@astrasyncai/verification-gateway 5.17.0 → 5.17.2

package/dist/bin/astrasync-claude-hook.js

@@ -3752,7 +3752,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.17.0";
+var SDK_VERSION = "5.17.2";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -3891,6 +3891,7 @@ function getCacheKey(request, counterpartyId) {
     request.enableRuntimeChallenge ? "1" : "0",
     // 5.16.0: route policy changes the verdict (owners / challenge).
     request.routePolicy ? JSON.stringify(request.routePolicy) : "",
+    request.approvalHeldByRoute ? "1" : "0",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -4064,6 +4065,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
   if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
+  if (requestData.approvalHeldByRoute) body.approvalHeldByRoute = true;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -4395,6 +4397,8 @@ async function verify(config, request, options) {
   } else if (result.recommendation === "step_up_required" && result.identityVerified) {
     result.requiresStepUp = true;
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Step-up verification required"];
+    const stepUpFailures = apiResponse.access?.failures;
+    if (stepUpFailures?.length) result.failures = stepUpFailures;
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {

package/dist/bin/astrasync-codex-hook.js

@@ -3751,7 +3751,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.17.0";
+var SDK_VERSION = "5.17.2";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -3890,6 +3890,7 @@ function getCacheKey(request, counterpartyId) {
     request.enableRuntimeChallenge ? "1" : "0",
     // 5.16.0: route policy changes the verdict (owners / challenge).
     request.routePolicy ? JSON.stringify(request.routePolicy) : "",
+    request.approvalHeldByRoute ? "1" : "0",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -4063,6 +4064,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
   if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
+  if (requestData.approvalHeldByRoute) body.approvalHeldByRoute = true;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -4394,6 +4396,8 @@ async function verify(config, request, options) {
   } else if (result.recommendation === "step_up_required" && result.identityVerified) {
     result.requiresStepUp = true;
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Step-up verification required"];
+    const stepUpFailures = apiResponse.access?.failures;
+    if (stepUpFailures?.length) result.failures = stepUpFailures;
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {

package/dist/bin/astrasync-guard.js

@@ -3713,7 +3713,7 @@ Policy saved to ${outputPath}`);
 };
 
 // src/version.ts
-var SDK_VERSION = "5.17.0";
+var SDK_VERSION = "5.17.2";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -4756,6 +4756,7 @@ function getCacheKey(request2, counterpartyId) {
     request2.enableRuntimeChallenge ? "1" : "0",
     // 5.16.0: route policy changes the verdict (owners / challenge).
     request2.routePolicy ? JSON.stringify(request2.routePolicy) : "",
+    request2.approvalHeldByRoute ? "1" : "0",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -4929,6 +4930,7 @@ async function callVerifyAccessAPI(config, request2) {
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
   if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
+  if (requestData.approvalHeldByRoute) body.approvalHeldByRoute = true;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -5260,6 +5262,8 @@ async function verify(config, request2, options) {
   } else if (result.recommendation === "step_up_required" && result.identityVerified) {
     result.requiresStepUp = true;
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Step-up verification required"];
+    const stepUpFailures = apiResponse.access?.failures;
+    if (stepUpFailures?.length) result.failures = stepUpFailures;
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
@@ -7362,6 +7366,12 @@ async function startBrowseProxy(opts) {
 }
 
 // src/fleet/browse.ts
+function refusal(body) {
+  const e = body.error;
+  if (e && typeof e === "object")
+    return { code: e.code ?? body.code, message: e.message ?? body.message };
+  return { code: body.code, message: body.message ?? (typeof e === "string" ? e : void 0) };
+}
 async function runBrowse(paths, opts) {
   const log = opts.log ?? ((l) => console.log(l));
   const f = opts.fetchImpl ?? fetch;
@@ -7387,25 +7397,42 @@ async function runBrowse(paths, opts) {
     );
     const body = await signin.json().catch(() => ({}));
     if (signin.status !== 201 && signin.status !== 202) {
+      const r = refusal(body);
       throw new Error(
-        `Sign-in refused (${signin.status}${body.code ? ` ${body.code}` : ""}): ${body.message ?? "no detail"}`
+        `Sign-in refused (${signin.status}${r.code ? ` ${r.code}` : ""}): ${r.message ?? "no detail"}`
       );
     }
     const sessionId = String(body.data?.sessionId ?? "");
     let code = body.data?.code;
     if (!code) {
       log("Waiting for the owner to approve this sign-in with their passkey\u2026");
+      const approvalUrl = body.data?.approvalUrl;
+      if (typeof approvalUrl === "string" && approvalUrl) log(`  Approve it at: ${approvalUrl}`);
       const deadline = Date.now() + (opts.waitMs ?? 10 * 6e4);
+      let failures = 0;
       while (!code) {
         if (Date.now() > deadline) throw new Error("The owner did not approve in time.");
         await new Promise((r) => setTimeout(r, opts.pollIntervalMs ?? 3e3));
-        const poll = await f(
-          `${apiBaseUrl.replace(/\/+$/, "")}/agent-sessions/${sessionId}/status`,
-          {
+        let poll;
+        try {
+          poll = await f(`${apiBaseUrl.replace(/\/+$/, "")}/agent-sessions/${sessionId}/status`, {
             headers: { "x-astra-device": device }
-          }
-        );
+          });
+        } catch (err) {
+          if (++failures >= 3)
+            throw new Error(`Couldn't check the sign-in status: ${err.message}`);
+          continue;
+        }
         const p = await poll.json().catch(() => ({}));
+        if (!poll.ok) {
+          const r = refusal(p);
+          const why = `(${poll.status}${r.code ? ` ${r.code}` : ""}): ${r.message ?? "no detail"}`;
+          if (poll.status === 401 || poll.status === 403 || poll.status === 404)
+            throw new Error(`Sign-in status check refused ${why}`);
+          if (++failures >= 3) throw new Error(`Couldn't check the sign-in status ${why}`);
+          continue;
+        }
+        failures = 0;
         const status = p.data?.status;
         if (status === "approved") code = p.data?.code;
         else if (status === "denied" || status === "ended")

package/dist/bin/astrasync.js

@@ -36,7 +36,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    SDK_VERSION = "5.17.0";
+    SDK_VERSION = "5.17.2";
   }
 });
 
@@ -5170,6 +5170,7 @@ function getCacheKey(request2, counterpartyId) {
     request2.enableRuntimeChallenge ? "1" : "0",
     // 5.16.0: route policy changes the verdict (owners / challenge).
     request2.routePolicy ? JSON.stringify(request2.routePolicy) : "",
+    request2.approvalHeldByRoute ? "1" : "0",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -5341,6 +5342,7 @@ async function callVerifyAccessAPI(config, request2) {
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
   if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
+  if (requestData.approvalHeldByRoute) body.approvalHeldByRoute = true;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -5672,6 +5674,8 @@ async function verify(config, request2, options) {
   } else if (result.recommendation === "step_up_required" && result.identityVerified) {
     result.requiresStepUp = true;
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Step-up verification required"];
+    const stepUpFailures = apiResponse.access?.failures;
+    if (stepUpFailures?.length) result.failures = stepUpFailures;
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
@@ -8651,6 +8655,12 @@ var init_browse_proxy = __esm({
 });
 
 // src/fleet/browse.ts
+function refusal(body) {
+  const e = body.error;
+  if (e && typeof e === "object")
+    return { code: e.code ?? body.code, message: e.message ?? body.message };
+  return { code: body.code, message: body.message ?? (typeof e === "string" ? e : void 0) };
+}
 async function runBrowse(paths, opts) {
   const log = opts.log ?? ((l) => console.log(l));
   const f = opts.fetchImpl ?? fetch;
@@ -8676,25 +8686,42 @@ async function runBrowse(paths, opts) {
     );
     const body = await signin.json().catch(() => ({}));
     if (signin.status !== 201 && signin.status !== 202) {
+      const r = refusal(body);
       throw new Error(
-        `Sign-in refused (${signin.status}${body.code ? ` ${body.code}` : ""}): ${body.message ?? "no detail"}`
+        `Sign-in refused (${signin.status}${r.code ? ` ${r.code}` : ""}): ${r.message ?? "no detail"}`
       );
     }
     const sessionId = String(body.data?.sessionId ?? "");
     let code = body.data?.code;
     if (!code) {
       log("Waiting for the owner to approve this sign-in with their passkey\u2026");
+      const approvalUrl = body.data?.approvalUrl;
+      if (typeof approvalUrl === "string" && approvalUrl) log(`  Approve it at: ${approvalUrl}`);
       const deadline = Date.now() + (opts.waitMs ?? 10 * 6e4);
+      let failures = 0;
       while (!code) {
         if (Date.now() > deadline) throw new Error("The owner did not approve in time.");
         await new Promise((r) => setTimeout(r, opts.pollIntervalMs ?? 3e3));
-        const poll = await f(
-          `${apiBaseUrl.replace(/\/+$/, "")}/agent-sessions/${sessionId}/status`,
-          {
+        let poll;
+        try {
+          poll = await f(`${apiBaseUrl.replace(/\/+$/, "")}/agent-sessions/${sessionId}/status`, {
             headers: { "x-astra-device": device }
-          }
-        );
+          });
+        } catch (err) {
+          if (++failures >= 3)
+            throw new Error(`Couldn't check the sign-in status: ${err.message}`);
+          continue;
+        }
         const p = await poll.json().catch(() => ({}));
+        if (!poll.ok) {
+          const r = refusal(p);
+          const why = `(${poll.status}${r.code ? ` ${r.code}` : ""}): ${r.message ?? "no detail"}`;
+          if (poll.status === 401 || poll.status === 403 || poll.status === 404)
+            throw new Error(`Sign-in status check refused ${why}`);
+          if (++failures >= 3) throw new Error(`Couldn't check the sign-in status ${why}`);
+          continue;
+        }
+        failures = 0;
         const status = p.data?.status;
         if (status === "approved") code = p.data?.code;
         else if (status === "denied" || status === "ended")

package/dist/browser/background.js

@@ -3988,7 +3988,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.17.0";
+var SDK_VERSION = "5.17.2";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -4127,6 +4127,7 @@ function getCacheKey(request, counterpartyId) {
     request.enableRuntimeChallenge ? "1" : "0",
     // 5.16.0: route policy changes the verdict (owners / challenge).
     request.routePolicy ? JSON.stringify(request.routePolicy) : "",
+    request.approvalHeldByRoute ? "1" : "0",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -4300,6 +4301,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
   if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
+  if (requestData.approvalHeldByRoute) body.approvalHeldByRoute = true;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -4631,6 +4633,8 @@ async function verify(config, request, options) {
   } else if (result.recommendation === "step_up_required" && result.identityVerified) {
     result.requiresStepUp = true;
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Step-up verification required"];
+    const stepUpFailures = apiResponse.access?.failures;
+    if (stepUpFailures?.length) result.failures = stepUpFailures;
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {