@autohq/cli 0.1.129 → 0.1.130

package/dist/agent-bridge.js

@@ -19670,6 +19670,7 @@ var RuntimeBridgeOutputAckSchema = external_exports.object({
 var OpaqueIdSchema2 = external_exports.string().trim().min(1);
 var ProfileIdSchema = OpaqueIdSchema2.brand();
 var EnvironmentIdSchema = OpaqueIdSchema2.brand();
+var IdentityIdSchema = OpaqueIdSchema2.brand();
 var ConnectionIdSchema = OpaqueIdSchema2.brand();
 var ExternalAccountIdSchema = OpaqueIdSchema2.brand();
 var OrganizationIdSchema = OpaqueIdSchema2.brand();
@@ -20872,169 +20873,6 @@ var githubMcpMergeToolSet = new Set(
   GITHUB_MCP_MERGE_TOOLS
 );
 
-// ../../packages/schemas/src/secrets.ts
-var SECRET_ENCRYPTION_ALGORITHM = "AES-256-GCM";
-var SecretEnvNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
-var SecretCiphertextFieldSchema = external_exports.string().trim().min(1).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/);
-var SecretAesGcmIvSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{16}$/);
-var SecretAesGcmAuthTagSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{22}==$/);
-var SecretEnvValueSchema = external_exports.union([
-  external_exports.string(),
-  external_exports.object({
-    $secret: ResourceNameSchema,
-    optional: external_exports.boolean().optional()
-  })
-]);
-var SecretEnvSchema = external_exports.record(
-  SecretEnvNameSchema,
-  SecretEnvValueSchema
-);
-var EncryptedSecretValueSchema = external_exports.object({
-  keyVersion: external_exports.string().trim().min(1),
-  algorithm: external_exports.literal(SECRET_ENCRYPTION_ALGORITHM),
-  ciphertext: SecretCiphertextFieldSchema,
-  valueIv: SecretAesGcmIvSchema,
-  valueAuthTag: SecretAesGcmAuthTagSchema,
-  encryptedDek: SecretCiphertextFieldSchema,
-  dekIv: SecretAesGcmIvSchema,
-  dekAuthTag: SecretAesGcmAuthTagSchema
-});
-var SecretSetRequestSchema = external_exports.object({
-  value: external_exports.string()
-});
-var SecretMetadataSchema = external_exports.object({
-  id: external_exports.string().trim().min(1),
-  organizationId: external_exports.string().trim().min(1),
-  projectId: external_exports.string().trim().min(1).nullable(),
-  name: ResourceNameSchema,
-  createdAt: external_exports.string().datetime(),
-  updatedAt: external_exports.string().datetime()
-});
-var SecretSetResponseSchema = external_exports.object({
-  secret: SecretMetadataSchema
-});
-var SecretListResponseSchema = external_exports.object({
-  secrets: external_exports.array(SecretMetadataSchema)
-});
-var SecretDeleteResponseSchema = external_exports.object({
-  secret: SecretMetadataSchema
-});
-
-// ../../packages/schemas/src/environments.ts
-var RESOURCE_KIND_ENVIRONMENT = "environment";
-var CURRENT_SANDBOX_USER_HOME = "/home/user";
-var LEGACY_SANDBOX_USER_HOMES = ["/home/auto", "/home/node"];
-var STORED_SANDBOX_USER_HOMES = [
-  CURRENT_SANDBOX_USER_HOME,
-  ...LEGACY_SANDBOX_USER_HOMES
-];
-var EnvironmentSetupCachePathSchema = external_exports.string().trim().refine((value2) => isSafeSandboxUserHomePath(value2), {
-  message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
-});
-var StoredEnvironmentSetupCachePathSchema = external_exports.string().trim().refine(
-  (value2) => isSafeSandboxUserHomePath(value2, {
-    allowedHomes: STORED_SANDBOX_USER_HOMES
-  }),
-  {
-    message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
-  }
-);
-var EnvironmentImageSchema = external_exports.object({
-  kind: external_exports.literal("preset"),
-  name: ResourceNameSchema
-}).strict();
-var EnvironmentSetupSchema = environmentSetupSchema(
-  StoredEnvironmentSetupCachePathSchema
-);
-var EnvironmentApplySetupSchema = environmentSetupSchema(
-  EnvironmentSetupCachePathSchema
-);
-var EnvironmentSetupCacheSchema = external_exports.object({
-  ttl: external_exports.string().trim().refine(isSetupCacheTtl, {
-    message: "Expected a positive setup cache TTL such as 30m, 24h, or 7d"
-  })
-}).strict();
-var EnvironmentResourcesSchema = external_exports.object({
-  cpuCount: external_exports.number().int().min(1).optional(),
-  memoryMB: external_exports.number().int().min(128).optional()
-}).strict().refine(
-  (resources) => resources.cpuCount !== void 0 || resources.memoryMB !== void 0,
-  {
-    message: "Expected at least one runtime resource setting"
-  }
-);
-var EnvironmentSpecSchema = environmentSpecSchema(
-  EnvironmentSetupSchema
-);
-var EnvironmentApplySpecSchema = environmentSpecSchema(
-  EnvironmentApplySetupSchema
-);
-var EnvironmentResourceSchema = resourceEnvelopeSchema(
-  EnvironmentSpecSchema
-);
-var EnvironmentApplyRequestSchema = resourceApplySchema(
-  EnvironmentApplySpecSchema
-);
-function environmentSetupSchema(cachePathSchema) {
-  return external_exports.object({
-    name: ResourceNameSchema,
-    commands: external_exports.array(external_exports.string().trim().min(1)).min(1),
-    cache: external_exports.object({
-      key: ResourceNameSchema.optional(),
-      files: external_exports.array(
-        external_exports.string().trim().refine(isSafeRelativePath, {
-          message: "Expected a relative path without traversal"
-        })
-      ).default([]),
-      paths: external_exports.array(cachePathSchema).default([])
-    }).strict().default({ files: [], paths: [] })
-  }).strict();
-}
-function environmentSpecSchema(setupSchema) {
-  return external_exports.object({
-    image: EnvironmentImageSchema,
-    env: SecretEnvSchema.default({}),
-    resources: EnvironmentResourcesSchema.optional(),
-    steps: external_exports.array(external_exports.string()).default([]),
-    setup: external_exports.array(setupSchema).default([]),
-    setupCache: EnvironmentSetupCacheSchema.optional()
-  }).strict();
-}
-function isSafeSandboxUserHomePath(value2, options = {}) {
-  return (options.allowedHomes ?? [CURRENT_SANDBOX_USER_HOME]).some(
-    (home) => isSafePathUnderHome(value2, home)
-  );
-}
-function isSafePathUnderHome(value2, home) {
-  const prefix = `${home}/`;
-  if (!value2.startsWith(prefix)) {
-    return false;
-  }
-  const relative = value2.slice(prefix.length);
-  return relative.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-function isSafeRelativePath(value2) {
-  if (!value2 || value2.startsWith("/")) {
-    return false;
-  }
-  return value2.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-function isSetupCacheTtl(value2) {
-  return /^[1-9][0-9]*(s|m|h|d)$/.test(value2);
-}
-
-// ../../packages/schemas/src/mcp.ts
-var McpToolCallMessageSchema = external_exports.object({
-  method: external_exports.literal("tools/call"),
-  params: external_exports.object({
-    name: external_exports.string().trim().min(1)
-  })
-});
-var McpJsonRpcMessageSchema = external_exports.object({
-  method: external_exports.string().optional()
-}).passthrough();
-var McpPostBodySchema = external_exports.union([McpJsonRpcMessageSchema, external_exports.array(McpJsonRpcMessageSchema)]).transform((body) => Array.isArray(body) ? body : [body]);
-
 // ../../packages/schemas/src/mounts.ts
 var AbsoluteMountPathSchema = external_exports.string().trim().min(1).refine((value2) => value2.startsWith("/"), {
   message: "Mount paths must be absolute"
@@ -21106,35 +20944,52 @@ var SessionMountSchema = external_exports.discriminatedUnion("kind", [
   GitMountSchema
 ]);
 
-// ../../packages/schemas/src/project-service-accounts.ts
-var ProjectServiceAccountSchema = external_exports.object({
-  id: ServiceAccountIdSchema,
-  organizationId: OrganizationIdSchema,
-  projectId: ProjectIdSchema,
-  name: ResourceNameSchema,
-  scopes: external_exports.array(AuthScopeSchema),
-  createdAt: external_exports.string().datetime()
-});
-var ProjectServiceAccountCreateRequestSchema = external_exports.object({
-  name: ResourceNameSchema,
-  scopes: external_exports.array(AuthScopeSchema).min(1)
+// ../../packages/schemas/src/secrets.ts
+var SECRET_ENCRYPTION_ALGORITHM = "AES-256-GCM";
+var SecretEnvNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
+var SecretCiphertextFieldSchema = external_exports.string().trim().min(1).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/);
+var SecretAesGcmIvSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{16}$/);
+var SecretAesGcmAuthTagSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{22}==$/);
+var SecretEnvValueSchema = external_exports.union([
+  external_exports.string(),
+  external_exports.object({
+    $secret: ResourceNameSchema,
+    optional: external_exports.boolean().optional()
+  })
+]);
+var SecretEnvSchema = external_exports.record(
+  SecretEnvNameSchema,
+  SecretEnvValueSchema
+);
+var EncryptedSecretValueSchema = external_exports.object({
+  keyVersion: external_exports.string().trim().min(1),
+  algorithm: external_exports.literal(SECRET_ENCRYPTION_ALGORITHM),
+  ciphertext: SecretCiphertextFieldSchema,
+  valueIv: SecretAesGcmIvSchema,
+  valueAuthTag: SecretAesGcmAuthTagSchema,
+  encryptedDek: SecretCiphertextFieldSchema,
+  dekIv: SecretAesGcmIvSchema,
+  dekAuthTag: SecretAesGcmAuthTagSchema
 });
-var ProjectServiceAccountUpdateRequestSchema = external_exports.object({
-  scopes: external_exports.array(AuthScopeSchema).min(1)
+var SecretSetRequestSchema = external_exports.object({
+  value: external_exports.string()
 });
-var ProjectServiceAccountTokenResponseSchema = external_exports.object({
-  serviceAccount: ProjectServiceAccountSchema,
-  token: external_exports.string().min(1)
+var SecretMetadataSchema = external_exports.object({
+  id: external_exports.string().trim().min(1),
+  organizationId: external_exports.string().trim().min(1),
+  projectId: external_exports.string().trim().min(1).nullable(),
+  name: ResourceNameSchema,
+  createdAt: external_exports.string().datetime(),
+  updatedAt: external_exports.string().datetime()
 });
-var ProjectServiceAccountUpdateResponseSchema = external_exports.object({
-  serviceAccount: ProjectServiceAccountSchema
+var SecretSetResponseSchema = external_exports.object({
+  secret: SecretMetadataSchema
 });
-var ProjectServiceAccountRemoveResponseSchema = external_exports.object({
-  serviceAccount: ProjectServiceAccountSchema,
-  removed: external_exports.literal(true)
+var SecretListResponseSchema = external_exports.object({
+  secrets: external_exports.array(SecretMetadataSchema)
 });
-var ProjectServiceAccountListResponseSchema = external_exports.object({
-  serviceAccounts: external_exports.array(ProjectServiceAccountSchema)
+var SecretDeleteResponseSchema = external_exports.object({
+  secret: SecretMetadataSchema
 });
 
 // ../../packages/schemas/src/tools.ts
@@ -21609,13 +21464,13 @@ var SessionIdentitySchema = external_exports.object({
     }
   ).optional()
 }).strict().refine((identity) => Object.keys(identity).length > 0, {
-  message: "Session identity requires at least one field"
+  message: "Identity requires at least one field"
 });
 var SessionSpecFieldsSchema = external_exports.object({
   harness: external_exports.enum(SESSION_HARNESSES).optional(),
   systemPrompt: external_exports.string().trim().min(1).max(1e5).optional(),
   environment: ResourceNameSchema.optional(),
-  identity: SessionIdentitySchema.optional(),
+  identity: external_exports.union([ResourceNameSchema, SessionIdentitySchema]).optional(),
   initialPrompt: external_exports.string().trim().min(1).max(2e4).optional(),
   env: SecretEnvSchema.default({}),
   mounts: external_exports.array(SessionMountSchema).default([]),
@@ -21888,11 +21743,167 @@ function hasFilterValue(trigger, path2, expected) {
   return trigger.where?.[path2] === expected;
 }
 
+// ../../packages/schemas/src/identities.ts
+var RESOURCE_KIND_IDENTITY = "identity";
+var IdentitySpecSchema = SessionIdentitySchema;
+var IdentityResourceSchema = resourceEnvelopeSchema(IdentitySpecSchema);
+var IdentityApplyRequestSchema = resourceApplySchema(IdentitySpecSchema);
+
+// ../../packages/schemas/src/environments.ts
+var RESOURCE_KIND_ENVIRONMENT = "environment";
+var CURRENT_SANDBOX_USER_HOME = "/home/user";
+var LEGACY_SANDBOX_USER_HOMES = ["/home/auto", "/home/node"];
+var STORED_SANDBOX_USER_HOMES = [
+  CURRENT_SANDBOX_USER_HOME,
+  ...LEGACY_SANDBOX_USER_HOMES
+];
+var EnvironmentSetupCachePathSchema = external_exports.string().trim().refine((value2) => isSafeSandboxUserHomePath(value2), {
+  message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
+});
+var StoredEnvironmentSetupCachePathSchema = external_exports.string().trim().refine(
+  (value2) => isSafeSandboxUserHomePath(value2, {
+    allowedHomes: STORED_SANDBOX_USER_HOMES
+  }),
+  {
+    message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
+  }
+);
+var EnvironmentImageSchema = external_exports.object({
+  kind: external_exports.literal("preset"),
+  name: ResourceNameSchema
+}).strict();
+var EnvironmentSetupSchema = environmentSetupSchema(
+  StoredEnvironmentSetupCachePathSchema
+);
+var EnvironmentApplySetupSchema = environmentSetupSchema(
+  EnvironmentSetupCachePathSchema
+);
+var EnvironmentSetupCacheSchema = external_exports.object({
+  ttl: external_exports.string().trim().refine(isSetupCacheTtl, {
+    message: "Expected a positive setup cache TTL such as 30m, 24h, or 7d"
+  })
+}).strict();
+var EnvironmentResourcesSchema = external_exports.object({
+  cpuCount: external_exports.number().int().min(1).optional(),
+  memoryMB: external_exports.number().int().min(128).optional()
+}).strict().refine(
+  (resources) => resources.cpuCount !== void 0 || resources.memoryMB !== void 0,
+  {
+    message: "Expected at least one runtime resource setting"
+  }
+);
+var EnvironmentSpecSchema = environmentSpecSchema(
+  EnvironmentSetupSchema
+);
+var EnvironmentApplySpecSchema = environmentSpecSchema(
+  EnvironmentApplySetupSchema
+);
+var EnvironmentResourceSchema = resourceEnvelopeSchema(
+  EnvironmentSpecSchema
+);
+var EnvironmentApplyRequestSchema = resourceApplySchema(
+  EnvironmentApplySpecSchema
+);
+function environmentSetupSchema(cachePathSchema) {
+  return external_exports.object({
+    name: ResourceNameSchema,
+    commands: external_exports.array(external_exports.string().trim().min(1)).min(1),
+    cache: external_exports.object({
+      key: ResourceNameSchema.optional(),
+      files: external_exports.array(
+        external_exports.string().trim().refine(isSafeRelativePath, {
+          message: "Expected a relative path without traversal"
+        })
+      ).default([]),
+      paths: external_exports.array(cachePathSchema).default([])
+    }).strict().default({ files: [], paths: [] })
+  }).strict();
+}
+function environmentSpecSchema(setupSchema) {
+  return external_exports.object({
+    image: EnvironmentImageSchema,
+    env: SecretEnvSchema.default({}),
+    resources: EnvironmentResourcesSchema.optional(),
+    steps: external_exports.array(external_exports.string()).default([]),
+    setup: external_exports.array(setupSchema).default([]),
+    setupCache: EnvironmentSetupCacheSchema.optional()
+  }).strict();
+}
+function isSafeSandboxUserHomePath(value2, options = {}) {
+  return (options.allowedHomes ?? [CURRENT_SANDBOX_USER_HOME]).some(
+    (home) => isSafePathUnderHome(value2, home)
+  );
+}
+function isSafePathUnderHome(value2, home) {
+  const prefix = `${home}/`;
+  if (!value2.startsWith(prefix)) {
+    return false;
+  }
+  const relative = value2.slice(prefix.length);
+  return relative.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function isSafeRelativePath(value2) {
+  if (!value2 || value2.startsWith("/")) {
+    return false;
+  }
+  return value2.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function isSetupCacheTtl(value2) {
+  return /^[1-9][0-9]*(s|m|h|d)$/.test(value2);
+}
+
+// ../../packages/schemas/src/mcp.ts
+var McpToolCallMessageSchema = external_exports.object({
+  method: external_exports.literal("tools/call"),
+  params: external_exports.object({
+    name: external_exports.string().trim().min(1)
+  })
+});
+var McpJsonRpcMessageSchema = external_exports.object({
+  method: external_exports.string().optional()
+}).passthrough();
+var McpPostBodySchema = external_exports.union([McpJsonRpcMessageSchema, external_exports.array(McpJsonRpcMessageSchema)]).transform((body) => Array.isArray(body) ? body : [body]);
+
+// ../../packages/schemas/src/project-service-accounts.ts
+var ProjectServiceAccountSchema = external_exports.object({
+  id: ServiceAccountIdSchema,
+  organizationId: OrganizationIdSchema,
+  projectId: ProjectIdSchema,
+  name: ResourceNameSchema,
+  scopes: external_exports.array(AuthScopeSchema),
+  createdAt: external_exports.string().datetime()
+});
+var ProjectServiceAccountCreateRequestSchema = external_exports.object({
+  name: ResourceNameSchema,
+  scopes: external_exports.array(AuthScopeSchema).min(1)
+});
+var ProjectServiceAccountUpdateRequestSchema = external_exports.object({
+  scopes: external_exports.array(AuthScopeSchema).min(1)
+});
+var ProjectServiceAccountTokenResponseSchema = external_exports.object({
+  serviceAccount: ProjectServiceAccountSchema,
+  token: external_exports.string().min(1)
+});
+var ProjectServiceAccountUpdateResponseSchema = external_exports.object({
+  serviceAccount: ProjectServiceAccountSchema
+});
+var ProjectServiceAccountRemoveResponseSchema = external_exports.object({
+  serviceAccount: ProjectServiceAccountSchema,
+  removed: external_exports.literal(true)
+});
+var ProjectServiceAccountListResponseSchema = external_exports.object({
+  serviceAccounts: external_exports.array(ProjectServiceAccountSchema)
+});
+
 // ../../packages/schemas/src/project-resources.ts
 var EnvironmentApplyDocumentSchema = resourceApplyDocumentSchema(
   RESOURCE_KIND_ENVIRONMENT,
   EnvironmentApplyRequestSchema.shape.spec
 );
+var IdentityApplyDocumentSchema = resourceApplyDocumentSchema(
+  RESOURCE_KIND_IDENTITY,
+  IdentityApplyRequestSchema.shape.spec
+);
 var ToolApplyDocumentSchema = resourceApplyDocumentSchema(
   RESOURCE_KIND_TOOL,
   ToolApplyRequestSchema.shape.spec
@@ -21903,11 +21914,13 @@ var SessionApplyDocumentSchema = resourceApplyDocumentSchema(
 );
 var ProjectApplyResourceSchema = external_exports.discriminatedUnion("kind", [
   EnvironmentApplyDocumentSchema,
+  IdentityApplyDocumentSchema,
   ToolApplyDocumentSchema,
   SessionApplyDocumentSchema
 ]);
 var PROJECT_RESOURCE_APPLY_ORDER = [
   RESOURCE_KIND_ENVIRONMENT,
+  RESOURCE_KIND_IDENTITY,
   RESOURCE_KIND_TOOL,
   RESOURCE_KIND_SESSION
 ];
@@ -21953,6 +21966,7 @@ var ProjectApplySystemConfigSchema = external_exports.object({
 });
 var ProjectAppliedResourceSchema = external_exports.union([
   EnvironmentResourceSchema,
+  IdentityResourceSchema,
   ToolResourceSchema,
   SessionResourceSchema
 ]);
@@ -21964,6 +21978,7 @@ var ProjectApplyDiagnosticSchema = external_exports.object({
   action: external_exports.enum(["create", "update", "unchanged"]),
   kind: external_exports.enum([
     RESOURCE_KIND_ENVIRONMENT,
+    RESOURCE_KIND_IDENTITY,
     RESOURCE_KIND_TOOL,
     RESOURCE_KIND_SESSION
   ]),
@@ -21979,6 +21994,7 @@ var ProjectApplyResponseSchema = external_exports.object({
       action: external_exports.enum(["create", "update", "unchanged", "archive"]),
       kind: external_exports.enum([
         RESOURCE_KIND_ENVIRONMENT,
+        RESOURCE_KIND_IDENTITY,
         RESOURCE_KIND_TOOL,
         RESOURCE_KIND_SESSION
       ]),
@@ -21990,6 +22006,7 @@ var ProjectApplyResponseSchema = external_exports.object({
     external_exports.object({
       kind: external_exports.enum([
         RESOURCE_KIND_ENVIRONMENT,
+        RESOURCE_KIND_IDENTITY,
         RESOURCE_KIND_TOOL,
         RESOURCE_KIND_SESSION
       ]),
@@ -26266,7 +26283,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.129",
+  version: "0.1.130",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"