@chibitek/chibi 0.1.161 → 0.1.168

package/dist-server/drivers/agents-proxy.js

@@ -9,6 +9,12 @@ import readline from "node:readline";
 
 // shared/credential-request.ts
 var CREDENTIAL_TARGETS = {
+  connectionSecret: {
+    label: "Connection credential",
+    description: "A password, API key or token for the named connection.",
+    placeholder: "Enter the credential",
+    helpUrl: ""
+  },
   xaiApiKey: {
     label: "xAI API key",
     description: "Used by the built-in Grok provider.",
@@ -50,6 +56,63 @@ function isCredentialTargetId(value) {
   return typeof value === "string" && Object.prototype.hasOwnProperty.call(CREDENTIAL_TARGETS, value);
 }
 
+// server/drivers/agents-credential.ts
+async function requestCredential(args, BOT_ID, THREAD_ID, api) {
+  const credentialId = args.credential_id;
+  if (!isCredentialTargetId(credentialId)) {
+    return { text: "request_credential needs a supported credential_id.", isError: true };
+  }
+  const reason = typeof args.reason === "string" ? args.reason.trim().slice(0, 240) : "";
+  const r = await api("/api/internal/request-credential", {
+    method: "POST",
+    body: JSON.stringify({
+      fromBotId: BOT_ID,
+      fromThreadId: THREAD_ID,
+      credentialId,
+      ...credentialId === "connectionSecret" ? { connection: args.connection } : {},
+      ...reason ? { reason } : {}
+    })
+  });
+  if (r.error) return { text: String(r.error), isError: true };
+  if (r.alreadyConfigured) {
+    return { text: `${r.label ?? CREDENTIAL_TARGETS[credentialId].label} is already configured. Continue the task.` };
+  }
+  return {
+    text: `A secure ${r.label ?? CREDENTIAL_TARGETS[credentialId].label} request is ready. The desktop app and a freshly QR-paired mobile app show its secure entry card; older mobile pairings explain how to pair again or finish on the computer. End this turn; Atomic will resume the task after the user saves or declines. Never ask them to paste the key into chat.`
+  };
+}
+var credentialTool = {
+  name: "request_credential",
+  description: "Ask for a password, API key or token through Atomic's secure credential flow. Use connectionSecret with connection details for any HTTPS MCP service, or a built-in credential_id for a provider. The desktop app and a freshly QR-paired mobile app show a secure entry card; older mobile pairings show how to pair again or finish on the computer. Never claim a secure field opened unless this request succeeds, and never ask the user to paste a secret into chat. The secret is saved by the desktop app and is never returned to you. After calling this tool, end the turn; Atomic resumes the task after the user saves or declines.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      credential_id: {
+        type: "string",
+        enum: Object.keys(CREDENTIAL_TARGETS),
+        description: "The credential the current task requires."
+      },
+      connection: {
+        type: "object",
+        description: "Required for connectionSecret. The person reviews this HTTPS MCP destination before entering a password, API key or token. Never include the secret here.",
+        properties: {
+          name: { type: "string", description: "MCP server name." },
+          url: { type: "string", description: "Official HTTPS MCP URL, without credentials or query parameters." },
+          header: { type: "string", description: "Credential header name, for example x-api-key or Authorization." },
+          prefix: { type: "string", enum: ["Bearer "], description: "Only when the service requires a Bearer token." }
+        },
+        required: ["name", "url", "header"],
+        additionalProperties: false
+      },
+      reason: {
+        type: "string",
+        description: "Optional short, non-sensitive explanation of why the task needs it."
+      }
+    },
+    required: ["credential_id"]
+  }
+};
+
 // server/agent-tool-policy.ts
 var READ_ONLY_AGENT_TOOL_NAMES = /* @__PURE__ */ new Set([
   "list_bots",
@@ -523,25 +586,7 @@ var toolDefinitions = (externalRuntime) => [
       required: ["room_id", "action"]
     }
   },
-  {
-    name: "request_credential",
-    description: "Ask the user for a supported API key through Atomic's secure credential flow. The desktop app and a freshly QR-paired mobile app show a secure entry card; older mobile pairings show how to pair again or finish on the computer. Never claim a secure field opened unless this request succeeds, and never ask the user to paste a secret into chat. The secret is saved by the desktop app and is never returned to you. After calling this tool, end the turn; Atomic resumes the task after the user saves or declines.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        credential_id: {
-          type: "string",
-          enum: Object.keys(CREDENTIAL_TARGETS),
-          description: "The credential the current task requires."
-        },
-        reason: {
-          type: "string",
-          description: "Optional short, non-sensitive explanation of why the task needs it."
-        }
-      },
-      required: ["credential_id"]
-    }
-  },
+  credentialTool,
   {
     name: "marketplace_search",
     description: "Find an app or service the person wants connected in Atomic's Marketplace: official servers Atomic connects, and official apps through their Claude account. Then call open_marketplace. Never offer to build a connection or a community server.",
@@ -17118,28 +17163,7 @@ ${lines.join("\n")}` };
     const message = typeof r.message === "string" ? r.message : `Updated room ${roomId}.`;
     return { text: message };
   }
-  if (name === "request_credential") {
-    const credentialId = args.credential_id;
-    if (!isCredentialTargetId(credentialId)) {
-      return { text: "request_credential needs a supported credential_id.", isError: true };
-    }
-    const reason = typeof args.reason === "string" ? args.reason.trim().slice(0, 240) : "";
-    const r = await api("/api/internal/request-credential", {
-      method: "POST",
-      body: JSON.stringify({
-        fromBotId: BOT_ID,
-        fromThreadId: THREAD_ID,
-        credentialId,
-        ...reason ? { reason } : {}
-      })
-    });
-    if (r.alreadyConfigured) {
-      return { text: `${r.label ?? CREDENTIAL_TARGETS[credentialId].label} is already configured. Continue the task.` };
-    }
-    return {
-      text: `A secure ${r.label ?? CREDENTIAL_TARGETS[credentialId].label} request is ready. The desktop app and a freshly QR-paired mobile app show its secure entry card; older mobile pairings explain how to pair again or finish on the computer. End this turn; Atomic will resume the task after the user saves or declines. Never ask them to paste the key into chat.`
-    };
-  }
+  if (name === "request_credential") return requestCredential(args, BOT_ID, THREAD_ID, api);
   if (name === "list_routines") {
     const query = new URLSearchParams({ fromBotId: BOT_ID, fromThreadId: THREAD_ID });
     const r = await api(`/api/internal/routines?${query.toString()}`);