@attunesolutions/piece-skyvern-selfhosted 0.0.1 → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +72 -6
- package/package.json +1 -1
- package/src/index.js +43 -4
package/README.md
CHANGED
|
@@ -25,12 +25,78 @@ Saving the connection calls `GET {Base URL}/workflows` to verify both values.
|
|
|
25
25
|
|
|
26
26
|
## Actions
|
|
27
27
|
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
-
|
|
28
|
+
| Action | Endpoint | Returns |
|
|
29
|
+
| --- | --- | --- |
|
|
30
|
+
| Run Agent Task | `POST /run/tasks` | run id |
|
|
31
|
+
| Run Workflow | `POST /run/agents` | run id |
|
|
32
|
+
| Login Task | `POST /run/tasks/login` | run id |
|
|
33
|
+
| Push One-Time Code | `POST /credentials/totp` | ack |
|
|
34
|
+
| Create Credential | `POST /credentials` | `credential_id` (`cred_…`) |
|
|
35
|
+
| Create Browser Profile | `POST /browser_profiles` | `browser_profile_id` (`bp_…`) |
|
|
36
|
+
| Cancel Run | `POST /runs/{id}/cancel` | run |
|
|
37
|
+
| Get Workflow/Task Run | `GET /runs/{id}` | run |
|
|
38
|
+
| Find Workflow | `GET /workflows` | matches |
|
|
39
|
+
| Custom API Call | any | body |
|
|
40
|
+
|
|
41
|
+
Every action returns the parsed response body, so a later step reads
|
|
42
|
+
`{{ step_1['output'].credential_id }}` rather than `.body.credential_id`.
|
|
43
|
+
|
|
44
|
+
All actions above except **Custom API Call** are built from static properties only, so they can be
|
|
45
|
+
added, validated and published entirely over the Activepieces MCP API with no visit to the web UI.
|
|
46
|
+
Custom API Call keeps the framework's dynamic `url`/`body` properties: it runs fine, but a step
|
|
47
|
+
built from it over MCP is marked invalid and blocks publishing, because a dynamic property's schema
|
|
48
|
+
is only written into `propertySettings` by the builder UI.
|
|
49
|
+
|
|
50
|
+
### Two different fields called `credential_type`
|
|
51
|
+
|
|
52
|
+
The API reuses one field name for two unrelated enums, and the piece renames one of them to keep
|
|
53
|
+
them apart:
|
|
54
|
+
|
|
55
|
+
| Piece property | API field | Means | Values |
|
|
56
|
+
| --- | --- | --- | --- |
|
|
57
|
+
| Create Credential → **Credential Type (Kind of Secret)** | `credential_type` | what sort of secret this is | `password`, `credit_card`, `secret` |
|
|
58
|
+
| Login Task → **Credential Source (Vault)** | `credential_type` | which vault to read from | `skyvern`, `bitwarden`, `1password`, `azure_vault` |
|
|
59
|
+
|
|
60
|
+
Passing `password` as a Login Task's Credential Source fails confusingly. It is the natural mistake.
|
|
61
|
+
|
|
62
|
+
### Browser profiles need a v2 engine
|
|
63
|
+
|
|
64
|
+
`browser_profile_id` is rejected by `skyvern-1.0` and the CUA engines. Run Agent Task selects
|
|
65
|
+
`skyvern-2.0` for you when a Browser Profile ID is set and Engine is blank, and throws a clear
|
|
66
|
+
error when an incompatible engine is chosen explicitly. Skyvern's own message names the engine
|
|
67
|
+
`skyvern_v2`, but the value the field accepts is `skyvern-2.0`.
|
|
68
|
+
|
|
69
|
+
### Run a workflow by its permanent id
|
|
70
|
+
|
|
71
|
+
Run Workflow posts to `POST /run/agents`; `POST /agents/{id}` is the *update* endpoint and answers
|
|
72
|
+
a run attempt with *"Invalid workflow definition. Workflow should be provided in either yaml or
|
|
73
|
+
json format."* Pass the permanent `wpid_…` id, never a versioned `w_…` one — editing a workflow
|
|
74
|
+
mints a new `w_…` while the `wpid_…` stays put, so a pinned `w_…` quietly runs a stale version.
|
|
75
|
+
Find Workflow returns `workflow_permanent_id`, which is the value Agent ID wants.
|
|
76
|
+
|
|
77
|
+
## Verifying webhook callbacks
|
|
78
|
+
|
|
79
|
+
Skyvern signs every callback with an `x-skyvern-signature` header: hex HMAC-SHA256 over the **raw
|
|
80
|
+
request body** using your API key as the secret. No timestamp is mixed in, so the signature is over
|
|
81
|
+
the body alone.
|
|
82
|
+
|
|
83
|
+
In a Code step:
|
|
84
|
+
|
|
85
|
+
```ts
|
|
86
|
+
import { createHmac, timingSafeEqual } from 'node:crypto';
|
|
87
|
+
|
|
88
|
+
export const code = async (inputs) => {
|
|
89
|
+
const expected = createHmac('sha256', inputs.apiKey)
|
|
90
|
+
.update(inputs.rawBody, 'utf8')
|
|
91
|
+
.digest('hex');
|
|
92
|
+
const a = Buffer.from(expected, 'utf8');
|
|
93
|
+
const b = Buffer.from(inputs.signature, 'utf8');
|
|
94
|
+
return a.length === b.length && timingSafeEqual(a, b);
|
|
95
|
+
};
|
|
96
|
+
```
|
|
97
|
+
|
|
98
|
+
Compare with `timingSafeEqual`, not `===`, and hash the raw body exactly as received — re-serialising
|
|
99
|
+
the parsed JSON changes the bytes and the signature will not match.
|
|
34
100
|
|
|
35
101
|
## Building
|
|
36
102
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@attunesolutions/piece-skyvern-selfhosted",
|
|
3
|
-
"version": "0.0
|
|
3
|
+
"version": "0.1.0",
|
|
4
4
|
"description": "Activepieces piece for a self-hosted Skyvern instance — browser-automation agent tasks and workflows against your own API URL.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"homepage": "https://github.com/AttuneSolutions/activepieces/tree/main/packages/pieces/community/skyvern-selfhosted",
|