers, with no environment fallback, so a server never inherits what it accepts from an ambient variable",
"Replace the private takeover handoff store with an Agent-First UI access token, gaining constant-time comparison and a revoke path the crate never had, and cleanup that no longer runs only when a credential is minted",
"Add afhttp ui takeover, which opens the takeover panel in an Agent-First UI window so the window closing is the signal that the person finished instead of the agent guessing",
"Emit a runnable client command from container install and status and from the entrypoint banner, instead of an AFHTTP_TOKEN_SECRET=<host-token> template to paste"
],
"bonds": [
{
"relation": "depends_on",
"uri": "cmn://agentfirstkit.com/b3.XWoP3CQVfssQGj63azRQnNKkSBEDVmaK5gdNHHAxffc",
"id": "agent-first-data",
"reason": "All request/response fields use Agent-First Data suffix conventions, and runtime protocol/log events are emitted on stdout only"
},
{
"relation": "depends_on",
"uri": "cmn://agentfirstkit.com/b3.GjeiTGxA14EuCQ4cNGAXEZxFa61k2C3zCZuJT1SW4cNC",
"id": "agent-first-ui",
"reason": "Every short-lived takeover panel credential is an Agent-First UI access token, and `afhttp ui takeover` opens the panel in an Agent-First UI window"
}
],
"tree": {
"algorithm": "blob_tree_blake3_nfc",
"exclude_names": [
".git",
".cmn"
],
"follow_rules": [
".gitignore"
]
}
}