@aexhq/sdk 0.34.0 → 0.36.0

package/dist/cli.mjs

@@ -10,34 +10,6 @@ import { readFile, writeFile, readdir, stat, mkdir, chmod, rm } from "node:fs/pr
 import { resolve as resolvePath4, join, dirname as dirname2 } from "node:path";
 import { homedir } from "node:os";
 
-// ../contracts/dist/proxy-protocol.js
-var PROXY_PROTOCOL_VERSION_V2 = "2";
-var PROXY_PROTOCOL_HEADER = "x-aex-proxy-protocol";
-var PROXY_RESP_STATUS_HEADER = "x-aex-proxy-status";
-var PROXY_RESP_MODE_HEADER = "x-aex-proxy-effective-mode";
-var PROXY_RESP_TRUNCATED_HEADER = "x-aex-proxy-truncated";
-var PROXY_RESP_UPSTREAM_HEADERS_HEADER = "x-aex-proxy-upstream-headers";
-var PROXY_METHOD_HEADER = "x-aex-method";
-var PROXY_PATH_HEADER = "x-aex-path";
-var PROXY_QUERY_HEADER = "x-aex-query";
-var PROXY_HEADERS_HEADER = "x-aex-headers";
-var PROXY_RESPONSE_MODE_HEADER = "x-aex-response-mode";
-var PROXY_RESPONSE_MODES = ["status_only", "headers_only", "full"];
-var PROXY_ENDPOINT_DEFAULTS = {
-  allowHeaders: [],
-  responseMode: "headers_only",
-  // 10 MiB. The body is buffered in the hosted API to enforce this cap, while the
-  // launch default fits practical multimodal/tool POSTs without every endpoint
-  // needing an override.
-  maxRequestBytes: 10 * 1024 * 1024,
-  // Unlimited (0). The request body is buffered to enforce its cap, so that
-  // stays finite; the response is streamed, so it does not need one.
-  maxResponseBytes: 0,
-  // 5 minutes. Long-running upstream tool/model calls should not fail under a
-  // development-oriented 10s ceiling; endpoints can still set a smaller value.
-  timeoutMs: 5 * 60 * 1e3
-};
-
 // ../contracts/dist/provider-support.js
 var COMMON_DOCS = [
   { label: "Secrets", href: "secrets.md" },
@@ -392,7 +364,6 @@ function parseRunRequestConfig(input) {
     "environment",
     "runtimeSize",
     "timeout",
-    "proxyEndpoints",
     "metadata"
   ]);
   for (const key of Object.keys(record)) {
@@ -412,14 +383,13 @@ function parseRunRequestConfig(input) {
     ...system !== void 0 ? { system } : {},
     prompt,
     ...mcpServers !== void 0 ? { mcpServers } : {},
-    // environment / proxyEndpoints / metadata: passed through
-    // as-is — the BFF revalidates them via `parseRunSubmissionRequest`,
+    // environment / metadata: passed through as-is — the BFF revalidates
+    // them via `parseRunSubmissionRequest`,
     // so duplicating the heavyweight parsers here would mean two sources
     // of truth. The CLI surfaces structural errors at submission time.
     ...record.environment !== void 0 ? { environment: record.environment } : {},
     ...record.runtimeSize !== void 0 ? { runtimeSize: record.runtimeSize } : {},
     ...record.timeout !== void 0 ? { timeout: record.timeout } : {},
-    ...record.proxyEndpoints !== void 0 ? { proxyEndpoints: record.proxyEndpoints } : {},
     ...record.metadata !== void 0 ? { metadata: record.metadata } : {}
   };
 }
@@ -489,7 +459,6 @@ var RUNTIME_SECURITY_PROFILE_CONFIG = Object.freeze({
     allowOpenNetworking: false,
     allowRuntimePackages: false,
     allowCustomerEnvVars: true,
-    allowProxyEndpoints: true,
     allowMcpServers: true
   }),
   standard: Object.freeze({
@@ -498,7 +467,6 @@ var RUNTIME_SECURITY_PROFILE_CONFIG = Object.freeze({
     allowOpenNetworking: true,
     allowRuntimePackages: true,
     allowCustomerEnvVars: true,
-    allowProxyEndpoints: true,
     allowMcpServers: true
   }),
   developer: Object.freeze({
@@ -507,7 +475,6 @@ var RUNTIME_SECURITY_PROFILE_CONFIG = Object.freeze({
     allowOpenNetworking: true,
     allowRuntimePackages: true,
     allowCustomerEnvVars: true,
-    allowProxyEndpoints: true,
     allowMcpServers: true
   })
 });
@@ -524,9 +491,6 @@ var RUN_PROVIDERS = [
   "doubao-cn"
 ];
 var DEFAULT_RUN_PROVIDER = "anthropic";
-var MIN_REDACTION_TARGET_BYTES = 4;
-var MIN_PROXY_SECRET_BYTES = 8;
-var _MIN_PROXY_SECRET_BYTES_OK = MIN_PROXY_SECRET_BYTES >= MIN_REDACTION_TARGET_BYTES;
 var BUILTIN_TOOL_NAMES = [
   "bash",
   "read_file",
@@ -1400,6 +1364,7 @@ __export(operations_exports, {
   listRuns: () => listRuns,
   listSecrets: () => listSecrets,
   listSessionEvents: () => listSessionEvents,
+  listSessionMessages: () => listSessionMessages,
   listSessionOutputs: () => listSessionOutputs,
   listSessions: () => listSessions,
   normalizeOutputLinkExpiresIn: () => normalizeOutputLinkExpiresIn,
@@ -2188,6 +2153,16 @@ async function sendSessionMessage(http, sessionId, request, options) {
     body: JSON.stringify(request)
   });
 }
+async function listSessionMessages(http, sessionId, query) {
+  const params = {};
+  if (query?.limit !== void 0)
+    params.limit = String(query.limit);
+  if (query?.cursor !== void 0)
+    params.cursor = query.cursor;
+  if (query?.since !== void 0)
+    params.since = query.since;
+  return http.request(`/api/sessions/${encodeURIComponent(sessionId)}/messages`, {}, params);
+}
 async function suspendSession(http, sessionId, options) {
   const headers = idempotencyHeaders(options);
   return http.request(`/api/sessions/${encodeURIComponent(sessionId)}/suspend`, { method: "POST", ...headers ? { headers } : {} });
@@ -2800,34 +2775,8 @@ async function uploadWorkspaceAsset(http, input) {
   });
 }
 
-// ../contracts/dist/proxy-validation.js
-function validateProxyAuth(endpoints, auth) {
-  const authList = auth ?? [];
-  const endpointNames = new Set(endpoints.map((e) => e.name));
-  const authNames = /* @__PURE__ */ new Set();
-  for (const entry of authList) {
-    if (authNames.has(entry.name)) {
-      throw new Error(`secrets.proxyEndpointAuth contains duplicate name '${entry.name}'`);
-    }
-    authNames.add(entry.name);
-    if (!endpointNames.has(entry.name)) {
-      throw new Error(`secrets.proxyEndpointAuth[].name='${entry.name}' has no matching proxyEndpoints[].name`);
-    }
-  }
-  for (const endpoint of endpoints) {
-    const match = authList.find((a) => a.name === endpoint.name);
-    if (!match) {
-      throw new Error(`proxyEndpoints[].name='${endpoint.name}' is missing a matching secrets.proxyEndpointAuth entry`);
-    }
-    if (match.value.type !== endpoint.authShape.type) {
-      throw new Error(`secrets.proxyEndpointAuth[name='${endpoint.name}'].value.type='${match.value.type}' does not match proxyEndpoints[name='${endpoint.name}'].authShape.type='${endpoint.authShape.type}'`);
-    }
-  }
-}
-
 // dist/internal.js
 var AEX_INDEX_PATH = "/mnt/session/uploads/aex/index.json";
-var AEX_RUN_TOKEN_PATH = "/mnt/session/uploads/aex/run-token";
 
 // dist/host/common.js
 var SUCCESS = { code: 0 };
@@ -2986,7 +2935,7 @@ async function refuseInsideManagedRun(io2, verb) {
   try {
     await io2.readFile(AEX_INDEX_PATH);
     io2.stderr(`\`aex ${verb}\` is a host command and cannot run inside a managed run container.
-Use \`aex proxy ...\` to call your declared upstream endpoints from inside the run.
+Make HTTP calls from your code and pass credentials through secrets.
 `);
     return true;
   } catch (err2) {
@@ -3171,285 +3120,6 @@ async function runOutputsSyncCmd(io2, dirs) {
   return SUCCESS;
 }
 
-// dist/proxy.js
-function parseProxyFlags(rest) {
-  let endpointName = null;
-  let method = "GET";
-  let path = "/";
-  let query = null;
-  const headers = /* @__PURE__ */ new Map();
-  let dataSpec = null;
-  let responseMode = null;
-  let showHelp = false;
-  for (let i2 = 0; i2 < rest.length; i2++) {
-    const arg = rest[i2];
-    if (arg === "--help" || arg === "-h") {
-      showHelp = true;
-      continue;
-    }
-    if (arg === "--method") {
-      method = expect(rest, ++i2, "--method");
-      continue;
-    }
-    if (arg === "--path") {
-      path = expect(rest, ++i2, "--path");
-      continue;
-    }
-    if (arg === "--query") {
-      query = expect(rest, ++i2, "--query");
-      continue;
-    }
-    if (arg === "--header") {
-      const kv = expect(rest, ++i2, "--header");
-      const eq = kv.indexOf("=");
-      if (eq <= 0)
-        return { ok: false, reason: "--header must be in the form KEY=VALUE" };
-      headers.set(kv.slice(0, eq).toLowerCase(), kv.slice(eq + 1));
-      continue;
-    }
-    if (arg === "--data") {
-      dataSpec = expect(rest, ++i2, "--data");
-      continue;
-    }
-    if (arg === "--response-mode") {
-      responseMode = expect(rest, ++i2, "--response-mode");
-      continue;
-    }
-    if (arg.startsWith("--")) {
-      return { ok: false, reason: `unknown flag: ${arg}` };
-    }
-    if (endpointName === null) {
-      endpointName = arg;
-      continue;
-    }
-    return { ok: false, reason: `unexpected positional argument: ${arg}` };
-  }
-  return { ok: true, flags: { endpointName, method, path, query, headers, dataSpec, responseMode, showHelp } };
-}
-function expect(arr, idx, flag) {
-  const v = arr[idx];
-  if (v === void 0) {
-    throw new CliUsageError(`${flag} requires a value`);
-  }
-  return v;
-}
-var CliUsageError = class extends Error {
-};
-async function printProxyHelp(io2) {
-  io2.stdout("aex proxy \u2014 call an upstream HTTP endpoint via the managed proxy.\n\n");
-  io2.stdout("Usage:\n");
-  io2.stdout("  aex proxy <endpoint-name> [flags]\n\n");
-  io2.stdout("Flags:\n");
-  io2.stdout("  --method <verb>          HTTP method (default: GET)\n");
-  io2.stdout("  --path <path>            Caller-supplied path; must match policy prefixes\n");
-  io2.stdout(`  --query <json>           JSON object of query parameters (e.g. '{"q":"x"}')
-`);
-  io2.stdout("  --header K=V             Add a caller header (repeatable)\n");
-  io2.stdout("  --data <value>           Request body. Use '-' for stdin, '@<file>' for file content\n");
-  io2.stdout("  --response-mode <mode>   status_only | headers_only | full (may only narrow policy)\n");
-  io2.stdout("  --help                   Show this message\n\n");
-  const manifest = await tryReadManifest(io2);
-  if (manifest && manifest.endpoints.length > 0) {
-    io2.stdout("Declared endpoints:\n");
-    for (const ep of manifest.endpoints) {
-      io2.stdout(`  \u2022 ${formatProxyEndpointSummary(ep)}
-`);
-    }
-  }
-  return SUCCESS;
-}
-function formatProxyEndpointSummary(ep) {
-  const retry = ep.retry ? `, retry=${ep.retry.maxAttempts}x ${ep.retry.retryOnMethods.join("/")} ${ep.retry.retryOnStatuses.join("/")} delay=${ep.retry.initialDelayMs}-${ep.retry.maxDelayMs}ms jitter=${ep.retry.jitter}${ep.retry.respectRetryAfter ? " retry-after" : ""}` : "";
-  return `${ep.name}: ${ep.allowMethods.join(",")} ${ep.allowPathPrefixes.join(",")} (mode=${ep.responseMode}${retry})`;
-}
-async function runProxy(io2, rest) {
-  let parsed;
-  try {
-    parsed = parseProxyFlags(rest);
-  } catch (err2) {
-    if (err2 instanceof CliUsageError) {
-      io2.stderr(`${err2.message}
-`);
-      return USAGE_ERR;
-    }
-    throw err2;
-  }
-  if (!parsed.ok) {
-    io2.stderr(`${parsed.reason}
-`);
-    return USAGE_ERR;
-  }
-  const f = parsed.flags;
-  if (f.showHelp) {
-    return await printProxyHelp(io2);
-  }
-  if (!f.endpointName) {
-    io2.stderr("missing endpoint-name\n");
-    io2.stderr("usage: aex proxy <endpoint-name> [flags]\n");
-    return USAGE_ERR;
-  }
-  if (f.responseMode && !PROXY_RESPONSE_MODES.includes(f.responseMode)) {
-    io2.stderr(`--response-mode must be one of: ${PROXY_RESPONSE_MODES.join(", ")}
-`);
-    return USAGE_ERR;
-  }
-  const manifest = await tryReadManifest(io2);
-  if (!manifest) {
-    emitError(io2, {
-      error: "internal_error",
-      message: "manifest not mounted; this CLI must run inside an aex-managed run"
-    });
-    return RUNTIME_ERR;
-  }
-  if (!manifest.proxyBaseUrl) {
-    emitError(io2, {
-      error: "endpoint_not_found",
-      message: "this run has no proxy endpoints declared",
-      endpointName: f.endpointName
-    });
-    return RUNTIME_ERR;
-  }
-  let token;
-  try {
-    token = (await io2.readFile(AEX_RUN_TOKEN_PATH)).trim();
-  } catch {
-    emitError(io2, {
-      error: "unauthorized",
-      message: "run token file missing; this run has no proxy bearer"
-    });
-    return RUNTIME_ERR;
-  }
-  if (!token) {
-    emitError(io2, { error: "unauthorized", message: "run token is empty" });
-    return RUNTIME_ERR;
-  }
-  let body;
-  if (f.dataSpec !== null) {
-    try {
-      body = await resolveBody(io2, f.dataSpec);
-    } catch (err2) {
-      io2.stderr(`failed to read request body: ${err2.message}
-`);
-      return RUNTIME_ERR;
-    }
-  }
-  const url = `${manifest.proxyBaseUrl.replace(/\/+$/, "")}/${encodeURIComponent(f.endpointName)}`;
-  const requestHeaders = new Headers();
-  requestHeaders.set("authorization", `Bearer ${token}`);
-  requestHeaders.set(PROXY_PROTOCOL_HEADER, PROXY_PROTOCOL_VERSION_V2);
-  requestHeaders.set(PROXY_METHOD_HEADER, f.method.toUpperCase());
-  requestHeaders.set(PROXY_PATH_HEADER, f.path);
-  if (f.query) {
-    requestHeaders.set(PROXY_QUERY_HEADER, f.query);
-  }
-  if (f.headers.size > 0) {
-    requestHeaders.set(PROXY_HEADERS_HEADER, JSON.stringify(Object.fromEntries(f.headers)));
-  }
-  if (f.responseMode) {
-    requestHeaders.set(PROXY_RESPONSE_MODE_HEADER, f.responseMode);
-  }
-  if (body !== void 0) {
-    requestHeaders.set("content-length", String(body.byteLength));
-  }
-  const init = {
-    method: "POST",
-    headers: requestHeaders,
-    redirect: "manual"
-  };
-  if (body !== void 0) {
-    init.body = body;
-  }
-  let response;
-  try {
-    response = await io2.fetchImpl(url, init);
-  } catch (err2) {
-    emitError(io2, {
-      error: "upstream_error",
-      message: `proxy request failed: ${err2.message}`,
-      endpointName: f.endpointName
-    });
-    return RUNTIME_ERR;
-  }
-  if (response.headers.get(PROXY_RESP_STATUS_HEADER) !== null) {
-    const envelope = await readStreamedEnvelope(response, f.endpointName);
-    io2.stdout(JSON.stringify(envelope) + "\n");
-    return SUCCESS;
-  }
-  const text = await response.text();
-  let parsedBody;
-  try {
-    parsedBody = text ? JSON.parse(text) : {};
-  } catch {
-    const snippet = text.slice(0, 200).replace(/\s+/g, " ").trim();
-    emitError(io2, {
-      error: "internal_error",
-      message: `proxy returned non-JSON response (HTTP ${response.status}, body=${JSON.stringify(snippet)})`,
-      endpointName: f.endpointName
-    });
-    return RUNTIME_ERR;
-  }
-  if (!response.ok) {
-    io2.stderr(JSON.stringify(parsedBody) + "\n");
-    return RUNTIME_ERR;
-  }
-  io2.stdout(JSON.stringify(parsedBody) + "\n");
-  return SUCCESS;
-}
-async function resolveBody(io2, spec) {
-  if (spec === "-") {
-    const data = await io2.readFile("/dev/stdin");
-    return new Uint8Array(Buffer.from(data, "utf8"));
-  }
-  if (spec.startsWith("@")) {
-    const path = spec.slice(1);
-    if (!path)
-      throw new Error("--data @<file> requires a path");
-    const data = await io2.readFile(path);
-    return new Uint8Array(Buffer.from(data, "utf8"));
-  }
-  return new Uint8Array(Buffer.from(spec, "utf8"));
-}
-function emitError(io2, body) {
-  io2.stderr(JSON.stringify(body) + "\n");
-}
-async function readStreamedEnvelope(response, endpointName) {
-  const effectiveResponseMode = response.headers.get(PROXY_RESP_MODE_HEADER) ?? "headers_only";
-  const upstreamStatus = Number.parseInt(response.headers.get(PROXY_RESP_STATUS_HEADER) ?? "0", 10);
-  let upstreamHeaders = {};
-  const rawHeaders = response.headers.get(PROXY_RESP_UPSTREAM_HEADERS_HEADER);
-  if (rawHeaders) {
-    try {
-      const parsed = JSON.parse(rawHeaders);
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-        upstreamHeaders = parsed;
-      }
-    } catch {
-    }
-  }
-  const truncatedRaw = response.headers.get(PROXY_RESP_TRUNCATED_HEADER);
-  const bytes = new Uint8Array(await response.arrayBuffer());
-  return {
-    endpointName,
-    upstreamStatus,
-    upstreamHeaders,
-    effectiveResponseMode,
-    // The streamed path can't echo the request-side clamp decision (it
-    // isn't carried back); the effective mode is authoritative for the
-    // agent and matches what v1 surfaced for an un-clamped call.
-    modeClamped: false,
-    ...effectiveResponseMode === "full" && bytes.byteLength > 0 ? { upstreamBodyBase64: Buffer.from(bytes).toString("base64") } : {},
-    ...truncatedRaw === "true" ? { truncated: true } : {}
-  };
-}
-async function tryReadManifest(io2) {
-  try {
-    const raw = await io2.readFile(AEX_INDEX_PATH);
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-
 // dist/host/run-cmd.js
 import { resolve as resolvePath } from "node:path";
 var DEFAULT_SESSION_IDLE_TTL = "3m";
@@ -3616,6 +3286,10 @@ async function runRunCmd(io2, argv) {
     return USAGE_ERR;
   }
   rest = proxyAuthFlags.remaining;
+  if (proxyEndpointFlags.values.length > 0 || Object.keys(proxyAuthFlags.entries).length > 0) {
+    io2.stderr("--proxy-endpoint and --proxy-auth are no longer supported; make HTTP calls from your code and pass credentials via secrets.\n");
+    return USAGE_ERR;
+  }
   const positional = rest.filter((a) => !a.startsWith("--"));
   const unknownFlags = rest.filter((a) => a.startsWith("--"));
   if (unknownFlags.length > 0) {
@@ -3727,35 +3401,6 @@ async function runRunCmd(io2, argv) {
   for (const name of mcpHeaderBag.keys()) {
     if (!mcpServersForSubmission.some((m) => m.name === name)) {
       io2.stderr(`--mcp-auth ${name}: no matching --mcp / mcpServers entry declared
-`);
-      return USAGE_ERR;
-    }
-  }
-  let proxyEndpoints = runConfig.proxyEndpoints ?? [];
-  if (proxyEndpointFlags.values.length > 0) {
-    try {
-      proxyEndpoints = proxyEndpointFlags.values.map((raw, i2) => parseJsonOrThrow(raw, `--proxy-endpoint[${i2}]`));
-    } catch (err2) {
-      io2.stderr(`${err2.message}
-`);
-      return USAGE_ERR;
-    }
-  }
-  const proxyAuth = [];
-  for (const [name, spec] of Object.entries(proxyAuthFlags.entries)) {
-    const parsed = parseProxyAuth(spec);
-    if (!parsed.ok) {
-      io2.stderr(`--proxy-auth ${name}: ${parsed.reason}
-`);
-      return USAGE_ERR;
-    }
-    proxyAuth.push({ name, value: parsed.value });
-  }
-  if (proxyEndpoints.length > 0) {
-    try {
-      validateProxyAuth(proxyEndpoints, proxyAuth);
-    } catch (err2) {
-      io2.stderr(`proxy auth validation failed: ${err2.message}
 `);
       return USAGE_ERR;
     }
@@ -3774,8 +3419,7 @@ async function runRunCmd(io2, argv) {
   const hasAdditionalProviderKeys = Object.keys(providerKeyValues).some((p) => p !== provider);
   const secrets = {
     apiKeys: hasAdditionalProviderKeys ? providerKeyValues : { [provider]: providerKeyValues[provider] },
-    ...mcpServerSecrets.length > 0 ? { mcpServers: mcpServerSecrets } : {},
-    ...proxyAuth.length > 0 ? { proxyEndpointAuth: proxyAuth } : {}
+    ...mcpServerSecrets.length > 0 ? { mcpServers: mcpServerSecrets } : {}
   };
   const request = {
     provider,
@@ -3784,8 +3428,7 @@ async function runRunCmd(io2, argv) {
     retention: { idleTtl: DEFAULT_SESSION_IDLE_TTL },
     ...runtimeSizeFlag.value ? { runtimeSize: runtimeSizeFlag.value } : runConfig.runtimeSize ? { runtimeSize: runConfig.runtimeSize } : {},
     ...runTimeoutFlag.value ? { timeout: runTimeoutFlag.value } : runConfig.timeout ? { timeout: runConfig.timeout } : {},
-    ...webhookFlag.value ? { webhook: { url: webhookFlag.value } } : {},
-    ...proxyEndpoints.length > 0 ? { proxyEndpoints } : {}
+    ...webhookFlag.value ? { webhook: { url: webhookFlag.value } } : {}
   };
   const createKey = idempotency.value ?? generateIdempotencyKey();
   const messageKey = `${createKey}:message`;
@@ -3864,47 +3507,6 @@ async function runRunCmd(io2, argv) {
     return RUNTIME_ERR;
   }
 }
-function parseProxyAuth(spec) {
-  const idx = spec.indexOf(":");
-  if (idx <= 0) {
-    return { ok: false, reason: `expected '<type>:<value>' (got: ${spec})` };
-  }
-  const type = spec.slice(0, idx);
-  const restValue = spec.slice(idx + 1);
-  switch (type) {
-    case "bearer":
-      if (!restValue)
-        return { ok: false, reason: "bearer requires a token value" };
-      return { ok: true, value: { type: "bearer", token: restValue } };
-    case "header":
-      if (!restValue)
-        return { ok: false, reason: "header requires a value" };
-      return { ok: true, value: { type: "header", value: restValue } };
-    case "query":
-      if (!restValue)
-        return { ok: false, reason: "query requires a value" };
-      return { ok: true, value: { type: "query", value: restValue } };
-    case "basic": {
-      const sep = restValue.indexOf(":");
-      if (sep <= 0 || sep >= restValue.length - 1) {
-        return { ok: false, reason: "basic requires <username>:<password>" };
-      }
-      return {
-        ok: true,
-        value: { type: "basic", username: restValue.slice(0, sep), password: restValue.slice(sep + 1) }
-      };
-    }
-    default:
-      return { ok: false, reason: `unknown auth type '${type}' (expected bearer|basic|header|query)` };
-  }
-}
-function parseJsonOrThrow(raw, label) {
-  try {
-    return JSON.parse(raw);
-  } catch (err2) {
-    throw new Error(`${label} is not valid JSON: ${err2.message}`);
-  }
-}
 function stripMcpHeadersForParsing(input) {
   const mcpHeaders = /* @__PURE__ */ new Map();
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
@@ -4400,6 +4002,82 @@ async function runWhoamiCmd(io2, argv) {
   }
 }
 
+// dist/host/redeem.js
+function messageForStatus(status2, serverMessage) {
+  switch (status2) {
+    case 404:
+      return "coupon code not found";
+    case 403:
+      return "this coupon can't be redeemed by this workspace";
+    case 409:
+      return "coupon already redeemed";
+    case 400:
+      return serverMessage ? `invalid input: ${serverMessage}` : "invalid input";
+    case 401:
+      return "not authorized \u2014 check --api-token, or run `aex login`";
+    default:
+      return serverMessage ? `redeem failed: ${serverMessage}` : `redeem failed (HTTP ${status2})`;
+  }
+}
+async function runRedeemCmd(io2, argv) {
+  if (await refuseInsideManagedRun(io2, "redeem"))
+    return USAGE_ERR;
+  const common = await resolveCommonHostFlags(io2, argv);
+  if (!common.ok) {
+    io2.stderr(`${common.reason}
+`);
+    return USAGE_ERR;
+  }
+  const positional = common.rest.filter((arg) => !arg.startsWith("--"));
+  if (positional.length !== 1) {
+    io2.stderr("usage: aex redeem <code> [common flags]\n");
+    return USAGE_ERR;
+  }
+  const code = positional[0];
+  const base = common.flags.aexUrl.replace(/\/+$/, "");
+  const url = `${base}/billing/redeem`;
+  let response;
+  try {
+    response = await io2.fetchImpl(url, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json",
+        authorization: `Bearer ${common.flags.apiToken}`
+      },
+      body: JSON.stringify({ code })
+    });
+  } catch (err2) {
+    io2.stderr(`redeem failed: ${err2 instanceof Error ? err2.message : String(err2)}
+`);
+    return RUNTIME_ERR;
+  }
+  if (common.flags.debug) {
+    io2.stderr(`[aex] POST /billing/redeem -> ${response.status}
+`);
+  }
+  const text = await response.text();
+  let body = {};
+  try {
+    if (text.length > 0)
+      body = JSON.parse(text);
+  } catch {
+    body = {};
+  }
+  if (!response.ok) {
+    const serverMessage = body && typeof body === "object" && typeof body.message === "string" ? body.message : void 0;
+    io2.stderr(`${messageForStatus(response.status, serverMessage)}
+`);
+    return RUNTIME_ERR;
+  }
+  const ok = body;
+  const amountUsd = typeof ok.amountUsd === "number" ? ok.amountUsd : 0;
+  const newBalanceUsd = typeof ok.newBalanceUsd === "number" ? ok.newBalanceUsd : 0;
+  io2.stdout(`Redeemed $${amountUsd.toFixed(2)}. New balance: $${newBalanceUsd.toFixed(2)}.
+`);
+  return SUCCESS;
+}
+
 // dist/host/debug.js
 import { dirname, resolve as resolvePath3 } from "node:path";
 function status(source, state, opts = {}) {
@@ -5649,8 +5327,6 @@ async function dispatch(io2, args) {
   const sub = args[0];
   const rest = args.slice(1);
   switch (sub) {
-    case "proxy":
-      return runProxy(io2, rest);
     case "run":
       return runRunCmd(io2, rest);
     case "status":
@@ -5680,6 +5356,8 @@ async function dispatch(io2, args) {
       return runDeleteAssetCmd(io2, rest);
     case "whoami":
       return runWhoamiCmd(io2, rest);
+    case "redeem":
+      return runRedeemCmd(io2, rest);
     case "login":
       return runLoginCmd(io2, rest);
     case "logout":
@@ -5704,26 +5382,6 @@ async function dispatch(io2, args) {
   }
 }
 async function printGlobalHelp(io2) {
-  const manifest = await tryReadManifest(io2);
-  if (manifest) {
-    io2.stdout("aex \u2014 in-container CLI for managed run sessions\n\n");
-    io2.stdout("Usage:\n");
-    io2.stdout("  aex proxy <endpoint-name> [flags]\n");
-    io2.stdout("  aex proxy --help\n\n");
-    if (manifest.endpoints.length === 0) {
-      io2.stdout("This run declared no proxy endpoints.\n");
-    } else {
-      io2.stdout("Declared proxy endpoints for this run:\n");
-      for (const ep of manifest.endpoints) {
-        io2.stdout(`  \u2022 ${formatProxyEndpointSummary(ep)}
-`);
-      }
-    }
-    io2.stdout(`
-Protocol version: ${manifest.protocolVersion}
-`);
-    return SUCCESS;
-  }
   io2.stdout("aex \u2014 unified CLI for the aex platform (mirrors the SDK 1:1)\n\n");
   io2.stdout("Usage:\n");
   io2.stdout("  aex run --config <run.json> --<provider>-api-key K --api-token T [flags]\n");
@@ -5740,6 +5398,7 @@ Protocol version: ${manifest.protocolVersion}
   io2.stdout("  aex delete <session-id> --api-token T\n");
   io2.stdout("  aex delete-asset <assetId|hash> --api-token T\n");
   io2.stdout("  aex whoami --api-token T\n");
+  io2.stdout("  aex redeem <code> --api-token T             Redeem a coupon code into the workspace prepaid balance\n");
   io2.stdout("  aex login --api-token T [--aex-url U]      Persist token + url (then other verbs need no --api-token)\n");
   io2.stdout("  aex logout                                 Clear the stored token\n");
   io2.stdout("  aex auth status                            Show the resolved config (token never printed)\n");
@@ -5767,8 +5426,6 @@ Protocol version: ${manifest.protocolVersion}
   io2.stdout("  --mcp name=url              MCP server entry (repeatable)\n");
   io2.stdout("  --mcp-auth name=Hdr:Val     Auth header on the matching --mcp; routed into vaulted secrets (repeatable)\n");
   io2.stdout("  --metadata key=value        Submission metadata entry (repeatable)\n");
-  io2.stdout("  --proxy-endpoint '<json>'   PlatformProxyEndpoint JSON (repeatable)\n");
-  io2.stdout("  --proxy-auth name=<spec>    bearer:tok | basic:u:p | header:v | query:v (repeatable)\n");
   io2.stdout("  --runtime-size <size>       managed runtime preset\n");
   io2.stdout("  --run-timeout <dur>         Server-side run deadline (e.g. 1h); distinct from --timeout\n");
   io2.stdout("  --idempotency-key <key>     Optional; defaults to a fresh UUID\n");