@aexhq/cli 0.19.0 → 0.21.0

package/dist/cli.mjs

@@ -126,6 +126,34 @@ var PROVIDER_PUBLIC_SUPPORT = {
     runtimeEvidence: {
       managed: COMMON_EVIDENCE
     }
+  },
+  // Doubao (ByteDance) via the official Ark API — international BytePlus gateway.
+  // Wired + parser/routing-verified but not yet proven against a live BytePlus
+  // account, so `live-unverified`. Promote to `supported` (and swap COMMON_EVIDENCE
+  // for a DOUBAO_MANAGED_EVIDENCE pointer to live-sdk-doubao.test.ts) once the
+  // live run passes.
+  doubao: {
+    displayName: "Doubao",
+    status: "live-unverified",
+    docsAnchor: "doubao",
+    docs: COMMON_DOCS,
+    evidence: COMMON_EVIDENCE,
+    runtimeEvidence: {
+      managed: COMMON_EVIDENCE
+    }
+  },
+  // Doubao (ByteDance) via the official Ark API — China Volcengine gateway.
+  // Same wiring as `doubao`; additionally gated on CF Worker egress reaching the
+  // Beijing host (see apps/egress-probe). `live-unverified` until proven live.
+  "doubao-cn": {
+    displayName: "Doubao (China)",
+    status: "live-unverified",
+    docsAnchor: "doubao-cn",
+    docs: COMMON_DOCS,
+    evidence: COMMON_EVIDENCE,
+    runtimeEvidence: {
+      managed: COMMON_EVIDENCE
+    }
   }
 };
 
@@ -144,7 +172,21 @@ var MODEL_PROVIDER_IDS = {
   "gemini-2.0-flash": { gemini: "gemini-2.0-flash", openrouter: "google/gemini-2.0-flash-001" },
   "gemini-2.5-flash": { gemini: "gemini-2.5-flash" },
   "mistral-large-latest": { mistral: "mistral-large-latest" },
-  "mistral-small-latest": { mistral: "mistral-small-latest" }
+  "mistral-small-latest": { mistral: "mistral-small-latest" },
+  // Doubao (ByteDance) via the official Ark API. Served by both the
+  // international BytePlus ModelArk gateway (`doubao`, the default) and the
+  // China Volcengine Ark gateway (`doubao-cn`). Ark accepts the API-format
+  // model NAME directly in the chat-completions `model` field (no `ep-…`
+  // inference-endpoint id). The native strings are the same Ark catalog ids on
+  // both gateways; BytePlus per-account availability is confirmed at live-verify
+  // (both providers ship `live-unverified` until then — provider-support.ts).
+  //   pro   — Doubao Seed 1.8 (flagship, 256K context).
+  //   flash — Doubao Seed 1.6 Flash (fast/cheap, 256K context).
+  "doubao-seed-pro": { doubao: "doubao-seed-1-8-251228", "doubao-cn": "doubao-seed-1-8-251228" },
+  "doubao-seed-flash": {
+    doubao: "doubao-seed-1-6-flash-250828",
+    "doubao-cn": "doubao-seed-1-6-flash-250828"
+  }
 };
 var RUN_MODELS = Object.keys(MODEL_PROVIDER_IDS);
 var PROVIDERS_BY_MODEL = (() => {
@@ -743,7 +785,9 @@ var RUN_PROVIDERS = [
   "openai",
   "gemini",
   "mistral",
-  "openrouter"
+  "openrouter",
+  "doubao",
+  "doubao-cn"
 ];
 var DEFAULT_RUN_PROVIDER = "anthropic";
 var RUNTIME_KINDS = ["managed"];
@@ -794,7 +838,7 @@ function visitCustodyValue(input, path, findings) {
 }
 function scanStringValue(value, path, findings) {
   for (const pattern of forbiddenStringPatterns) {
-    if (pattern.regex.test(value)) {
+    if (matchesForbiddenPattern(pattern, value)) {
       findings.push(Object.freeze({
         path,
         reason: pattern.reason,
@@ -803,11 +847,32 @@ function scanStringValue(value, path, findings) {
     }
   }
 }
+function matchesForbiddenPattern(pattern, value) {
+  if (!pattern.accept) {
+    return pattern.regex.test(value);
+  }
+  const scan = pattern.regex.global ? pattern.regex : new RegExp(pattern.regex.source, `${pattern.regex.flags}g`);
+  scan.lastIndex = 0;
+  let match;
+  while ((match = scan.exec(value)) !== null) {
+    if (pattern.accept(match[0])) {
+      return true;
+    }
+    if (match.index === scan.lastIndex) {
+      scan.lastIndex++;
+    }
+  }
+  return false;
+}
 var forbiddenStringPatterns = Object.freeze([
   { reason: "bearer_token", regex: /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/i },
   {
     reason: "provider_key",
-    regex: /\b(?:sk-(?:ant|proj|live|test|deepseek|openai)|xox[baprs]-|AIza)[A-Za-z0-9_-]{8,}/i
+    // Prefixed provider keys (`sk-…`, Slack `xox*-…`, Google `AIza…`). The bare
+    // `sk-` body is intentionally generic so an unrecognised vendor's `sk-` key
+    // (e.g. DeepSeek `sk-<hex>`, OpenRouter `sk-or-…`) is still caught by shape,
+    // not left to the narrowed entropy catch-all below.
+    regex: /\b(?:sk-[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{8,}|AIza[A-Za-z0-9_-]{8,})/i
   },
   { reason: "signed_url", regex: /[?&](?:X-Amz-Signature|X-Amz-Credential|X-Amz-Algorithm|AWSAccessKeyId)=/i },
   { reason: "object_store_key", regex: /(^|[\s"'`])(?:runs|assets)\/[^?<#\s"'`]+/i },
@@ -816,8 +881,59 @@ var forbiddenStringPatterns = Object.freeze([
     reason: "private_resource_handle",
     regex: /\b(?:machine|session|agent|file|skill|env|resource|handle|token_hash|bearer_hash)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i
   },
-  { reason: "high_entropy_token", regex: /\b(?=[A-Za-z0-9_-]{40,}\b)(?=.*[A-Za-z])(?=.*\d)[A-Za-z0-9_-]{40,}\b/ }
+  {
+    reason: "high_entropy_token",
+    // Catch-all for an unrecognised opaque secret blob. The candidate run
+    // EXCLUDES `_` (so `SCREAMING_SNAKE` env names and `slug_with_words` URL
+    // segments split instead of fusing into a phantom 40-char run — the live
+    // false positive was `ted_season_2_peacock_official_discussion_thread` in
+    // web-search result text and a fetched URL), and the `accept` predicate
+    // vetoes content-addressed hashes (md5/sha1/sha256 digests — the platform's
+    // OWN asset filenames) and low-entropy / single-class runs so only genuine
+    // opaque secrets remain. Slash-bearing secrets (signed URLs, connection
+    // strings, `Bearer …`) are covered by the named patterns above.
+    regex: /\b[A-Za-z0-9-]{40,}\b/,
+    accept: isHighEntropySecretRun
+  }
 ]);
+var CONTENT_HASH_RUN = /^(?:[0-9a-f]{32}|[0-9a-f]{40}|[0-9a-f]{64})$/i;
+function isHighEntropySecretRun(run) {
+  if (CONTENT_HASH_RUN.test(run)) {
+    return false;
+  }
+  if (!/[A-Za-z]/.test(run) || !/\d/.test(run)) {
+    return false;
+  }
+  if (highEntropyCharClassCount(run) < 2) {
+    return false;
+  }
+  return highEntropyShannonBits(run) >= 3;
+}
+function highEntropyCharClassCount(value) {
+  let count = 0;
+  if (/[a-z]/.test(value))
+    count++;
+  if (/[A-Z]/.test(value))
+    count++;
+  if (/[0-9]/.test(value))
+    count++;
+  return count;
+}
+function highEntropyShannonBits(value) {
+  if (value.length === 0) {
+    return 0;
+  }
+  const counts = /* @__PURE__ */ new Map();
+  for (const char of value) {
+    counts.set(char, (counts.get(char) ?? 0) + 1);
+  }
+  let bits = 0;
+  for (const count of counts.values()) {
+    const p = count / value.length;
+    bits -= p * Math.log2(p);
+  }
+  return bits;
+}
 function isForbiddenCustodyFieldName(key) {
   return /^(apiKey|secretValue|bearerHash|signedUrl|objectStoreKey|objectKey|vaultId|providerResponseBody|responseBody|privateResourceHandle|resourceHandle|rawBody)$/i.test(key);
 }
@@ -1246,11 +1362,13 @@ __export(operations_exports, {
   createAgentsMd: () => createAgentsMd,
   createFile: () => createFile,
   createOutputLink: () => createOutputLink,
+  createSecret: () => createSecret,
   createSkillBundle: () => createSkillBundle,
   createSkillBundleDirect: () => createSkillBundleDirect,
   deleteAgentsMd: () => deleteAgentsMd,
   deleteFile: () => deleteFile,
   deleteRun: () => deleteRun,
+  deleteSecret: () => deleteSecret,
   deleteSkill: () => deleteSkill,
   deleteWorkspaceAsset: () => deleteWorkspaceAsset,
   download: () => download,
@@ -1265,13 +1383,17 @@ __export(operations_exports, {
   getFile: () => getFile,
   getRun: () => getRun,
   getRunUnit: () => getRunUnit,
+  getSecret: () => getSecret,
   getSkill: () => getSkill,
   listAgentsMd: () => listAgentsMd,
   listFiles: () => listFiles,
   listOutputs: () => listOutputs,
   listRunEvents: () => listRunEvents,
+  listSecrets: () => listSecrets,
   listSkills: () => listSkills,
   resolveOutputFileSelector: () => resolveOutputFileSelector,
+  revealSecret: () => revealSecret,
+  rotateSecret: () => rotateSecret,
   submitRun: () => submitRun,
   submitRunMultipart: () => submitRunMultipart,
   uploadWorkspaceAsset: () => uploadWorkspaceAsset,
@@ -2380,6 +2502,44 @@ function unwrapFile(result) {
   }
   return result;
 }
+async function createSecret(http, args) {
+  const result = await http.request("/api/secrets", {
+    method: "POST",
+    body: JSON.stringify({ name: args.name, value: args.value })
+  });
+  return unwrapSecret(result);
+}
+async function listSecrets(http) {
+  const result = await http.request("/api/secrets");
+  if (Array.isArray(result)) {
+    return result;
+  }
+  return result.secrets;
+}
+async function getSecret(http, name) {
+  const result = await http.request(`/api/secrets/${encodeURIComponent(name)}`);
+  return unwrapSecret(result);
+}
+async function revealSecret(http, name) {
+  return http.request(`/api/secrets/${encodeURIComponent(name)}/reveal`, {
+    method: "POST"
+  });
+}
+async function rotateSecret(http, args) {
+  const result = await http.request(`/api/secrets/${encodeURIComponent(args.name)}/rotate`, { method: "POST", body: JSON.stringify({ value: args.value }) });
+  return unwrapSecret(result);
+}
+async function deleteSecret(http, name) {
+  await http.request(`/api/secrets/${encodeURIComponent(name)}`, {
+    method: "DELETE"
+  });
+}
+function unwrapSecret(result) {
+  if (result && typeof result === "object" && "secret" in result) {
+    return result.secret;
+  }
+  return result;
+}
 function unwrapSkill(result) {
   if (result && typeof result === "object" && "skill" in result) {
     return result.skill;

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-479aa815e56005b54f89791ddaac4e41b564ffc377e3077deb11258dba46aaf5  cli.mjs
+d05e5e074b577553d20fa3680f834b7941fe0cb7692c0a743975fcf36c4ec9b5  cli.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexhq/cli",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/aexhq/aex.git"
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "fflate": "^0.8.2",
-    "@aexhq/contracts": "0.19.0"
+    "@aexhq/contracts": "0.21.0"
   },
   "devDependencies": {
     "esbuild": "^0.28.0"