@bnbagent/deploy-provider-bnb 0.3.1 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bnbagent/deploy-provider-bnb",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "type": "module",
   "description": "BNB Chain trial-platform provider for @bnbagent/deploy — deploys agents to the managed free-trial runtime (bnbagent-api) over plain HTTPS: GitHub device-flow login, zip artifact upload, deploy + poll. No cloud credentials of your own.",
   "license": "Apache-2.0",
@@ -17,10 +17,10 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@bnbagent/deploy-core": "*"
+    "@bnbagent/deploy-core": "^0.4.0"
   },
   "devDependencies": {
-    "@bnbagent/deploy-core": "^0.3.1",
+    "@bnbagent/deploy-core": "^0.4.0",
     "@types/bun": "^1.3.0",
     "typescript": "^5.7.0"
   }

package/src/client.ts

@@ -16,7 +16,21 @@ import { loadSession, saveSession, withSessionLock, type Session } from "./sessi
  */
 export function apiUrl(ctx: Context): string {
   const fromSpec = ctx.overrides?.bnb?.apiUrl;
-  const url = (typeof fromSpec === "string" && fromSpec) || process.env.BNBAGENT_API_URL;
+  const fromEnv = process.env.BNBAGENT_API_URL?.trim();
+  const hasApiToken = Boolean(process.env.BNBAGENT_API_TOKEN?.trim());
+  // An API token is normally injected by CI while the TOML comes from the
+  // checked-out repository. Bind that credential to the trusted environment
+  // endpoint so repository config cannot redirect it to another HTTPS origin.
+  if (hasApiToken && !fromEnv) {
+    throw new BnbApiError(
+      0,
+      "config.token_api_url_missing",
+      "BNBAGENT_API_TOKEN requires BNBAGENT_API_URL so the CI credential is bound to a trusted origin.",
+    );
+  }
+  const url = hasApiToken
+    ? fromEnv
+    : (typeof fromSpec === "string" && fromSpec.trim()) || fromEnv;
   if (!url) {
     throw new BnbApiError(
       0,

package/src/index.ts

@@ -93,6 +93,10 @@ function slugPath(id: string): string {
   return encodeURIComponent(id);
 }
 
+export function isFreshSlugError(error: unknown): boolean {
+  return error instanceof BnbApiError && error.status === 404;
+}
+
 /**
  * The HARD spec contract for bnb/trial. validate() reports these early;
  * deploy() re-asserts UNCONDITIONALLY — --force / skipValidation only skip the
@@ -153,7 +157,8 @@ async function slugRetiredIssue(name: string, ctx: Context): Promise<string | un
     if (agent.state === "deleted" || agent.state === "reclaiming") return retired;
   } catch (e) {
     if (e instanceof BnbApiError && (e.status === 410 || e.code === "agent.deleted")) return retired;
-    // 404 = fresh slug; anything else (auth/network) is another gate's job.
+    if (isFreshSlugError(e)) return undefined;
+    throw e;
   }
   return undefined;
 }
@@ -346,6 +351,23 @@ const bnbProvider: CloudProvider = {
           "Run: bnbagent-deploy login --provider bnb (against the current apiUrl), or fix [bnb] apiUrl / BNBAGENT_API_URL.",
       });
     }
+    let authReady = false;
+    if ((apiToken || session) && base && !issues.some((i) => i.code === "auth.host_mismatch")) {
+      try {
+        await authedRequest(ctx, "GET", "/v1/account");
+        authReady = true;
+      } catch (e) {
+        const err = e instanceof BnbApiError ? e : undefined;
+        issues.push({
+          level: "error",
+          code: err?.code ?? "auth.unavailable",
+          message: `Trial-platform authentication failed: ${(e as Error).message}`,
+          ...(err?.status === 401
+            ? { hint: "Re-run login, or replace the revoked/expired BNBAGENT_API_TOKEN." }
+            : {}),
+        });
+      }
+    }
     try {
       if (!base) throw new Error("no endpoint");
       const campaign: CampaignStatus = await publicRequest(base, "GET", "/v1/campaign");
@@ -365,14 +387,22 @@ const bnbProvider: CloudProvider = {
     }
     // Doomed-deploy precheck (needs working auth): a deleted slug is
     // retired forever — deploy would fail AFTER uploading the artifact.
-    if ((apiToken || session) && base && !issues.some((i) => i.code === "auth.host_mismatch")) {
-      const retired = await slugRetiredIssue(spec.name, ctx);
-      if (retired) {
+    if (authReady && base) {
+      try {
+        const retired = await slugRetiredIssue(spec.name, ctx);
+        if (retired) {
+          issues.push({
+            level: "error",
+            code: "agent.retired",
+            message: retired,
+            hint: "Pick a new agent name (slug) in agent-deploy.toml.",
+          });
+        }
+      } catch (e) {
         issues.push({
           level: "error",
-          code: "agent.retired",
-          message: retired,
-          hint: "Pick a new agent name (slug) in agent-deploy.toml.",
+          code: e instanceof BnbApiError ? e.code : "agent.precheck_failed",
+          message: `Could not verify the agent slug: ${(e as Error).message}`,
         });
       }
     }
@@ -419,7 +449,7 @@ const bnbProvider: CloudProvider = {
         );
       }
       if (!(e instanceof BnbApiError)) throw e; // the retired-slug Error above
-      // 404 = fresh slug; other API/network errors are the next call's problem.
+      if (!isFreshSlugError(e)) throw e;
     }
 
     const shipped = spec.type === "zip" ? await shipZipArtifact(spec, ctx) : await shipImageArtifact(spec, ctx);

package/src/init.ts

@@ -26,6 +26,9 @@ export async function initCmd(ctx: Context): Promise<void> {
   const defaultName = slugify(basename(ctx.baseDir));
   const name = process.stdin.isTTY ? slugify(ask(`Agent name (slug) [${defaultName}]: `) || defaultName) : defaultName;
   const apiUrl = process.stdin.isTTY ? ask("Trial platform URL (https://…): ") : "";
+  const apiUrlLine = apiUrl
+    ? `apiUrl = ${JSON.stringify(apiUrl)}`
+    : '# apiUrl = "https://<the-trial-platform-host>" # Or set BNBAGENT_API_URL';
 
   const toml = `name = "${name}"
 
@@ -37,7 +40,7 @@ entrypoint = "main.py"           # .py → Python · .js/.mjs/.cjs → Node (zip
 # protocol = "A2A"               # or "MCP" — buyers then authenticate via the platform token plane
 
 [bnb]
-apiUrl = "${apiUrl || "https://<the-trial-platform-host>"}"
+${apiUrlLine}
 
 # [env]                          # non-sensitive runtime config (plaintext)
 # MY_FLAG = "1"